KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#developer-tools #typescript #dsh #dsh-plugin #ai-agent #codex #ai-agents #deepseek-harness #claude-code #cli #react #mcp

TinyLoad

★ 184 Open GitHub ↗

Open source Windows x64 PE packer and crypter. Compresses and encrypts executables with a custom virtual machine into a self extracting stub.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

## *TinyLoad v7.3 - PE packer for windows* 
<p align=”left">
  <img alt="Version" src="https://img.shields.io/badge/version-v7.2-e84393?style=plastic&logo=cplusplus&logoColor=white&labelColor=0d0d0d">
  <img alt="Actively Maintained" src="https://img.shields.io/badge/Actively%20Maintained-2ed573?style=plastic&logo=checkmarx&logoColor=white">
  <a href="https://github.com/gmh5225/awesome-game-security"><img src="https://awesome.re/mentioned-badge.svg" alt="Mentioned in Awesome" height="18"></a>
</p>

TinyLoad is an pe crypter/packer for x64 executables it packs an input exe with varying protection layers to prevent it from being reverse engineered. Its 1 single .cpp file and does not have any external dependencies.

## *how it works*

TinyLoad appends your payload to a copy of itself. when the packed exe runs it extracts the payload, decrypts it, and executes it directly in memory without ever writing the original to disk. every time you pack something the VM opcodes are randomly changed and put into 4 independently keyed subtables so no 2 builds are the same.

## *download*

grab a precompiled binary from [releases](https://github.com/iamsopotatoe-coder/tinyload/releases) or build it yourself.

## *building from source*

you need MinGW (g++). just run:

```cmd
g++ -o TinyLoad.exe TinyLoad.cpp -static -O2 -s
```

or use `build.bat`.

## *usage*

```cmd
TinyLoad.exe --i <input> [--o <output>] [--vm] [--c] [--veh]
```

| flag | what it does |
|------|-------------|
| `--i <file>` | input exe to pack |
| `--o <file>` | output path (default: `input_packed.exe`) |
| `--vm` | VM encryption |
| `--c` | LZ77 compression |
| `--veh` | VEH page fault decryption |
| `--noconsole` | GUI subsystem |

you need at least 1 of `--vm`, `--c`, or `--veh`.

### examples

## *DIE images*

## *compression*

custom LZ77 compression with hash chain matching and a 64KB sliding window. compression runs first, then VM encryption goes on top so any patterns in the compressed data get hidden too.

## *vm encryption*

custom 28 opcode virtual machine that runs inside the stub. the opcodes get randomly placed into 4 subtables of 8 each and every subtable is XOR encrypted with a different key derived from the payload data. cracking 1 subtable reveals at most 8 opcodes out of 28. the cipher itself is a 128 bit stream cipher using rotl and rotr key mixing run entirely inside the VM interpreter. The payload is encrypted using XXTEA.

## *veh page fault decryption*

with `--veh` enabled, all PE section pages get mapped as PAGE_NOACCESS. when the program tries to access a page it triggers an exception, a vectored exception handler decrypts just that 1 page and sets the correct protection. a watchdog thread runs in the background and re-encrypts any page that hasnt been touched in 200ms. at any given moment most of your program is still encrypted in memory so memory dumps only capture whatever was recently accessed.

## *anti dump*

the 4 most critical APIs (GetModuleHandleA, GetProcAddress, ExitProcess, VirtualAlloc) get redirected through wrapper functions inside the stub. after the payload is loaded the entire import directory gets zeroed so memory dumps cannot reconstruct the import table.

## *license*

MIT

## *sidenotes*

- There are alot of features that i didnt put into the readme, you can read the code yourself or look at [changelog.md](docs/CHANGELOG.md)
- this works on most files ive tested, if it breaks on yours open an issue and ill look into it
- suggestions and feature ideas go in issues too
- if you use it a star helps alot <3 
- yes AVs flag packers, thats expected. (Currently has 9 detections on virustotal, any file you pack with it gets 9 detections, the content doesnt matter)
- please dont pack malware with this, its intended for legitimate purposes

TinyLoad

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README