Index
> Windows > Compiled size |
| Author |
|
|
revolution 30 May 2016, 14:13
PE format is aligned to 512 bytes. 4608-4096=512
|
|||
30 May 2016, 14:13 |
|
|
MUFOS 30 May 2016, 16:52
revolution wrote: PE format is aligned to 512 bytes. 4608-4096=512 Thank you, I was suspecting something along those lines. |
|||
|
30 May 2016, 16:52 |
|
|
Grom PE 31 May 2016, 08:38
Technically the "physical size" of the last section of a PE exe can be other than multiple of 512 bytes.
But I could find only a handful of such files on my computer, I wonder if there's a disadvantage in doing this? |
|||
|
31 May 2016, 08:38 |
|
|
Mikl___ 31 May 2016, 09:05
Hi, revolution!
MASM has /ALIGN[:number] option specifies the alignment of each section within the linear address space of the program. The number argument is in bytes and must be a power of two. The smallest value that can be set link.exe is 16. Force may for PE-file alignment can be set to 4 and PE-file is working. See Tiny PE in win64 |
|||
|
31 May 2016, 09:05 |
|
|
Tomasz Grysztar 31 May 2016, 10:11
You can freely experiment with the alignment settings when you use the PE formatting macros that come with fasmg:
Code: PE.Settings.Magic = 0x20B PE.Settings.Machine = IMAGE_FILE_MACHINE_AMD64 PE.Settings.Subsystem = IMAGE_SUBSYSTEM_WINDOWS_GUI PE.Settings.ImageBase = 0x140000000 PE.Settings.SectionAlignment = 4 PE.Settings.FileAlignment = 4 include 'x64.inc' include 'format/pe.inc' use64 entry start section '.text' code readable executable start: sub rsp,8*5 ; reserve stack for API use and make stack dqword aligned mov r9d,0 lea r8,[_caption] lea rdx,[_message] mov rcx,0 call [MessageBoxA] mov ecx,eax call [ExitProcess] section '.data' data readable writeable _caption db 'Win64 assembly program',0 _message db 'Hello World!',0 section '.idata' import data readable writeable dd 0,0,0,RVA kernel_name,RVA kernel_table dd 0,0,0,RVA user_name,RVA user_table dd 0,0,0,0,0 kernel_table: ExitProcess dq RVA _ExitProcess dq 0 user_table: MessageBoxA dq RVA _MessageBoxA dq 0 kernel_name db 'KERNEL32.DLL',0 user_name db 'USER32.DLL',0 _ExitProcess dw 0 db 'ExitProcess',0 _MessageBoxA dw 0 db 'MessageBoxA',0 Last edited by Tomasz Grysztar on 13 Sep 2016, 09:04; edited 1 time in total |
|||
|
31 May 2016, 10:11 |
|
|
Mikl___ 31 May 2016, 10:38
Hi, Tomasz Grysztar!
So, what I have written (SectionAlignment = FileAlignment = 4) works fine in 64-bits Win7 and Win10, and before that, try out the 32-bit WinXP and Win7... |
|||
|
31 May 2016, 10:38 |
|
|
bitRAKE 15 Sep 2016, 15:00
Windows 7 Home: if PE.Settings.ImageBase > 0x7FFF0000 then IMAGE_FILE_LARGE_ADDRESS_AWARE must be present. IMAGE_FILE_32BIT_MACHINE has never been needed for IMAGE_FILE_MACHINE_AMD64 targets, afaik.
|
|||
|
15 Sep 2016, 15:00 |
|
< Last Thread | Next Thread > |
Forum Rules:
|