3 ms·

It might work on 32bit Windows 10 but I've not tested it. The smallest of the Tiny PE files that runs on 64bit is 296 bytes, which is close to the 268 bytes men

• ChrisSD 9y ago
  After some investigation I'm pretty sure 268 bytes is indeed a hard limit for reasons that are mostly explained on the tiny pe page > The PE specification says that the number of data directories is specified in the NumberOfRvaAndSizes header field and the size of the PE optional header is variable. If we set NumberOfRvaAndSizes to 0 and decrease SizeOfOptionalHeader, we can remove the data directories from the file. > Most functions that read the data directories check if NumberOfRvaAndSizes is large enough to avoid accessing invalid memory. The only exception is the Debug directory on Windows XP. If the size of the Debug directory is not 0, regardless of NumberOfRvaAndSizes, the loader will crash with an access violation in ntdll!LdrpCheckForSecuROMImage. We need to ensure that the dword at offset 0x94 from the beginning of the optional header is always 0. In our PE file this address is outside the memory mapped file and is zeroed by the OS. In Windows 10 (and probably Vista & 7) this memory isn't "zeroed by the OS", so we have to set it in the PE file. This appears to be a hard limit on the minimum size.