4

What is the minimum file size of a PE file (exe) on Windows? And the minimum memory allocation?

I assembled (using MASM (ml.exe) and link.exe that come with VS 10) the following code: I can not leave out kernel32.lib and ExitProcess, if I do, the program crashes. 

; Assmebly options
.386
.MODEL FLAT, STDCALL
option casemap:none

; Include Libs
includelib kernel32.lib

; Imported symbols
ExitProcess PROTO :Dword
Sleep PROTO :Dword

; Code
.CODE

start:
    invoke Sleep, 10000
    invoke ExitProcess, 0
END start

The Sleep command is included only to be able to read the memory usage before the program ends.

Now I measure the following: The .exe file is exactly 2.5 KB in size (if I include user32.lib and MessageBoxA, it becomes 3 KB in size --> blocks?) and the application uses 136 KB RAM when it's run (Vista 32bit).

Isn't that somewhat much memory for such a simple program? Why is the exe file so large, and the RAM requirement much larger than the exe file?

Are there some minimal memory sizes? What about the file? It looks like it's organized in blocks of 0.5 KB in size, but isn't it 0.5 KB then for this shortest possible program?

Where can I read about this (except http://msdn.microsoft.com/en-us/magazine/cc301805.aspx which I will check out)?

Thanks (my first question here)

masterxilo
  • 2,503
  • 1
  • 30
  • 35
  • The memory used by your (small) program depends on the OS overhead, not your executable. So if you're using Vista, the memory use number will be different on XP or 7. – Greg Hewgill Nov 30 '10 at 01:41

3 Answers3

8

ntdll.dll is mapped into every single process and does a lot of basic initialization before your code starts running. This will always cause a small amount of private memory to be allocated. Take a look at LdrpInitializeProcess; here's a small list of things:

  • It creates the process heap.
  • It sets up the activation context stack for the current thread.
  • It initializes several critical sections. This will almost always cause memory to be allocated.

Also, other DLLs that get loaded into your process (e.g. kernel32.dll, user32.dll) will probably allocate memory themselves, in their DllMain functions.

EDIT: Take a look at this simple test program I created:

Minimal program

It's a completely native program (no Win32), and imports just two functions from ntdll.dll: NtDelayExecution and NtTerminateProcess. It's very similar to your program, and even though it doesn't do anything except sleep, it still uses 100 kB of private memory. The file is 2.5 kB in size, just like your program.

wj32
  • 8,053
  • 3
  • 28
  • 37
6

This is a very good page on exactly this subject, if you haven't read it already:

http://www.phreedom.org/research/tinype/

JustSomeGuy
  • 3,677
  • 1
  • 23
  • 31
Leo Davidson
  • 6,093
  • 1
  • 27
  • 29
  • Thanks for this. Only the memory question left. – masterxilo Nov 30 '10 at 00:17
  • If an exe file is of size 100KB, is it mandatory that the file will take at least 100KB in memory when loaded? – bjan Mar 05 '15 at 06:36
  • @bjan Interesting question. Tried searching on google just to find your question on SO ([here](http://stackoverflow.com/questions/28941153/size-of-exe-file-vs-available-memory)). Will keep an eye on it. – Marc.2377 Jun 06 '15 at 12:30
2

Remember, that even though it might say "using 136KB" of memory, the majority of that is shared between all the applications. You really need to check out the private bytes, and even then, there are other factors like the default heap reservation, etc. The Windows OS would rather your apps run faster than to save RAM - wasted memory doesn't help anything.

Ana Betts
  • 73,868
  • 16
  • 141
  • 209