Tiniest windows portable executable

[DaviFN]

Hi everyone!

I've been, for the past days, searching for the smallest executable for Windows. The reason is that I want to start a small macro for a game (basically just presses a key and maybe draw some pixels on screen), and I'd like it to be tiny, just for the sake of it. I'll not use NASM, however; I intend to use Ollydbg or another such tool to directly "code" in the executable itself (sort of like a challenge).

I searched the web for the smallest executable, and it appears to be 97 bytes large. I couldn't find it for download, but I don't think it would run in any version of Windows (I want it to run from XP up (XP,7,8,10)). I found one called "hh2 golden.exe" (~400 bytes), which apparently runs from XP up, but it prints "Hello World!" in the screen (I'd like one that did nothing).

Also, I couldn't assemble them (I don't know how to properly use NASM). I'd use "hh2 golden.exe", but then I had the idea to ask here if one of you guys have a better executable that I could use in this adventure.

tl;dr: I'm asking for the smallest executable capable of running from winXP up. Preferrably it does nothing, since I want to modify it and put some functionality to it (but I need it to be completely clear at the beginning)

Thanks!

[sal55]

That 97-byte executable sounds dubious, unless perhaps it's an old .com format (used on MS-DOS) which might possibly still work on some Windows systems.

Windows  executables normally use 'PE' format, which starts off with a stub program in MS-DOS Com format (even on 64-bit Windows 10), that itself might be 128 bytes long.

Following that are various headers of the PE format, and a number of sections, which I think tend to be each rounded up to blocks of 512 bytes.

The smallest PE exe file I can come up with is 2560 bytes, and corresponds to this program in Nasm format:

Code: [Select]

    global main
    extern exit
main:
    mov rcx,0
    call exit

I used my own linker which I know adds no extra code (although it may include bss and data sections even though they are empty, however real program usually will have data). The 'exit' routine is located externally.

[ig]

You can do various (ugly) tricks to make a PE file smaller, such as overlap the PE and DOS headers... here the PE header starts at offset 0x0C, deep inside the DOS header. Yes, the PE loader allows that, though of course you need to set the fields (at least those that are actually used) so that they make sense in both the headers simultaneously.

So yes, those tiny files are actually PE files, not COMs.
However, they are not produced by any linker, they are created manually - and the NASM source is actually emitting the PE directly (as if it was emitting a COM), without any linker.

Needless to say, those are nice POCs (illustrating what the PE loader actually allows), but unsuitable for any reasonable program - be it because of the compatibility issues, or the (un)maintainability.

[avcaballero]

Making so small PE is tricky and may alert antivirus. It is not recommendable. The trick is avoid anything not necessary. If you merge data and code you will gain some bytes. Reject anything not necessary. Even doing the work that usually does the compiler... doesn't worth.

Here an uncompressed windows in 1.5kb.

[avcaballero]

Here a messagebox in 268 bytes

[frankly]

Hello1.exe file (1,536 Bytes), NASM source code, NASM compiler command line, and GoLink.exe command line located here -

https://forum.nasm.us/index.php?topic=2456.0

[frankly]

This is probably one of the smallest PE files I can create using NASM -
(Attachment - Smallest.exe - 1,024 Bytes)

Smallest.asm (NASM source code) -

Code: [Select]


cpu 586
bits 32

section .text

global START

START:
   clc    ;0xF8 Clear the Carry Flag - No Harm Done
   ret    ;0xC3 Return


NASM Command Line -

Code: [Select]

NASM.EXE -f win32 Smallest.asm
(NASM.exe version 0.98.39)

Code: [Select]

GoLink.exe Smallest.obj
(GoLink.exe version 0.2.5.4)

[Frank Kotler]

You ain't going to get the tiniest using a linker. Look at Alfonso's "smallpe".

Best,
Frank

[Frank Kotler]

This is a "helper" for making fairly small executables. I forget how it works...

http://home.myfairpoint.net/fbkotler/nagoa20120202.zip

Best,
Frank

[frankly]

I recently found this little Portable Executable that was basically handmade by a user named 'Cornel'.

tinyexe.exe is just 277 Bytes and accesses both user32.dll MessageBoxA and kernel32.dll ExitProcess

https://www.codejuggle.dj/creating-the-smallest-possible-windows-executable-using-assembly-language/

For everything this PE does in 277 Bytes, it will be tough to beat.

(I have included the attachment tinyexe.zip)

[Frank Kotler]

A zip of the executable only isn't too useful ...

Best,
Frank

[frankly]

It looks like I made a few mistakes about tinyexe.exe.

Even though tinyexe.exe works without error on a Windows 7 64 bit machine, I *assumed* it would work on a Windows XP machine, but it doesn't.

Also, I should have clarified that the website https://www.codejuggle.dj/creating-the-smallest-possible-windows-executable-using-assembly-language/ has a breakdown of the entire tinyexe.exe Portable Executable.

Sorry for these mistakes.