portable-executable – Make Me Engineer

What is the smallest possible Windows (PE) executable?

As quoted from source (Creating the smallest possible PE executable): 1 Smallest possible PE file: 97 bytes Smallest possible PE file on Windows 2000: 133 bytes Smallest PE file that downloads a file over WebDAV and executes it: 133 bytes The files above are the smallest possible PE files due to requirements of the PE … Read more

VA (Virtual Address) & RVA (Relative Virtual Address)

Most Windows process (*.exe) are loaded in (user mode) memory address 0x00400000, that’s what we call the “virtual address” (VA) – because they are visible only to each process, and will be converted to different physical addresses by the OS (visible by the kernel / driver layer). For example, a possible physical memory address (visible … Read more