What is the minimum file size of a PE file (exe) on Windows? And the minimal memory allocation? [duplicate]

This question already has answers here: What is the smallest possible Windows (PE) executable? (2 answers) Closed 7 years ago.

What is the minimum file size of a PE file (exe) on Windows? And the minimum memory allocation?

I assembled (using MASM (ml.exe) and link.exe that come with VS 10) the following code: I can not leave out kernel32.lib and ExitProcess, if I do, the program crashes.

; Assmebly options
.386
.MODEL FLAT, STDCALL
option casemap:none

; Include Libs
includelib kernel32.lib

; Imported symbols
ExitProcess PROTO :Dword
Sleep PROTO :Dword

; Code
.CODE

start:
    invoke Sleep, 10000
    invoke ExitProcess, 0
END start

The Sleep command is included only to be able to read the memory usage before the program ends.

Now I measure the following: The .exe file is exactly 2.5 KB in size (if I inclu开发者_开发技巧de user32.lib and MessageBoxA, it becomes 3 KB in size --> blocks?) and the application uses 136 KB RAM when it's run (Vista 32bit).

Isn't that somewhat much memory for such a simple program? Why is the exe file so large, and the RAM requirement much larger than the exe file?

Are there some minimal memory sizes? What about the file? It looks like it's organized in blocks of 0.5 KB in size, but isn't it 0.5 KB then for this shortest possible program?

Where can I read about this (except http://msdn.microsoft.com/en-us/magazine/cc301805.aspx which I will check out)?

Thanks (my first question here)

---

ntdll.dll is mapped into every single process and does a lot of basic initialization before your code starts running. This will always cause a small amount of private memory to be allocated. Take a look at LdrpInitializeProcess; here's a small list of things:

• It creates the process heap.
• It sets up the activation context stack for the current thread.
• It initializes several critical sections. This will almost always cause memory to be allocated.

Also, other DLLs that get loaded into your process (e.g. kernel32.dll, user32.dll) will probably allocate memory themselves, in their DllMain functions.

EDIT: Take a look at this simple test program I created:

It's a completely native program (no Win32), and imports just two functions from ntdll.dll: NtDelayExecution and NtTerminateProcess. It's very similar to your program, and even though it doesn't do anything except sleep, it still uses 100 kB of private memory. The file is 2.5 kB in size, just like your program.

---

This is a very good page on exactly this subject, if you haven't read it already:

http://www.phreedom.org/research/tinype/

---

Remember, that even though it might say "using 136KB" of memory, the majority of that is shared between all the applications. You really need to check out the private bytes, and even then, there are other factors like the default heap reservation, etc. The Windows OS would rather your apps run faster than to save RAM - wasted memory doesn't help anything.