TinyLoad
simple PE packer with LZ77 compression and custom VM encryption for Windows executables.
simple PE packer with LZ77 compression and custom VM encryption for Windows executables.
v5 doubles down on anti-analysis. The payload is now worthless without the stub at runtime — dumping from memory gets you a broken executable with no import table.
Previous versions protected the payload at rest. v5 protects it at runtime too — even if an analyst dumps the decrypted payload from memory, they get an exe with no import table, IAT entries pointing to dead addresses, and no way to automatically remap them. They'd have to manually reverse every IAT slot by its stub address.
v4 is finally here. We focused heavily on anti-analysis and hardening to make TinyLoad practically invisible to standard debuggers and automated unpackers.
A virtual machine is great for hiding the decryption routine, but it doesn't help if an analyst can just step through it or dump the unpacked payload from memory right before execution. The new anti-debugging mechanisms prevent them from even starting the debugging process.
The section scrambling completely breaks automated tools that rely on specific packer signatures, forcing analysts to manually reverse the VM just to figure out where the payload actually lives.
TinyLoad is a simple tool for packing Windows executables. it compresses the input file and encrypts the payload using a custom virtual machine. when the packed executable runs, it spins up a VM interpreter, decrypts the payload, and loads it directly into RAM.
the whole thing is one .cpp file with no external dependencies.
TinyLoad.exe --i app.exe --c
TinyLoad.exe --i app.exe --o packed.exe --vm --c
TinyLoad.exe --i game.exe --vm
| Flag | What it does |
|---|---|
--i <file> |
input executable to pack |
--o <file> |
output path, defaults to inputname_packed.exe |
--vm |
encrypt payload with custom VM, randomized ISA every build |
--c |
compress with LZ77 |
custom hash-chain LZ77 with a 64KB sliding window and deep chain search. uses lazy match evaluation to pick better matches. compression runs on the raw PE first, then VM encryption is applied on top so patterns in the compressed stream are also hidden.
a custom 32-opcode VM interpreter is embedded in the stub. at pack time the opcode table is randomly shuffled — so every packed file has a different instruction set. the decryption program is stored as bytecode with 128-bit keys embedded as immediate values. v5 adds multiple opaque predicates, junk instruction scattering, and encrypted decode tables to make VM tracing infeasible without fully reversing the interpreter.
v5 redirects critical payload imports through stub-resident wrappers and wipes the import directory after loading. a dumped payload has no import table and IAT entries pointing into dead addresses. automated reconstruction is impossible — every slot must be manually reversed.
grab the source on GitHub or download the latest build: releases.