- Home
- Executable Packers
- TinyLoad
TinyLoad
What it is
TinyLoad v7.4 is an open-source packer and crypter for 64-bit Windows PE executables. It adds protection layers intended to make packed programs harder to reverse engineer. A packed file appends its payload to a copy of itself, then extracts, decrypts, and runs that payload in memory without writing the original payload to disk. Optional LZ77 compression uses hash-chain matching with a 64 KB sliding window. Its custom virtual machine has 28 opcodes in four independently keyed subtables, while XXTEA encrypts the payload. With VEH enabled, PE pages decrypt when accessed and a watchdog re-encrypts pages untouched for 200 milliseconds. TinyLoad also redirects four APIs through wrappers and clears the payload import directory after loading. It accepts x64 PE files and requires VM encryption, compression, or VEH. The MIT-licensed source builds with MinGW g++ or build.bat, and precompiled binaries are linked from GitHub Releases.
For and against
For
- Open-source MIT license
- Supports in-memory payload execution
- Offers VM encryption, compression, and VEH options
- Builds with MinGW g++ or build.bat
- Precompiled binaries are available
Against
- Supports only 64-bit PE files
- Requires at least one protection option
- Maker reports nine VirusTotal detections
- Intended for legitimate use only
The verdict
TinyLoad provides several configurable protection mechanisms for Windows x64 PE executables, including in-memory execution and page re-encryption. Its 64-bit-only scope, required options, and reported antivirus detections should be considered before use.
Who it suits
It suits Windows x64 developers or researchers who need an open-source PE packing tool. Users should understand its legitimate-use requirement and compatibility with 64-bit PE files.
On the record
- Anti-dump
- The site says TinyLoad redirects four APIs through wrapper functions and zeroes the payload’s import directory after loading.iamsopotatoe-coder.github.io · read 3 Oct 2026
- Antivirus detections
- The maker says packers are expected to be flagged and reports nine VirusTotal detections for TinyLoad and files packed with it.iamsopotatoe-coder.github.io · read 3 Oct 2026
- Build
- The maker says to build from source with MinGW (g++) or use build.bat.iamsopotatoe-coder.github.io · read 3 Oct 2026
- Build requirements
- The maker says to build from source with MinGW g++ or the included build.bat file, and describes the project as a single C++ source file with no external dependencies.github.com · read 3 Oct 2026
- Compatibility limit
- The maker says TinyLoad works on most files they have tested, and release notes state it supports only 64-bit PE files.iamsopotatoe-coder.github.io · read 3 Oct 2026
- Compression
- Its optional LZ77 compression uses hash-chain matching and a 64 KB sliding window.iamsopotatoe-coder.github.io · read 3 Oct 2026
- Downloads
- The maker links to GitHub Releases for precompiled binaries and also offers source code in the repository.github.com · read 3 Oct 2026
- Encryption
- Its 28 opcode virtual machine uses randomly placed opcodes in four independently keyed subtables, and the payload is encrypted using XXTEA.iamsopotatoe-coder.github.io · read 3 Oct 2026
- How it works
- It appends a payload to a copy of itself, then extracts, decrypts, and executes the payload in memory without writing the original to disk.iamsopotatoe-coder.github.io · read 3 Oct 2026
- In-memory execution
- The packed executable extracts and decrypts its payload, then executes it in memory without writing the original payload to disk.iamsopotatoe-coder.github.io · read 3 Oct 2026
- Input requirements
- The packer accepts x64 PE executables and requires at least one of the VM encryption, compression, or VEH options.github.com · read 3 Oct 2026
- Intended use
- The maker says TinyLoad is intended for legitimate purposes and asks users not to pack malware with it.iamsopotatoe-coder.github.io · read 3 Oct 2026
- License
- TinyLoad is licensed under MIT.iamsopotatoe-coder.github.io · read 3 Oct 2026
- Memory handling
- With VEH enabled, a vectored exception handler decrypts PE section pages on access and a watchdog re-encrypts pages untouched for 200ms.iamsopotatoe-coder.github.io · read 3 Oct 2026
- Page decryption
- With the optional VEH feature, pages are decrypted on access and a watchdog re-encrypts pages that have not been touched in 200 ms.iamsopotatoe-coder.github.io · read 3 Oct 2026
- Product
- TinyLoad v7.4 is an open-source PE packer and crypter for Windows x64 executables.github.com · read 3 Oct 2026
- Purpose
- TinyLoad v7.4 is a PE packer for Windows.iamsopotatoe-coder.github.io · read 3 Oct 2026
- Support
- The maker invites users to open an issue if TinyLoad breaks on their file and to submit suggestions or feature ideas through issues.iamsopotatoe-coder.github.io · read 3 Oct 2026
