btw small correction, dont write "Windows.h" but "windows.h", as its actaully small, and this causes errors on a cross compile from linux, which is case-sensitive

Yooo NIR bro u going places I'm happy you grow channel organically only bro I watch ur assembly vid and loved the part when u said add wax 1 bro keep it up super super super hacker!

For those wondering about how to make things even smaller, Dave Plumber makes a really small Windows executable to fit in a QR code.

@@Name_cannot_be_blank but the file is called "Windoes.h"?

I don't know if anyone noticed, but the dialog box's title shows Error (5:51), so was the MB_OK parameter for the button to show OK?

i'm sure that it has a great personality too

Thats what she said

what is that pfp man i am seeing that everywhere

@@fizipcfx Isn't that matrix?

@@masterchief5589 i did some digging and it looks like it is from deus ex, and a youtuber named maximillianmus was saying that subscribe to everyone who uses this pfp

Just a small correction - Also Windows Executables for Windows versions based on DOS (Windows 1 until Windows ME) start with a small MZ dos program and NE/PE afterwards - NE is an older predecessor for PE en.wikipedia.org/wiki/New_Executable

So just removing anything before the pe header won't interfere with the executable or is there any system within nt/windows that expects the DOS header? Maybe something like defender?

Even funner fact: the DOS stub for the older NE executables actually said: "This program requires Microsoft Windows.", if I remember correctly. Technically you can change this string, or even replace the entire DOS stub with a legit useful DOS program, creating a so-called hybrid executable, but I haven't actually seen any linker that has this option. I'm also not sure if these strings are standardized, or just became adopted by all linkers because official MS tools use this exact text. UEFI applications are also PE executables, so they also need to have a DOS stub. The stub uses INT 21h/AH=09h to display the string and then quits with INT 21h/AH=4Ch (these are essentially DOS API calls).

@@robinweiland7533 I once tried to remove the MZ stub just to see what happens, so my executable started with PE directly. Windows XP then refused to start the program, as it didn't recognize it as valid executable. So yeah, NT expects the DOS stub to be present (besides, I may have fucked up the offsets present in the header anyway by just brutally stripping the MZ stub). But even DOS would refuse to start an ill-formatted executable, unless it has the .COM extension, because then it would load and start it as a flat binary, which would lead to nonsensical results, likely leading to the computer hanging.

Windows 2000 is NT 5 -- you're likely thinking 95/98/98SE

Snappy? Either way it’s snappy. It’s less than a megabyte

@@tweetyguy7347 100Kb can still be too big for some applications, like embedded

That is what happens when you have a lot more memory and processing power and storage space than back in the day, people will prioritize safety and/or readability over performance or use higher level languages so they can just focus on writing the program which I'd say makes sense even though I don't think things like electron make sense for many of the applications that use it

Just say you don't feel like buying 16 gigs of RAM 💀

@@vlc-cosplayer you don't need 16 gigs of RAM unless you're playing a big game that's going to use that RAM... Not very many do

It blew your mind to be able to run DOS software on a DOS derivative?

@@mikeyjohnson5888 No, it blew my mind that you can have a single installer executable which can be run from DOS and at the same time provide a graphical install wizard on modern Windows.

For example, the SETUP executable in Windows 3.1 worked that way. It could be run under DOS to change the configuration of Windows, but also under Windows itself.

DOS, Windows, Linux, MacOS in one quad mode executable?😂

You could hide an easter egg there

@@maxmuster7003 Now we're talking!

I read this in Boris' voice

And after put in 7z SFX archive 😅

upx has a 64kb limit for windows it's best to use crinkler and kkrunchy instead

Never heard of Krinkler before. Thanks for the info! :)

To add to crinkler, which replaces your link.exe, there are also kkrunchy and squishy; which both take an existing exe and produce a smaller one. Like UPX (iirc) and crinkler they compress your program section and the exe itself is a decompressor that takes the rest of the binary and decompresses it in memory to then execute it. In a way this does make the exe smaller but does not truly reduce instruction count, and it can trigger antivirus protection becausd it means executing arbitrary memory as code that could not be statically checked for malware while it was compressed. Also unsure about how linking additional dlls, and compiling compressed dlls, would work there but statically linking should. Sorry for the info dump, they are fun tools to explore so check them out if you are going in a compression adventure :)

@@tropicaltrevor i somehow merged kkrunchy and crinkler together lmao. i mostly write demoscene stuff on linux my bad

Impressive! I'm curious what you did to achieve that. What compiler settings, and platform did you use?

@@jakedeschamps4454 cl min.c -link -align:16 -entry:main, 688 bytes. Didn't try any harder

@@jakedeschamps4454 I use Arch and go all out in Assembly. The gcc switches/settings are nostartfiles, nostdlib, static, fno-ident, nmagic and build-id is none

Based on someone else’s comment, Windows skips over the first few bytes that displays the DOS message, while DOS does not. So I imagine in theory if you could replace the message with a jump statement to a point in your application that deals with DOS specifically, and have your default main be the Windows entry point. This is just speculation, I’m not sure if it would work or not.

@@CoderDBF I mean if someone thought its a good idea for every program to also work in dos, even if it only displays a message then maybe people thought that at least in transition phaze you could have one executable Then there has to be a compiler that can produce hybrid executable I mean why would win32 apps have a separate WinMain entry point WinMain for windows main for dos

Yes, I use LightWM which is based upon the TWM I made in an earlier vid.

The parameters are passed according to the calling convention, in this case the registers are used instead of the stack because of the x64 calling convention used.

Cutter works with many different binary file executable formats and is agnostic to the higher level programming language (or assembly) that they were originally written in.

Yah I recently started using winfile and it's very nice (it's the original file manager from Windows 3.1, Microsoft open sourced it and it's maintained on Github) The debloating Win10 is a good idea for a future video, I will add to my list

You can do that. The linker flags can be a bit different.

I checked with GCC as well and it also by default adds some C library boilerplate to the executable

Thanks!

good question! imma install hidra and look into it, will update as soon as done

@@ItsCOMMANDer_ the exact same way. it even accepts the return value from the entry point.

The binary in the video does not contain symbols (you can see in the functions list in cutter it does not pick up any symbols). Unlike Unix systems, on Windows symbols are not saved in the main binary but they are saved aside in a .pdb file. By default, when compiling with Visual Studio Build Tools, cl works in release mode and thus no symbols and debugging information is generated unless a special flag is passed. There exist many Windows API functions which can come in place of C lib functions, for example instead of printf, WriteConsole can be used. And for string to int there exists RtlCharToInteger learn.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-rtlchartointeger Indeed, in most cases it is useful to also use the C lib for the convenience, but in some cases, it can be useful for example for very simple programs to only use Windows API if desired, it can also be a good learning experience.

Isnt WriteConsole just a file write to stdout? And I also think that Windows have the api wsprintf which combined with WriteConsole would be a complete printf

​@@nirlichtman Thanks for sharing! Yeah, I was wrong... I just tested the /link /entry:main option and it shrinks the binary from 86kB to 1.5kB on my machine. And even the exit code is working just fine. Turns out, Windows is wildy different than Linux. But it's important to realize that stressing about 86k of library binary size isn't helpful for most developers. Though I personally do not like the Windows API and find its documentation very hard to understand, I agree it can be a great learning experience to use only Windows API functions instead of the C runtime. Your videos are very nicely produced, keep up the good work!

@@newton-342 Thanks!

There are 2 good videos from Dave's Garage about that. He got it down to 800-600 bytes :)

@@conrad42 thanks, and do you have any idea how the shell codes are being produced bc they are so small yet for example they can establish connections l wonder also how they are working

@@kaankarakoc7680 shell code is a script language, which needs another executable (interpreter) to be run. Shell scripts mostly just orchestrate other executables. C is a compiled language and you get a standalone executable. Is this understandable?

That's a good idea, I will add to my list (might do this as part of a future video) :)

There's nothing wrong with using Windows, nowadays even if you feel the need to use linux for something, WSL makes up for it so it isn't much of a big deal. Besides, if I were to be this knowledgeable about windows and its various APIs, I sure as hell would prefer it lol

he is

@@javierflores09 other than the fact that it is proprietary and malware, i agree there is nothing wrong with using windows

😂 I didn't mention this on the video, but it's also a better practice to use the wide char versions of Windows API functions in any case, since the Windows Native API functions that a lot of these APIs call work with wide char so when you call the ASCII versions of Windows API functions, they go through a conversion to wide before continuing to the native API.

Yes.

considering that that is checked only at one exact #ifndef in the windows' SDK (line 193 in windows.h), which is not #included in this example, i can say "not at all"

Most likely, no. But it makes compilation faster (in case anyone is still concerned about that).

He read. Documentation, compiler/linker options, etc. Nothing in this is special to C.

😂 Crazy heat wave on that day

Changing the entry point not only omits the startup code, but the whole C standard library, only leaving you with the parts of the Win32 API you explicitly link with. You may want to link to the UCRT (included since Windows 10, an update to the classic MSVCRT) instead of the Visual Studio runtime for a smaller C program.

@@D0Samp Thank you. I'll look into it. Or just have my own memcpy in the code. Thanks again

Yes, I started a TWM project for Windows called LightWM

Yes, but you will need to reimplement even more parts of standard library than for C case.

@kokokokosin yes

The `dir` from dosbox said it was 3072 bytes, so 3kB

@@EionRobb thanks

Planned :)

@@nirlichtman thanks!

😂 We had a serious heat wave

it's the principle of the matter

It runs the DOS stub section of the NT .exe, which in most cases is a simple DOS program that prints a message saying that it cant run on DOS (as demonstrated in the end of the video)

@@nirlichtman let me rephrase, since it got misunderstood. What happens if you remove the stub and correct the exe to not run into errors, then attempt to run in DOS?

Yes, if it will be built with Visual C++ 6 and /filealign:512 option.

torte ftw 😂

No, the program written isn't running in DOS mode, just a bit of boiler plate to let you know. Just like the "Non-bootable disk" boot sector messages of days of yore: obviously it booted to a message, but it isn't doing what the user was trying to do. So both are correct messages.

I find Windows more comfortable as my main desktop

Apparently this works because the entry point function returns into the function for spawning threads (BaseThreadInitThunk in kernel32) which exits the thread that it was started on, and a process will exit if it has no more threads.

you're calling ret from a function. How could it possibly crash?

@@GeorgeTsiros Unlike the main function, which is usually called by the startup code of the C library, an entry point function is not guaranteed to have a valid return address on the stack. But because threads are meant to return a status code and the main thread on Windows is started the exact same way as additional ones, it still works.

@@D0Samp the entry point is entered by calling into it. No matter what it is, it will have a valid return address. yes?

💩

It's not Windows, it's C runtime. Any C runtime must be initialized so your system APIs (memory, files, threads) can be wrapped efficiently inside C standard library. libsystem, glibc, musl etc. do this stuff too, your real entry point on Linux/Mac is also not main. Wanna see real bloat shit - dig into exception ABI on both Windows and POSIX :)

and "d.i.r." but we're not judging. That's how he learned to say it.

Learning ❤

@@boy_deploy thanks, what I was asking is, from a technical perspective does this speed up the program? thanks

I suppose this can be used to write malware.

@@chrischoir3594 It definitely speeds up the program startup and the size of final executable file. Some even go as far as removing the C runtime library to eliminate the bloat.

Correction: *and lessen the size of final executable

Roughly 73% of all computer users.

people who don't know anything about computers

Writing C code on windows is still valued but Windows 11 is the worst operating system they have made so far. It is worse than Vista.

@@Mikewee777 I'd argue later vista service packs are better than every windows after 7.

That is not executable under Windows (since it is an ELF format), try linking the code to be a PE format (the binary starts with the magic MZ) and x64 architecture

@@nirlichtman it would be interesting to see how small a binary we can get from the cosmopolitan compiler.