Merging PE objects in order to decrease file size, Is there a catch to this method ?

Originally posted by Lahar

In the C++ section i've seen that there is the possibility of creating small exes by merging sections.
I can merge .rdata into .text by this linker option:

Eventhough the changes are minimal, its very interesting.

Is this method advisable ?.

Thanks in advance,
__Lahar__

Merging PE objects & other methods to reduce the size of a PE


Combining objects, often - but not always - results in a smaller PE.

Objects have two alignment values - one for their disk image and one for their memory image. (Both of these values are specified in the PE file header).

Each object begins at a file-offset that is a multiple of the alignment value.
The default alignment for PE files is 512 bytes - this means that every object begins at a file offset that's a multiple of 512. Once mapped in memory, objects start on at least a page boundary, which on the x86 architecture, is equal to 4096 bytes, or 4 kb.

When you merge two objects, there is a good chance that you will reduce the size of the disk image by the size of the object disk alignment and save one page of committed memory for the mapped image, if - and only if - the empty space at the end of the two objects you are about to merge, adds up at least to the alignment value.
(This is true for "Hello World" - type applications, for instance, because the merged objects consist mainly of empty space).

Now, as to the catch of merging objects: As long as you merge objects with similar attributes, you won't have a problem.

Even the object that contains imports (typically called .idata) can be merged with a section that has read-only attributes, because the Windows loader when initializing the import data, temporarily sets the attributes of the pages in which the import data reside, to read/write.

However, you can not merge objects that contain resources, relocations or exception-handling table entries (typically named: .rsrc, .reloc, or .pdata).

Now, to further reduce the size of a PE, you could:

● Use a smaller DOS stub. (Safe to attempt).
● Strip the relocations (Safe to attempt with executable files only - do not attempt this with DLLs!).
● Setting the disk alignment to a smaller value than the default, using the /ALIGN linker switch. (Not advisable, as some systems will refuse to execute the PE image).

Resources

An In-Depth Look into the Win32 Portable Executable File Format - Part 1, by Matt Pietrek
An In-Depth Look into the Win32 Portable Executable File Format - Part 2, by Matt Pietrek
Microsoft Portable Executable and Common Object File Format Specification, by Microsoft
Peering Inside the PE: A Tour of the Win32 Portable Executable File Format, by Matt Pietrek
Tiny PE - Creating the smallest possible PE executable, by Solar Eclipse
Code Crunching - Tiny PE (challenge), by Gil Dabah