Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I reviewed the size of two PE binary,both are a multiple of 256 bytes, but I'm not sure if it's the PE standard, or only hold in windows?

share|improve this question
    
To satisfy the curious, "PE" is "Portable Executable". –  Dennis Williamson Sep 22 '10 at 17:30
add comment

2 Answers

up vote 2 down vote accepted

I cannot find any indication on the web that a PE binary has to be a multiple of 256 bytes, and this seems higly unlikely.

As a counter point, I've had a look at the excel.exe on my current machine (from Office 2003) which disproves this theory.

Filesize:
10 095 808 (9.62MiB)
Not divisble by 256 (divison results in 39436.75).

PE Binary? Yes:
Starts with MZ identifier, first line (reading in notepad!) contains the expected This program cannot be run in DOS mode. string. This section is here to safely deflect DOS (as in DOS itself, not the windows command line) from running the binary without crashing.

Contains the PE identifier at about byte 295 (again, reading in notepad, please excuse any inaccuracy). This is where execution will start in all compatible OSes.

PS: Most (all?) 32-bit executables on modern Windows are in PE format.

share|improve this answer
add comment

Size or Size on Disk?

Size is the number of bytes the file actually contains.

Size on Disk is the number of bytes the file has to use up on your drive. This is normally larger, because it has to round up to a multiple of the cluster size (alternatively called allocation unit) of that partition / disk. This will normally be a multiple of your disk's sector size, which is normally 512 bytes for most modern magnetic HDDs.

Cluster size is most commonly 4KiB by default - depending on OS, file system and disk size - but you can usually define the size used when formatting the disk/partition.
Check this Microsoft KB Article for info on default sizes in most of their OSes.

This means a 1 byte file will have to use up the size of 1 whole cluster, because a cluster may only contain a single file, regardless of if that file only takes up a tiny portion of the cluster.

share|improve this answer
    
I mean Size,not Size on Disk.And I'm talking about PE binary in windows. –  win Sep 22 '10 at 10:35
    
What type of file you are talking about wouldn't matter, what I've said holds true for all files, although not relevant it seems in this case. I highly doubt that the file format requires a size to be a multiple of 256, but I am unable to find a source to back me up at the moment. –  DMA57361 Sep 22 '10 at 10:53
    
After a quick web search I can't find any indication of this being a restriction on the file size. As a quick counter point I've just been looking at my Office 2003 excel.exe, it is 10095808 bytes large - or 9.62MiB - and not evenly divisable by 256. It has the MZ identifer as it's first to chars and the identifier PE is there at about byte 295 (was reading with notepad; not the best tool for the job, please excuse the inaccuracy) so I'm pretty sure it's a PE binary, I'd be surprised if it's not. –  DMA57361 Sep 22 '10 at 11:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.