title: Detecting UPX programmatically
body: <p>I'm trying to figure out how to detect whether a binary has been compressed with UPX. I am using a simple CRC to detect whether my app was in any way changed and if the CRC failed on the size due to a packer I would like to detect that as OK. </p>
  
  <p>Right now I am starting with UPX.</p>
  
  <p>So, is there any marker on the binary? are there any specific JMP or other instructions that I should search?<br>
  This will mainly be tested in Windows, but in the future I might add it to Linux as well.</p>
  
  <p>Any help (and code) is appreciated.</p>
  
  <p>ADDED:</p>
  
  <p>I found that in the 10 binaries I checked the </p>
  
  <p><code>AddressOfEntryPoint<br>
  Import Directory RVA<br>
  Resouce Directory RVA</code></p>
  
  <p>either point to UPX or have an offset that is set by UPX. Any information on this?</p>
  
  <p>Thanks</p>