Is it true that all PE binary size is a multiple of 256 bytes?

Question

I reviewed the size of two PE binary,both are a multiple of 256 bytes, but I'm not sure if it's the PE standard, or only hold in windows?

Answer 1

I cannot find any indication on the web that a PE binary has to be a multiple of 256 bytes, and this seems higly unlikely.

As a counter point, I've had a look at the excel.exe on my current machine (from Office 2003) which disproves this theory.

Filesize:
10 095 808 (9.62MiB)
Not divisble by 256 (divison results in 39436.75).

PE Binary? Yes:
Starts with MZ identifier, first line (reading in notepad!) contains the expected This program cannot be run in DOS mode. string. This section is here to safely deflect DOS (as in DOS itself, not the windows command line) from running the binary without crashing.

Contains the PE identifier at about byte 295 (again, reading in notepad, please excuse any inaccuracy). This is where execution will start in all compatible OSes.

_{PS: Most (all?) 32-bit executables on modern Windows are in PE format.}

Answer 2

Size or Size on Disk?

Size is the number of bytes the file actually contains.

Size on Disk is the number of bytes the file has to use up on your drive. This is normally larger, because it has to round up to a multiple of the cluster size (alternatively called allocation unit) of that partition / disk. This will normally be a multiple of your disk's sector size, which is normally 512 bytes for most modern magnetic HDDs.

Cluster size is most commonly 4KiB by default - depending on OS, file system and disk size - but you can usually define the size used when formatting the disk/partition.
Check this Microsoft KB Article for info on default sizes in most of their OSes.

This means a 1 byte file will have to use up the size of 1 whole cluster, because a cluster may only contain a single file, regardless of if that file only takes up a tiny portion of the cluster.