What is the minimum file size of a PE file (exe) on Windows? And the minimal memory allocation? [duplicate]

Question

What is the minimum file size of a PE file (exe) on Windows? And the minimum memory allocation?

I assembled (using MASM (ml.exe) and link.exe that come with VS 10) the following code: I can not leave out kernel32.lib and ExitProcess, if I do, the program crashes.

; Assmebly options
.386
.MODEL FLAT, STDCALL
option casemap:none

; Include Libs
includelib kernel32.lib

; Imported symbols
ExitProcess PROTO :Dword
Sleep PROTO :Dword

; Code
.CODE

start:
    invoke Sleep, 10000
    invoke ExitProcess, 0
END start

The Sleep command is included only to be able to read the memory usage before the program ends.

Now I measure the following: The .exe file is exactly 2.5 KB in size (if I include user32.lib and MessageBoxA, it becomes 3 KB in size --> blocks?) and the application uses 136 KB RAM when it's run (Vista 32bit).

Isn't that somewhat much memory for such a simple program? Why is the exe file so large, and the RAM requirement much larger than the exe file?

Are there some minimal memory sizes? What about the file? It looks like it's organized in blocks of 0.5 KB in size, but isn't it 0.5 KB then for this shortest possible program?

Where can I read about this (except http://msdn.microsoft.com/en-us/magazine/cc301805.aspx which I will check out)?

Thanks (my first question here)

Answer 1

ntdll.dll is mapped into every single process and does a lot of basic initialization before your code starts running. This will always cause a small amount of private memory to be allocated. Take a look at LdrpInitializeProcess; here's a small list of things:

• It creates the process heap.
• It sets up the activation context stack for the current thread.
• It initializes several critical sections. This will almost always cause memory to be allocated.

Also, other DLLs that get loaded into your process (e.g. kernel32.dll, user32.dll) will probably allocate memory themselves, in their DllMain functions.

EDIT: Take a look at this simple test program I created:

It's a completely native program (no Win32), and imports just two functions from ntdll.dll: NtDelayExecution and NtTerminateProcess. It's very similar to your program, and even though it doesn't do anything except sleep, it still uses 100 kB of private memory. The file is 2.5 kB in size, just like your program.