flat assembler
Message board for the users of flat assembler.

Index > Windows > Compiled size

Author
Thread Post new topic Reply to topic
MUFOS



Joined: 17 Apr 2016
Posts: 47
MUFOS
Hey,

I was wondering why while I am making a program, the compiled size is, for instance, 4096 bytes. It stays like that for a while, but after some lines, it could suddenly spike up to 4608 bytes.

Why this kind of increase? Why doesn't it increase as I add the new lines, why only after multiple lines of code?
Post 30 May 2016, 13:21
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17665
Location: In your JS exploiting you and your system
revolution
PE format is aligned to 512 bytes. 4608-4096=512
Post 30 May 2016, 14:13
View user's profile Send private message Visit poster's website Reply with quote
MUFOS



Joined: 17 Apr 2016
Posts: 47
MUFOS
revolution wrote:
PE format is aligned to 512 bytes. 4608-4096=512


Thank you, I was suspecting something along those lines.
Post 30 May 2016, 16:52
View user's profile Send private message Reply with quote
Grom PE



Joined: 13 Mar 2008
Posts: 114
Location: i@grompe.org.ru
Grom PE
Technically the "physical size" of the last section of a PE exe can be other than multiple of 512 bytes.
But I could find only a handful of such files on my computer, I wonder if there's a disadvantage in doing this?
Post 31 May 2016, 08:38
View user's profile Send private message Visit poster's website Reply with quote
Mikl___



Joined: 30 Dec 2014
Posts: 117
Mikl___
Hi, revolution!
MASM has /ALIGN[:number] option specifies the alignment of each section within the linear address space of the program. The number argument is in bytes and must be a power of two. The smallest value that can be set link.exe is 16. Force may for PE-file alignment can be set to 4 and PE-file is working. See Tiny PE in win64
Post 31 May 2016, 09:05
View user's profile Send private message Visit poster's website Reply with quote
Tomasz Grysztar



Joined: 16 Jun 2003
Posts: 7796
Location: Kraków, Poland
Tomasz Grysztar
You can freely experiment with the alignment settings when you use the PE formatting macros that come with fasmg:
Code:
PE.Settings.Magic = 0x20B
PE.Settings.Machine = IMAGE_FILE_MACHINE_AMD64
PE.Settings.Subsystem = IMAGE_SUBSYSTEM_WINDOWS_GUI
PE.Settings.ImageBase = 0x140000000
PE.Settings.SectionAlignment = 4
PE.Settings.FileAlignment = 4

include 'x64.inc'
include 'format/pe.inc'

use64
entry start

section '.text' code readable executable

  start:
        sub     rsp,8*5         ; reserve stack for API use and make stack dqword aligned

        mov     r9d,0
        lea     r8,[_caption]
        lea     rdx,[_message]
        mov     rcx,0
        call    [MessageBoxA]

        mov     ecx,eax
        call    [ExitProcess]

section '.data' data readable writeable

  _caption db 'Win64 assembly program',0
  _message db 'Hello World!',0

section '.idata' import data readable writeable

  dd 0,0,0,RVA kernel_name,RVA kernel_table
  dd 0,0,0,RVA user_name,RVA user_table
  dd 0,0,0,0,0

  kernel_table:
    ExitProcess dq RVA _ExitProcess
    dq 0
  user_table:
    MessageBoxA dq RVA _MessageBoxA
    dq 0

  kernel_name db 'KERNEL32.DLL',0
  user_name db 'USER32.DLL',0

  _ExitProcess dw 0
    db 'ExitProcess',0
  _MessageBoxA dw 0
    db 'MessageBoxA',0    
You may notice that Windows will accept only few of the variants and this depends on the version of Windows and subsystem, too. The default settings (and the ones that fasm 1 uses) are: SectionAlignment = 4096, FileAlignment = 512. As far as I know, these are the only ones that are guaranteed to work correctly everywhere.


Last edited by Tomasz Grysztar on 13 Sep 2016, 09:04; edited 1 time in total
Post 31 May 2016, 10:11
View user's profile Send private message Visit poster's website Reply with quote
Mikl___



Joined: 30 Dec 2014
Posts: 117
Mikl___
Hi, Tomasz Grysztar!
So, what I have written (SectionAlignment = FileAlignment = 4) works fine in 64-bits Win7 and Win10, and before that, try out the 32-bit WinXP and Win7...
Post 31 May 2016, 10:38
View user's profile Send private message Visit poster's website Reply with quote
bitRAKE



Joined: 21 Jul 2003
Posts: 3044
Location: vpcmipstrm
bitRAKE
Windows 7 Home: if PE.Settings.ImageBase > 0x7FFF0000 then IMAGE_FILE_LARGE_ADDRESS_AWARE must be present. IMAGE_FILE_32BIT_MACHINE has never been needed for IMAGE_FILE_MACHINE_AMD64 targets, afaik.
Post 15 Sep 2016, 15:00
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.

Website powered by rwasa.