TinyLoad

Spec sheet

Purpose

TinyLoad v7.4 is a PE packer for Windows.Read 3 Oct 2026 · iamsopotatoe-coder.github.io

Product

TinyLoad v7.4 is an open-source PE packer and crypter for Windows x64 executables.Read 3 Oct 2026 · github.com

Support

The maker invites users to open an issue if TinyLoad breaks on their file and to submit suggestions or feature ideas through issues.Read 3 Oct 2026 · iamsopotatoe-coder.github.io

License

TinyLoad is licensed under MIT.Read 3 Oct 2026 · iamsopotatoe-coder.github.io

Anti-dump

The site says TinyLoad redirects four APIs through wrapper functions and zeroes the payload’s import directory after loading.Read 3 Oct 2026 · iamsopotatoe-coder.github.io

Antivirus detections

The maker says packers are expected to be flagged and reports nine VirusTotal detections for TinyLoad and files packed with it.Read 3 Oct 2026 · iamsopotatoe-coder.github.io

Build

The maker says to build from source with MinGW (g++) or use build.bat.Read 3 Oct 2026 · iamsopotatoe-coder.github.io

Build requirements

The maker says to build from source with MinGW g++ or the included build.bat file, and describes the project as a single C++ source file with no external dependencies.Read 3 Oct 2026 · github.com

Compatibility limit

The maker says TinyLoad works on most files they have tested, and release notes state it supports only 64-bit PE files.Read 3 Oct 2026 · iamsopotatoe-coder.github.io

Compression

Its optional LZ77 compression uses hash-chain matching and a 64 KB sliding window.Read 3 Oct 2026 · iamsopotatoe-coder.github.io

Downloads

The maker links to GitHub Releases for precompiled binaries and also offers source code in the repository.Read 3 Oct 2026 · github.com

Encryption

Its 28 opcode virtual machine uses randomly placed opcodes in four independently keyed subtables, and the payload is encrypted using XXTEA.Read 3 Oct 2026 · iamsopotatoe-coder.github.io

How it works

It appends a payload to a copy of itself, then extracts, decrypts, and executes the payload in memory without writing the original to disk.Read 3 Oct 2026 · iamsopotatoe-coder.github.io

In-memory execution

The packed executable extracts and decrypts its payload, then executes it in memory without writing the original payload to disk.Read 3 Oct 2026 · iamsopotatoe-coder.github.io

Input requirements

The packer accepts x64 PE executables and requires at least one of the VM encryption, compression, or VEH options.Read 3 Oct 2026 · github.com

Intended use

The maker says TinyLoad is intended for legitimate purposes and asks users not to pack malware with it.Read 3 Oct 2026 · iamsopotatoe-coder.github.io

Memory handling

With VEH enabled, a vectored exception handler decrypts PE section pages on access and a watchdog re-encrypts pages untouched for 200ms.Read 3 Oct 2026 · iamsopotatoe-coder.github.io

Page decryption

With the optional VEH feature, pages are decrypted on access and a watchdog re-encrypts pages that have not been touched in 200 ms.Read 3 Oct 2026 · iamsopotatoe-coder.github.io

Usage requirements

At least one of --vm, --c, or --veh is required when packing an executable.Read 3 Oct 2026 · iamsopotatoe-coder.github.io

VM encryption

Its custom virtual machine uses 28 opcodes arranged in four subtables, and the payload is encrypted using XXTEA.Read 3 Oct 2026 · iamsopotatoe-coder.github.io

Where Specifiction places it

• Executable Packers#22 of 286.8