从程序集调用 Windows API，同时最小化程序大小
我正在尝试用汇编语言编写一个程序，并使生成的可执行文件尽可能小。 我正在做的一些事情需要 Windows API 调用 WriteProcessMemory 等函数。 我在调用这些函数方面取得了一些成功，但是在编译和链接之后，我的程序的大小在 14-15 KB 范围内。 （来自不到 1 KB 的来源）我所希望的比这少得多。
我对做这样的低级事情很陌生，所以我真的不知道需要做什么才能使程序更小。 据我所知，exe 格式本身占用了相当多的空间。 可以采取什么措施来尽量减少这种情况吗？
我应该提到我正在使用 NASM 和 GCC，但如果有帮助的话我可以轻松更改。
I'm trying to write a program in assembly and make the resulting executable as small as possible. Some of what I'm doing requires windows API calls to functions such as WriteProcessMemory. I've had some success with calling these functions, but after compiling and linking, my program comes out in the range of 14-15 KB. (From a source of less than 1 KB) I was hoping for much, much less than that.
I'm very new to doing low level things like this so I don't really know what would need to be done to make the program smaller. I understand that the exe format itself takes up quite a bit of space. Can anything be done to minimize that?
I should mention that I'm using NASM and GCC but I can easily change if that would help.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
请参阅 Tiny PE 了解一系列可用于减少最终结果的提示和技巧您的可执行文件的大小。 请注意，该文章中的一些后续技术非常脆弱。
See Tiny PE for a bunch of tips and tricks you can use to reduce the final size of your executable. Be warned that some of the later techniques in that article are extremely fragile.
大多数 PE 文件的默认节对齐方式是 4K，以与自然系统内存布局对齐。 如果您有 .data、.text 和 .resource 部分 - 那已经是 12K 了。 其中大部分都是 0，浪费空间。
您可以采取一些措施来最大限度地减少这种浪费。 首先，将节对齐减少到512字节（不知道nasm/gcc所需的选项）。 其次，合并这些部分，以便只有一个 .text 部分。 但对于打开 NX 位的现代机器来说，这可能是一个问题。 此安全功能可防止病毒等对代码的可执行部分进行修改。
还有大量 PE 压缩工具可以压缩您的 PE 并在执行时解压缩。
The default section alignment for most PE files is 4K to align with the natural system memory layout. If you have a .data, .text and .resource section - that's 12K already. Most of it will be 0's and a waste of space.
There are a few things you can do to minimize this waste. First, reduce the section alignment to 512 bytes (don't know the options needed for nasm/gcc). Second, merge the sections so that you only have a single .text section. This can be a problem though for modern machines with the NX bit turned on. This security feature prevents modification of executable sections of code from things like viruses.
There are also a slew of PE compression tools out there that will compact your PE and decompress it when executed.
我建议使用 DumpBin 实用程序（或 GNU 的objdump）来确定什么占用了最多的空间。 它可能是资源文件、巨大的全局变量或类似的东西。
I suggest using the DumpBin utility (or GNU's objdump) to determine what takes the most space. It may be resource files, huge global variables or something like that.
FWIW，我可以使用 ML 或 ML64 组装的最小程序约为 3kb。 （这只是打个招呼，然后退出。）
FWIW, the smallest programs I can assemble using ML or ML64 are on the order of 3kb. (That's just saying hello world and exiting.)
给我一个小 C 程序（不是 C++），我将向您展示如何用它制作 1 ko .exe。 我建议的可执行文件的最小大小是 1K，因为如果不是这个大小，它将无法在某些 Windows 上运行。
您只需使用链接器开关即可实现它！
polink 是一个很好的链接器。
如果您在 Assembly 中完成所有操作，那就更容易了。 只需访问 MASM32 论坛，您就会看到很多这样的程序。
Give me a small C program (not C++), and I'll show you how to make a 1 ko .exe with it. The smallest size of executable I recommend is 1K, because it will fail to run on some Windows if it's not at least this size.
You merely have to play with linker switches to make it happen!
A good linker to do this is polink.
And if you do everything in Assembly, it's even easier. Just go to the MASM32 forum and you'll see plenty of programs like this.