C vs ASM: Making the World's SMALLEST Windows App

How small can a fully functional Windows application get? 4K? 2K? 1K? Can ASM best the C version? Find out as Dave takes you on a tour of Windows apps in both C and assembly and demonstrates some aggressive optimization techniques! For my book "Secrets of the Autistic Millionaire": amzn.to/3diQILq
Follow me on Twitter: @davepl1968
Discord Chat w/ Myself and Subscribers: / discord .
Code: github.com/Plu...
"David's" Page on his tiny app: davidesnotes.com/
Primary Equipment (Amazon Affiliate Links):
* AppleTV 4K - amzn.to/3Web65S
* Dell Monitor - amzn.to/3Dmbsyx
* Indigo Automation Software: www.indigodomo...
* Black and Decker Stud Finder - amzn.to/3fvEMuu
* Camera: Sony FX-3 - amzn.to/3w31C0Z
* Camera Lens: 50mm F1.4 Art DG HSM - amzn.to/3kEnYk4
* Microphone: Electro-Voice RE 320 - amzn.to/37gL65g
* Teleprompter: Glide Gear TMP 100 - amzn.to/3MN2nlA
* SD Cards: Sony TOUGH - amzn.to/38QZGR9
Bridge desktop image by Rex Lau Photopgraphy
PE format image by Rick's Blog: 0xrick.github....

[@terminalpsychosis8022]

This is such a masterful explanation. Super technical, as it must be. Fully enjoyed every syllable, and the graphics... well, a gif = 1000 words. Maybe not for everyone, but my god this is amazing. Thank you Mr. Garage. ;-)

[@HisVirusness]

Mr. Garage never disappoints with great programming content.

[@RobMoerland]

I remember my first Windows 1 application. 4 pages of code and all I got was a window saying "Hello World!". But forgot the Exit button so had to reboot the computer to get out.

[@nezbrun872]

Those were the days! I wasn't inducted until Windows 2.0, when you were still allowed to ship programs with a free Windows runtime. Charles Petzold wrote the bible. Looking back on it, it reminds me of Cobol: you had to write a ton of code before you got any output. It was touted as "object oriented" due to the event driven messaging: quite the claim! 16 bits, local and global heaps. Near and far pointers. Cooperative multitasking. I don't miss any of that nonsense, but it's just replaced with a ton of new nonsense! Plus ca change.

[@SijmenMulder]

@@nezbrun872 the windows communicating with messages can rightfully considered to be object orientation, just not in the way it evolved to be now. More like a primitive sort of Smalltalk or Objective-C.

[@zgelrevol9682]

Ohh the memories!

[@Dennis2020i]

😂🤣Nice one👍 but this one is to do with chip assembler though, low level core stuff, geniuses these guys is👍😎✌.

[@AlexVaiphei]

Those are the golden era.

[@aquatrax123]

Back in the 90s when I was a young hacker want to be, I would open exe files in dos edit and thought how does anyone program? One would need a crazy keyboard. I did take note of the starting 2 bytes were Mz. Later in my hacking career I downloaded the virus workshop. Before you could use the program, it would prompt you to enter the first 2 byes of an exe file to test if you know what you were doing. I remember being so excited that I knew what to enter. Good times!

[@BlackStarEOP]

Hi Dave, recently found this channel! Very nice to see the insights into the older operating systems. I'm currently an embedded software engineer developing software mainly in C for microcontrollers (automotive) and one of my hobbies the the demoscene. Would love to hear your thoughts on the modern 64k/4k intros in a video sometime (some recommendations: Mercury - The Timeless, Conspiracy - Offscreen Colonies, TBC - Elevated) Regards from a fellow programmer (one that possible has autism but was never diagnosed) (y)

[@DrThalamic]

Nice nod to "The Friendly Giant"

[@JeffRyman69]

One of the smallest useful Windows applications is the VEDIT editor, whose history goes back to CP/M days. It is written in a combination of ASM and C (No C++). The .EXE is 572 KB and it has one .DLL file of only 25 KB.

[@truetom]

It is really sad that nowadays in the world of Electron a simple Hello World example is over 200 MiB in size.

[@Gunbudder]

People need to understand the quality and type of knowledge Dave is giving out here. This is the kind of information you would normally only ever get by walking into Dave's office, hoping he's not busy, and asking him "how does this work?" My last company called this "tribal knowledge" and every company goes to great lengths to try and extract it from old timers and inject it into newbies. in my experience, you just have to get an old timer to tell you before they retire. Dave is going way above and beyond by giving that kind of knowledge out for free for everyone to absorb

[@DavesGarage]

Thanks!

[@beebakrizzle]

developers in 2023: "I'm gonna bundle a full web browser with my application!"

[@simonlathwell]

Hi Dave, I know it's a long shot that you might read this. I think it would be an interesting video if you could talk about the file systems, like FAT12/16/32 & NFTS, and there history. Like how they work, file limitations, and if Windows or Linux is better when it comes to them.

[@DavesGarage]

Thanks for the suggestion, I'll put it on my TODO list!

[@zgelrevol9682]

I like the idea too! If I may be so bold - the one question that came to mind during this wonderful episode was... With all these optimizations for bytes, was the startup time changed? Call me an old optimist :)

[@SeanBZA]

@@zgelrevol9682 Still not going to be any sort of delay noticed, as all of these programs will fit into the L1 cache in their entirety, and thus will all execute in 8 bus clock cycles, and the biggest delay will be all the calls to the L2 cache for the DLL calls, likely cached there as they would be needed for other processes all the time, plus would have been called to load the EXE itself. The biggest delay would be the tens of thousands of CPU ticks that it takes for the glacial slow (to the CPU, which would context switch after the initial burst of calls as the process is now in a wait state) IO process to both graphics memory, and to the GDI instance to draw the window on screen. Probably all versions will have the window open before you have lifted your finger off the keyboard, and before the keyboard has sent the key lift code back to the south bridge keyboard controller itself. You might see a timing difference if you used a copy of Windows 98 (likely this code would run on it, though you would have to explicity use 16 bit code and change the linked libraries to ones that 98 worked with, and if you went further it would run on Win3.0 as well) on an original Pentium 25MHz, where you could literally see windows being drawn on screen, and Win98 would run very slowly.

[@ogamiitto5642]

If you want some real in-depth explanations of these filesystems, and how to take a closer look at their data structures (with the help of TSK, “The Sleuth Kit”), you should take a look at Brian Carrierʼs book on “File System Forensic Analysis”. While this title is now 17 years old, and its author, sadly, never published a revised edition, itʼs - apart from ReFS, which isnʼt covered at all - still the only real reference (that I know of, in book form) when it comes to “Windows filesystems”!

[@simonlathwell]

@@DavesGarage Thank you for the nice comment. Just a heads up, you've got a scammer on here commenting and asking people to telegram them, and there channel is using your picture. I've reported their channel to KZbin, but hopefully, you might be able to take action as well.

[@makethingsbetter]

Reminds me of a time with my late friend Paul. We worked to develop a partition manager that enabled us to remove the C: partition from view, but it was accessible by Windows because it was in memory. Helped keep it secure. We used some of the same compilers, albeit older versions. I miss my genius friend muchly… have fun hacking the sky Paul! 😊

[@zgelrevol9682]

🤗🤗🤗

[@NonTwinBrothers]

It's very rare to find experts in their craft who also post quality youtube videos. For me you're right up there with the Bisqwit yt channel. Thank you for all the video series' Keep doing what you're doing, Dave :)

[@DavesGarage]

Thanks for that!

[@jhoughjr1]

Bisqwit is a very rare bird.

[@empresagabriel]

It's crazy that Bisqwit is such an amazing programmer without never programming professionally.

[@tomvance3646]

@@empresagabriel Bisqwit has programmed professionally, you can see that if you look at his CV on his site. He's not currently employed as a programmer/engineer though.

[@AJMansfield1]

I remember doing a challenge to make the smallest possible ELF binary that runs and exits with a particular exit code; I was able to do some tricks by setting the "start of .text" field to get it to load a portion of the ELF header itself as if it were program code, and carefully bit-stuffing opcodes into unused header bytes (and selecting whatever other options would mean the bytes could be interpreted as assembly code without crashing). Doing this, I was able to get the program down to just 52 bytes -- exactly the size of the smallest possible ELF header.

[@joshuahudson2170]

Fun fact; the actual smallest is 45 bytes. If you truncate off the header, missing bytes are zeros. This requires cheating, and won't work on a processor that has working NX.

[@AJMansfield1]

@@joshuahudson2170 though if you wanted the smallest executable, period, you'd probably have to look past ELF to the other type of Linux executable header: the shebang. (e.g. the file with the contents `#!/bin/true` is also a valid executable on linux)

[@tomysshadow]

There's another classic way to find KERNEL32's address without using the import table. At your program's entry point (usually in the CRT code, but since that's cut out it would be main in this example,) ESP will contain a pointer into KERNEL32 since the program's entrypoint is actually called from the function in KERNEL32 that creates the thread, so a return to that function is on top of the stack at the entrypoint (your main function.) So the first instruction of your program can store the initial value at ESP, then you need to round it down to the nearest 0x1000 bytes and search backwards (0x1000 bytes at a time) for the beginning of the DLL, by looking for valid PE Headers (using the DOS header signature, MZ.) Then you can traverse its export table. You can run into memory you don't have permission to read in this process so you'll want to set up an exception handler that basically does nothing using SEH. Manually going through the export table this way also has an interesting side effect: it bypasses Compatibility Shims, since those are usually returned by GetProcAddress

[@DavesGarage]

Thanks, I'll give that a shot!

[@tomysshadow]

@@DavesGarage Also, I thought of another potential savings: you might be able to save space by searching by ordinal instead of storing all the string names of the imports you need. I don't know if the code would still be short enough to justify it, but might be worth a shot. You can store them as WORDs so they'd be significantly shorter than strings. Might even get away with BYTEs if the numbers are small enough.

[@MarekKnapek]

@@tomysshadow No, ordinals are not stable between Windows versions or updates. It would work only on that single computer. Exported functions are identified mostly by name, sometimes by ordinal (rare). For that you need to look for that DLL's import library from all the SDKs there are (even the very old ones). You will learn that InitCommonContrls was once exported by ordinal (most other functions were never exported by ordinal only by name). Thus it needs to have the same ordinal forever in the future. Otherwise old exe built by the old SDK would stop working on new Windows.

[@tomysshadow]

@@MarekKnapek You are right - I thought I had seen packers do this to save space before, but I must've been mistaken. I compared KERNEL32 from XP and 10 and the ordinals aren't the same

[@jhonbus]

When I was at school, we weren't supposed to have executable files on our user areas on the brand-spanking-new Windows NT 3.1 server they'd installed just that summer. Presumably they didn't want us messing anything up, or playing games while we were supposed to be learning how to do a mail merge or whatever (or teaching the IT teacher how to do it because he couldn't find the right page in his notes) We quickly figured out that just changing the extension to something innocuous wouldn't stop our precious .exe files being detected and auto-deleted, but lo and behold, using a hex editor to change that "MZ" to something else would keep them from being spotted. Seems weird looking back on it that they'd be so precious about us running executables but they'd given us access to all kinds of programming tools. Turbo C, Pascal, ASM, we could do a lot of damage with those! But Qbasic made it easy for everyone to start making their own games, and VB Classic made it even easier for us to access all the things we weren't supposed to. I guess we did all learn a lot about computers though, so maybe they had the last laugh!

[@thepwrtank18]

the easiest way to teach someone something is to tell them to not do it, and let them teach themselves to spite you

[@davidmartensson273]

Security is hard, and even harder today. Many are still naive about how easily it is to bypass many security principles and as some one once stated "the defender needs to find all the holes, the attacker needs only one".

[@Backyardinstallers]

I love just listening to people that can explain things simply.. Please keep this up Dave... Oh, one other thing just found you LED series it time to binge watch...

[@AJMansfield1]

Could tricks with overlapping header regions (like for ultra-tiny ELF files) be applied to EXE? If you search "tiniest ELF program", there's a really good article on the muppetlabs blog that gives a writeup of the technique as applied to ELF. Either way though, I'd love to see a deep dive into the internals of the EXE format, and what you'd be able to achieve in a from-scratch binary that doesn't rely on linker tools.

[@jbird4478]

No. The headers of EXE files don't use offsets, but just follow right after each other. What you can do is overwrite the DOS header and the DOS stub program that is usually at the start. All windows cares about is the magic number (MZ's signature) and the offset to the PE header, which is at the end of the DOS header. Usually, this offset is set to 0x100 which is right after the stub program that tells you "this program cannot be run in ms-dos mode". You can change that to immediately follow the DOS header. Next you can set the file offset of the .code section to 0, and your complete file can be mapped as code. Set the entry address to 4 and the very first instruction can start right after the DOS signature. You just have to make sure the code jumps over the PE header. This will save you ehm... 248 bytes give or take. P

[@Bunny99s]

@@jbird4478 What do you mean? The MZ header does have an offset that indicates where the PE or NE or whatever header is located. In the demo scene is was common to make the MZ and PE header overlap. Just as an example, I just opened the famous ".kkrieger" by the german demo scene group "farbrausch". The first 16 bytes are 4D 5A 66 61 72 62 72 61 75 73 63 68 50 45 00 00 Which reads "MZfarbrauschPE\0\0" So the PE header offset is actually located in the PE header itself. The offset to the PE header is located in the file at 0x003C from the beginning of the file. So they cleverly shifted the PE header so the only relevant field in the MZ header for windows (the offset to the PE header) is located at a position in the PE header that is unused, not important or the actual offset value is acceptable at this point in the PE header. Actually, since the PE header is actually smaller than the MZ header, I think the offset to the PE header is actually located behind the PE header ^^.

[@jbird4478]

@@Bunny99s Yes, I mentioned that offset. The PE headers themselves don't have offsets, unlike ELF files. In PE all the headers just follow after each other. In ELF files, the different headers are located with pointers, which is why you can make them overlap in some cases.

[@Bunny99s]

@@jbird4478 You're right, I glanced over it :) I guess I was kinda triggered by your first statement. Yes, the additional optional headers of the PE header do not have offsets. The PE header just contains the count of headers. Most products of the demo scene only contain the absolute minimum (usually 1). Though I think that the PE header and the optional header still fits almost within the MZ header :)

[@jbird4478]

@@Bunny99s The optional header of a PE file is 240 bytes, and despite the name, it is not optional. You might get away with cutting the end from that header, because that describes things that aren't always necessary, but I don't know. According to the specs and the WinNT header it is just a single fixed structure. What is optional are the sections and their headers, but you'd need at least 1 of those.

[@tbranch227]

I miss the old task manager... the new one looks better but it is a laggy nightmare.

[@Starchaser38]

They probably need to rewrite it from scratch to fix all the problems. I'm not sure they still have someone capable, though.

[@Michael_19056]

Well it's Windows, so ... ;^)

[@tams805]

Like much of Windows 11, there are some nice features, but man are they poorly/lazily coded. We all knew code would become less optimised as systems became more powerful, but such basic things should not be lagging on hardware that could only be dreamt of back in the 90s and even 00s.

[@halano]

The new one take day to even start

[@kyoudaiken]

@@halano Are you running on Core 2 Duos still? Even on a Ryzen 5600G it opens instantly.

[@waynesmith2287]

Love the Steve Gibson name drop!

[@SteveMasonCanada]

More of a tip of the hat than a name drop really.

[@waynesmith2287]

@@SteveMasonCanada True I think a lot of the younger viewer wouldn't know about Steve.

[@SebastianKurek]

Throwback to a time when every problem wasn't solved by throwing in another hundred megabytes (or so) of additional npm modules, and some custom tracking js on top of that for good measure.

[@lperkins2]

There is an article on doing something similar for Linux elf executables, from the early 00s. The smallest "it runs" files was 46 bytes, the smallest "it doesn't break the rules" was 76. Part of the way it got the size so small (aside from not being a GUI application), was embedding the executable code itself inside the metadata header of the program. It couldn't _remove_ the header, as the elf-checker would refuse to run it, but it could take the stretches of 0s in the header and fill them with useful code. I wonder if a similar approach could shave a few dozen bytes off in this case. It does rely on a hexeditor to do, though.

[@29Aios]

Hi Dave ! I'm Russian programmer, and started programming 8086 since 90', but before, I was programming ZX80/Elbrus/ДВК 1,2,3/Robotron1715/БК0010/Нейрон/Other Then, at this time there was a confusion, that when a code is smaller then it should be faster, actually not - say ASM "loop label" is slower on one tick than "dec cx; jcxnz lable" on x86. It was 30 years ago, but I still remember that goal we were going to archive, and was coded in ASM.

[@stolenlaptop]

In asm I always used " sub reg, value" or "dec reg" then jz or jnz for speed.

[@29Aios]

Yes, but the idea was in code size, ie. if it's smaller than it's faster, and in most cases its true, but not always for x86, let me show in the code: 0: 66 b9 0a 00 mov cx,0xa 4: 66 31 c0 xor ax,ax 00000007 : 7: 66 40 inc ax 9: e2 fc loop 7 b: 90 nop c: 90 nop d: 66 b9 0a 00 mov cx,0xa 11: 66 31 c0 xor ax,ax 00000014 : 14: 66 40 inc ax 16: 66 49 dec cx 18: 75 fa jne 14 Both blocks do the same, increment *ax* register 10 times, but 1st block (7-9) 4 bytes only, second block (14-18) is 6 bytes. Let's findout timings per instruction. I've googled "8086 instructions timing", used second link because of 8086-Pentium cycles. DEC Decrement operand bytes 8088 186 286 386 486 Pentium r16 1? 3 3 2 2 1 1 UV Jcc Jump on condition code operand bytes 8088 186 286 386 486 Pentium near8 2 4/16 4/13 3/7+m 3/7+m 1/3 1 PV LOOP Loop control with CX counter operand bytes 8088 186 286 386 486 Pentium short 2 5/17 5/15 4/8+m 11+m 6/7 5/6 NP So, Loop instruction on 8088 - 286 is a bit faster, however on 386+ "dec cx; jne lable" is much faster, about 2-3 times

[@stolenlaptop]

@@29Aios 386 is when I was cutting my teeth on asm. Before that it was basic and fortran. Padding is often overlooked code alignment and cache misses are big factors.

[@29Aios]

@@stolenlaptop You are right. Alignment is most important for data, so, say if you load a 32 bit register from mem [0x0], it will be 2x faster over loading from mem [0x01], because data is within 2 32/64 bit blocks, so processor needs to load 2 blocks instead of 1 aligned. But cache misses, what do you mean ?

[@evanbarnes9984]

You really demystified this process for me! Seeing how that works in C is actually really encouraging. I'm learning C, and making a GUI window seemed really complex and daunting, but it actually seems pretty straightforward since you just have to use functions built into Windows and respond to system messages. I was worried that I would have to write the functions that do things like tracking the mouse position.

[@gower1973]

It’s a massive api that’s been around for thirty years, just read the docs there’s a function for everything 😂

[@zgelrevol9682]

Its massive for those starting out to learn from this style. Pause is your friend, you might use the transcript to make a checklist of sorts. I agree with gower1973 - there is sooo many functions. Never let the learning side go!

[@stolenlaptop]

Program on Linux and let the GUI games begin!

[@Tarex_]

And with every dave's awesomeness video explaining how windows get drawn and resized it frustrates me anew that the company i started at has been working for years with a program that is not resizable and in a window, can only be maximized and then puts the program in a corner at the same size and fills the rest with white, and nobody has enough reach to do anything about it lol

[@ahmad-murery]

Wow, for years I used to think that Assembly is hard but after this video I think it's very very hard 😎 Thanks Dave

[@29Aios]

For me, most important thing to be learn from ASM - are pointers, which are also used in C/C++ and even C#, other instructions can be directly mapped from other languages. Say in C/C++/C#: int a = 10, b = 20, c = a * b; In ASM it will be: MOV EAX, 10 // a MOV EBX, 20 // b MOV ECX, EAX // a MUL ECX, EBX // ecx == 10 * 20 EAX, EBX, ECX - are commonly used registers, fastest memory. Each operation takes 1 cycle (except MUL), ie if a processor is running on 4GHz, it will execute 4'000'000'000 cycles/operations per second, however if a processor is superscalar (which are commonly used today), then multiple instructions can be executed at once (if they are independent)

[@ahmad-murery]

@@29Aios Thanks for the example, but is there any reason to store a in EAX then move EAX to ECX? why not directly move a to ECX and please excuse my ignorance in Assembly 😌

[@29Aios]

@@ahmad-murery This is an example, EAX value can be used later, but if not, it can be simplified as you said. There are many optimization tricks, like if you want to move 0 to EAX, it can be done as XOR EAX, EAX, and this 1 byte instruction, however MOV EAX, 0 is 5 bytes

[@ahmad-murery]

@@29Aios Thanks Oleg it makes sense now, Coming from high-level programming languages makes these things look complicated. I always wanted to learn how to program my MSX1 machine but life is more complicated than assembly to me where I'm living. Thanks once again Oleg and have a nice day/evening 👍💯

[@michaelbauers8800]

If you ever want to do something like assembly programming, but simpler, to get a sort of simple idea of it, there's a fun game called Human Resource Machine. I enjoyed it a lot. It's not quite like assembler, but it's in the ballpark. If you have programming experience, it's easy to get started. There's challenges in the game to minimize for size or speed I think, which can be fun, or tedious, depending :)

[@mobslicer1529]

i just wrote a program while watching this that uses NtRaiseHardError to display a message box, used a custom dos stub, and set the alignment to 16 instead of 4096. now i got it down to 992 bytes by using system calls. crinkler doesn't work because the code is 64-bit.

[@RandomInsano2]

This is the content I subscribed for!!!

[@BesenTV]

Now I see why the Ms ABI is always stdcall. It's extremely easy for assembly. As a Wine dev I still can't handle the Hungarian notation, though. Glad we banned it. Now I guess it's time to test, if the smallest Windows app works in Wine. 😉

[@colinofay7237]

It could be amazing to hear about you talking about any emergencies at MS, like a personal view of what it was like to respond go big exploits being taken advantage of

[@jhonbus]

"I've made a fully functional Windows program that fits in 644 bytes!" "Wow, that's tiny, what does it do?" "...What do you mean, _do?_ "

[@nickwallette6201]

Well, it occupies 644 bytes. :-) One of my most favorite things is, in Linux, if you look at the man pages for /bin/true and /bin/false, the description is: "Does nothing, successfully." and "Does nothing, unsuccessfully."

[@thomasbagley7142]

I thought your first version was masterful, it's incredible how small you have made this. I love this small Win app project of yours. It's so interesting and it explores something that many of us are interested in but don't have the time or expertise to play with. You are a master Dave, it's really incredible what you do. Thank you for taking the time and uploading these for us.

[@TheNameOfJesus]

My best efforts at hacking were to build a Batch file that converts a text file of hex characters (eg, "A0B1C2", ignoring spaces and newlines) into a binary file. I used this to create executables on systems where the creation of executables were somehow prevented. I challenge Dave to do that.

[@mittelwelle_531_khz]

Anybody here who still learned C with the very first edition of K&R? (Because there have been only three books about C available at this time.)

[@realityveil6151]

I'm not that old.

[@dondykeman1140]

I’m that old… I still have my K&R

[@Neko353-81]

no longer have that book but ya...

[@mittelwelle_531_khz]

@@dondykeman1140 first and second edition, then I stopped collecting ... 🙂

[@velho6298]

I have the second edition, I'm sorry 😔

[@BobSmun]

I remember, back in the day, there was at least one packer that would overlap a lot of the DOS Header with the PE Header (possibly the optional header too). Not sure how well that holds up with the newer windows OS versions (a lot of these packing methods start to sacrifice cross OS compatibility to eek out a few more bytes of file size savings)

[@retroretiree2086]

This reminds me of a 362 byte MS-DOS device driver that I wrote to correct the MS-DOS date and time after an add-on hard disk manufacturer's bios had destroyed it. It was a rush and it was originally just under 2K. The manufacturer of the add-on said that was too big - I told them it didn't matter provided it was under 2K as that was the cluster size on their HDD and once the driver had done its work it quit with its end address equal to its start address so no memory was used. But they wanted it to "look smaller" so at 3 AM that day I had it down to 362 bytes :) 8086 assembler none of this fancy 32 bit stuff!

[@Francois_L_7933]

A always find that modern programs really need the optimization, speed and size that Assembly can provide. If you want to have some fun, just take a look at the .Kkrieger demo game. It's a full 3D shooter that fits under 97kb and runs on Windows.

[@davestorm6718]

crikes! I wish I learned this stuff years ago (engineering, electronics and chemistry were fun and all, but...). I remember back in 1980 as a kid, wondering how to get the information for programming this kind of stuff - but, back then, "kids" simply weren't allowed to use computers in schools (mine would literally, expel a student if they touched any computer - really). Fortunately, I had a rich friend who's parents could afford a machine and he actually let me use it and showed me the ropes. Unfortunately, getting decent documentation on any computer programming from the library ( besides punched cards and teletype machines) was difficult or impossible (you needed to be in college to even get your hands on any juicy bits of information - forget getting anything from IBM or any big company at the time - trade secrets and all, especially as a teenager!). Glad to see the world has opened up since then.

[@WndSks]

Do you dare to talk about the "Rich" header inserted between the DOS and PE headers by the Microsoft linker. It contains some encrypted data...

[@JeersNX]

the smallest program for a 16 bit bootloader is 512 bytes (makes sense huh?), now the actual code can be mov ah, 0x0e mov al, 0x41 b40e b041 which is 8 bytes, nice huh?

[@zgelrevol9682]

Wow, Dave - Happy New Year! Absolutely loved this episode! I love the asm deep dive and the offer to allow us to help. Have to agree with others, its masterful indeed! More formally however I think you touched on something to be loved - teamwork. By doing it the way, and at the level you do, it brings out the best in competition. Along the way you put an sweet sample for any watcher to get their hands dirty and learn. I didn't see the jag back to C coming, yet fully believe you will take asm across the line for the checkered flag. As you might guess., I cut my teeth on 6502 asm. Be well and rock on!

[@butstough]

i laughed way too hard at the addition of "your token gray bearded wizard"

[@KevinLyda]

Just had to write a small poll(2) based server for some FreeBSD systems I work on and was curious how big it was. The normal compile came in at just over 31k. Setting CFLAGS to -Os (gcc) and running strip(1) I got it down to 22k. With some other tricks - including upx - I got it down to 10k. But this a program that does real work. It is interesting how much baggage Windows brings along even though Unix is so much older.

[@Kefford666]

I wish people like you still worked at Microsoft. I just recently installed Win10 as a second OS alongside Ubuntu. I allocated 40GB thinking that would be plenty and Windows took up 37GB by itself!!!

[@waynesmith2287]

I smiled when you mentioned Assembler and optimization as I was an IBM Systems Programer on S/360 & S/370 specializing in optimization back in the day when we had to fit program code in 64K. I also dabbled in programs for DOS and Windows.

[@PaulCotterCanada]

Me too. Abbreviated to Sysprog. Reversing a translate (TR) to re-organize memory was a cool trick. (Except we didn't use the word cool then). A 4mb upgrade to our 370 cost £2,000,000

[@waynesmith2287]

@@PaulCotterCanada One year in 1980's the company I worked for here in New Zealand spent $145 million dollars for 3 S/370 with extra memory. Tell that to kids today and they don't believe you.

[@aaronpower8741]

I once wrote a Windows program for a Production Ctrix farm in assembly. Well, when I say "production" it only had to work for a week or so. The company was moving from "Old system" to "New system". Most people accessed the system through Citrix published apps. We didn't want to just delete the app for the old system as we would then get swamped with support calls for "app doesn't work". Instead I wrote a small program that just popped up a windows and said "Remember all that training you got about the new system? How about you try the new app." - or something to that effect. On desktops we could just replace the old app with a batch file, but you can't have a batch file as a published app (or couldn't - I haven't used Citrix for some years now), so it needed to be an executable. Since software programming wasn't our thing I didn't have access to a (legal) development environment, so I was looking around for something that I could use for free to do this one time task. Stumbled across MASM and decided to write it in assembly. It worked and didn't crash the Citrix farm. After a week or two, once everyone was used to the new system we just deleted it. I was always surprised that I was able to get a working Win32 app written in assembly. It probably wasn't as neat and well formed as Dave's, but it did work for the few days we needed it. Thanks for the nostalgia from this old nerd 😃

[@grasshoffers]

This was exciting and fun, both for the history and the challenge. Absolutely love this and will be looking at source code to learn! Thank you.

[@byronwatkins2565]

It seems to me you could save several bytes by making the window struct part of the program and simply loading constant parameters as part of the code; thus, you don't need to load them into registers and store them into the struct...

[@JamieKitchens6]

Try it out and report back.

[@Crecross]

He's clearly smarter than you. Don't try to contest.

[@DFX2KX]

@@Crecross I mean... Dave literally says to give the other options a look and try and make it smaller. I'm not good enough with Assembly to contribute much, but the above approach *would* shave a handful more bytes.

[@alfred0231]

I find Win32 in ASM funny. Most ASM code is difficult to parse. But with Win32 it's easy to see the conversion from C code to ASM.

[@nickwallette6201]

Great! Now somebody pass these tips on to the people who compile drivers for hardware these days, so I don't have to resort to burning a dual-layer DVD to archive a single network card driver.

[@robertthomas5906]

644 bytes... So close to 640. As in 640K.

[@dennisfahey2379]

Pure gold. I recall a senior programmer explaining that the "compiler will do all the optimization". Then a low level (ASM) programmer analyzed the time in each routine with a Program Performance Analyzer and recoded the choke points in assembly - the increased performance was substantial, as in "wow that is WAY faster". The original (high level) programmer insisted that now the code was not portable which given the embedded nature of the custom hardware was a lame excuse really and never a design requirement. Oh, and it took far less ROM space at a time when ROM was a major expense in the COGs of the product. To me this illuminated the strength of a full stack programmer. From bits to drivers all the way up to presentation layer (and now network) a true programmer should know when and where to apply their toolkit to make the best solution than can be achieved. I will note the same coding god was one of the first to truly master multicore/multiprocessing. His intimacy with the hardware made for design win after design win.

[@DrRChandra]

Once the program size has gone below the filesystem block size, I don't see the point...other than the challenge. It kind of hits the diminishing returns realm so to speak.

[@VivekYadav-ds8oz]

What if you remove any struct padding any structure might have? It might be slower that way, but will definitely remove some extra 30-40 bytes.

[@IvanRandomDude]

100 kb and it only opens the window ElectronJs out there: Hold my 200 MB

[@Pistabacsiable]

what font is it at 17:03?

[@DavesGarage]

Glass TTY VT220

[@Pistabacsiable]

@@DavesGarage cheers!

[@YoyomaG6]

Fun little history fact. Word Perfect was written in ASM, and this is why it was so fast. Up to Word Perfect 7 for Windows. But when Corel bought Word Perfect, they did not do their due dillegence and had a horrid supprise when they realized that Word Perfect 6 for windows 3.1 was actually ALSO written in Assembly. So, Word Perfect 7 for Windows 95 was a complete re-write with some 16bit components because, well, they couldn't re-write it all in two years!

[@SeanBZA]

Which is why my sister loved it, as it was fast enough on a 286/16 PC to keep up with her typing speed. Otherwise with other word processing she would regularly out type the keyboard buffer and lose characters. Only with a 100MHz Pentium and Win98 did Word finally get fast enough that she could not out type the buffer and she finally, after a decade or more of WP, changed to Word, as the company did not want to pay the cost of Corel's upgrade.

[@nickwallette6201]

I bet that was a fun codebase to inherit...

[@YoyomaG6]

@@nickwallette6201 Because they had to re-write the whole thing, V7 for windows 95 was super buggy. It destroyed the reputation and ultimately led to business issues within Corel. The decision to make WP6 for Win3.1 in assembly was the first mistake, the second mistake is buying the company without due diligence about the state of the code base (or at least knowing about it and going forward). The third was veering away from their core business, which was Graphics stuff. They were a direct competitor to Adobe for years, and would probably have been to this day if they played their cards right. Adobe has a quasi-monopoly now on graphics software, Canva filled the gap that Corel had.

[@_fudgepop01]

I'll *absolutely* be linking this to others I meet who just really want to understand how some programs work in the Windows OS at the assembly level. This does a fantastic job explaining everything in a succinct way that can be searched for online later if necessary! It's also the video that made me realize that I'm starting to become comfortable reading asm, and boy does that thought make me feel really strange - but powerful ahahah~ Thanks for the great video Dave, and special thanks for making the original task manager program!~

[@RustedCroaker]

ChatGPT left the chat

[@MikeBramm]

Wow, very cool. Just think how much faster Windows would be if all applications were created as small as possible.

[@MartinDerTolle]

Would be cool. Maybe like a different edition of Windows called maybe Windows Legacy or Windows Classic with compliance with modern security standards but also a bare bones UI and a good compromise between features, speed, size and compatibility with older systems

[@mahoneg]

Thanks Dave. This was a cool exercise. Brought me back to the 1980s. I worked writing programs for neuroscience. Trying to get them to run in 64K. MS-DOS, Early windows and PDP-11s . I just created a java program that is 50mg. I wonder if I can get it to 45mg. :)

[@remixisthis]

This video explains windows development on a meta level better than so many books and tutorials or I went through only when I was younger. Amazing work!

[@InsaneFirebat]

Is there a recommended place to start reading if I wanna learn modern x64 assembly? My programming experience starts and ends with 65816 assembly (for Super Nintendo).

[@DavesGarage]

I'd look at Hacker Debugging Uncovered (I think that's the title). A couple of years old now but a great advanced assembly book!

[@InsaneFirebat]

@@DavesGarage Thanks! Looking into it now

[@stephenelliott7071]

I love these kind of videos, great work.

[@peterjansen4826]

What is up with all the lines which only contain zeros except for the address? Are those NOP's (don't do anything to give the CPU time to catch up with the pipelines)?

[@tomysshadow]

I assume you mean at 11:31 . Most of that isn't code, but is part of the PE Headers, which Windows requires to be at the start of every executable. It has so many addresses because the PE Headers basically outline where everything in the executable is, where the code is, where the data is, where are the resources (like icon, version info,) imports (as explained in the video,) thread local storage, does this program use .NET, where is the application manifest, and on and on. You can slim it down from it's usual size (as I'm sure Crinkler does) but only by so much before it just won't run.

[@toby9999]

Brilliant. Wish I'd known all of this 20 years ago.

[@mousefad3673]

"I'll do it all in notepad and assemble it from the command line". I like the cut of your jib, sir!

[@rmd6502]

644 bytes should be enough for anyone...

[@75slaine]

Great video Dave, really enjoyed that. It’s been a while since I did any Windows C programming, that was a trip down memory lane 👍

[@DavesGarage]

Glad you enjoyed it!

[@ewerybody]

Great to see you touch base with the demoscene! :D Size demos were always lots of fun for me.

[@atabac]

Still find it hard to follow, any books you can recommend to get up to speed for the windows stuff like the "fn_...". Like how does assembly know its definition.

[@xr.spedtech]

Reminiscing about .kkreiger ... Thanks Mr.

[@totallybonkers76]

Third (3 is a magic number! LOL)

[@napierpaxman]

Most software is bloated crap....

[@ironman5034]

More of this kind of content please

[@StreuB1]

This was absolutely wonderful!!! Thank you Dave!!!!

[@stevepoythress4678]

Great idea for content - I've always held that every serious developer should take at least an intro ASM course

[@DavesGarage]

Totally agree!

[@29Aios]

Actually, knowing the x86, or even Z80 architecture is enough to get the idea

[@stevepoythress4678]

@@29Aios Exactly - as a kid I did primitive Z80 and 8086 dev and grasping even just the basic hardware focused concepts (interrupts, stack management, pointers, and the like) is huge, just to respect what is going on under the hood

[@29Aios]

​@@stevepoythress4678 +1 ! Ah, interrupts :) They are totally disappeared today, so also LGDT/LIDT ASM instructions, they were used to remap 0000:0000 memory space to any 24-bit address of the x286, 16Mb space. Have a story about interrupts. In 90' I've created a resident prog to make memory snapshots of any program, named S&R, and then restore it by demand, which primary solved any floppy protection (save state when floppy is already checked, then restore file on any PC), but it was widely used in my local area to play games. So fellows saved games prior important event, and in case of failure just restored it. You could press F11/F12 to save/load snapshot anytime, and LIDT instruction just helped to intercept the keyboard interrupt 0x9 without boring that it has been already intercepted by someone else. Btw, in case of Mem386 utility, which was working in protected mode, and didn't allow any other program to execute high-privileged instructions like LIDT/LGDT, I still could intercept the interrupt by intercepting BIOS Clock once per second, and read the 60h port to know which key is pressed, but anyway, I couldn't read/write the protected memory. So only real mode games could be saved 😒

[@thogameskanaal]

I love for XOR reg1, reg1 is the same as a MOV 0 instruction, and OR reg1, reg1 is just an alternate NOP instruction

[@rastakins]

XOR reg,reg is not the same as mov reg,0. XOR updates the flags. Likewise OR reg,reg is not a NOP. It updates the flags without changing a register.

[@andrewandrosow4797]

Hello! In my opinion - for the cheap MCU like STM8S writing in assembly have a sense - because the Cosmic and Raisonanse C compilers costs 1000$. But... when you have libraries and pure architecture - maybe, it may have sense for the PC or a server. The TCP, TLS protocol must be written in aseembly - for the best performance. It is also actual for RDBMS .

[@jeffdege4786]

Back in my Amiga days I wrote a program consisting of a single MC68000 assembly instruction: ILLEGAL. I assembled it, linked it with no startup code or libraries, and ended up with a 40 byte executable. When I ran it it would cause AmigaOS to bring up the Guru Meditation Error.

[@whtiequillBj]

I'd like to know more about NE executable files. And why it's SO hard to find information about them.

[@gordonm2821]

I learnt to program Windows with Charles Petzold’s amazing ‘Programming’ series of books. When I moved from Win16 to Win32 his books made the transition so easy.

[@trainwreck1827]

I love your videos, but man... you need some more diagrams. I flowchart would have been amazing to illustrate the first half of the video while your schooled is on windows. I'm telling you because you might not realize how much it will help.

[@DavesGarage]

Probably true, but I have no art skills :-). I need a collaborator to draw that stuff!

[@trainwreck1827]

@@DavesGarage don't you have a lifetime Visio license? ;) If not, you can draw it up in node-red. I had to pause and draw it out, which is fine because I remember it better, but not likely what you had in mind. Also am spectrum, excuse me. Good video, u a GOAT dude.

[@ooooooooooog]

Interesting how similar avoiding static DLL imports - LoadLibrary, without static strings, etc - is to how malware often works.

[@williamist]

love small code and win32 programming and optimization. thank you task manager man!

[@TheStevenWhiting]

Struggled in the 90s in ASM. Just couldn't get my head round it. Didn't help we had a really poor teacher. I fudged one of the assignments that was suppose to take an input of our name and address then print it out. I just hard coded my name and address in the code and printed it out. So long ago can't remember if I got away with it. Wanted to understand ASM because I was so interested in Virus' back then. Not writing them, just understanding them. But just couldn't get my head around it.

[@AlexeiDimitri]

That loop choice for handling Windows mesages are a dumb choice from microsoft... Smartest was choosing a event-handler design... passing pointers to system, it calls your program specifc functions when a event occur. In this way, u can put events on different threads to not break the entire system...

[@I.____.....__...__]

- 2:16 The various "features". 😂 That's adorable. Most people would call it "bloat". Windows 10+'s Task Manager is an abomination. Windows 7 was the last time Task Manager was good, especially if you used the O&K Prio extension. The Windows 7 Task Manager is 222KB 32-bit and 251KB 64-bit and works just fine for almost every usage. Beyond that, you can just use Process Explorer (or Process Hacker or Process Lasso). - 6:53 COM files were limited to 64kb because they ran in real-mode and thus had to fit in a single memory segment. I'm still not sure why their entry-point had to be at offset 0100h. 🤔 - 7:07 I remember some people being really clever with the stub, doing things like making a hybrid DOS-Windows program that could run under DOS or Windows, using the stub to a DOS/CLI version of the program. - 7:57 No mention of NE files? (Shh, we don't talk about that. 😂) - 8:31 Ah, the command-line arguments. Someone should make a t-shirt with _MOV SI,81H_ 😀 Or maybe it's too nerdy/niche. - 15:32 PEB. Hmm, flashbacks to Greg Hoglunds books. … (I wonder how Microsoft felt about things like SoftIce? 🤔) - 17:32 Yeah, I guess it was inevitable to resort to the demo-scene. - farbrausch/.theprodukkt's .kkrieger is still epic. 👍 - 19:17 To be fair, Steve Gibson's "Small is Beautiful" demo might be 11kb, but it's a text-editor, not just a simple window.

[@motblikk3164]

Dave, can you make a video about how Windows applications have grown totally out of proportions? I myself have been a professional programmer for more than 25 years. And I cannot explain it. 23 years ago, I worked in a startup company in Norway. We grew, rapidly, from 4 people to almost 150 people, with offices in Europe, in USA. We sold a solution, not a tool. And the price tag was accordingly, expensive stuff. Now to my point, the “solution” we sold had a setup file with a whopping size of 3.5 Mb. I am not kidding you. Most written in Borland Delphi, some in assembler. At the same time Borland marketed its well renowned Interbase database, it came on one diskette! I got my first PC in 1994, bundled with Adobe Photoshop. And Photoshop came on 3 diskettes! 1.44Mb each. Today I am doing a lot of 3D, and use SynthEyes for match moving. It is a huge application when it comes to functionality. It has ton of functions, advanced algorithm, almost impossible to get top grips with all the tabs, buttons, settings etc. And the setup is a mere 20Mb! Yesterday I installed MicroChip MPLAB X, and application for programming micro controllers. It occupies 10Gb on my hard drive! Same with Visual Studio, several Gb, and so on for many others. Why does Windows 10 require several gigabytes of harddrive space, When Windows 3.11 came on 7 diskettes? I program every day, mostly C# and C++ . Recently I wrote one plug-in in C++ for Maxon Cinema 4D. I spent 8 months doing this. Advanced stuff, I can assure you. It resulted in a DLL of 600 Kb. If you could put some light on this phenomenon, it would be great. Because I myself do not understand why applications have become this astronomically enormously big. Ingvar Nilsen, Norway

[@OldePhart]

I would imagine you wouldn't have the patience, but if you made a few tutorials to create a useful windows app to the ESP32 controllers (at the hobbyist level )- you would have some real interest from a whole new group of followers .

[@solarbirdyz]

Aw yeah, this is the hard stuff. xD It has been a _while_, too. For me, anyway. I think the last time I did any Intel assembly was back in the 16-bit days, for PC Mail 3. I was working around some Novell misbehaviour in Netware.... 2.x? 3.x? Both? [ponders] Yes! 4.0 had fixed it (I don't remember the issue but it resulted in dropped server connections) and the workarounds/fixes were different on 2.x and 3.x and it ended up involving a little chunk of inline assembler triggered every 20 seconds. I do not miss Netware. Of course, neither does anyone else. xD

[@Chris.Wiley.]

I like the Steve Gibson reference! I've been using his utilities for about as long as I can remember.

[@raylopez99]

I tried every book back in the day to code to traditional Windows using the books available, and I could not make any sense of it, until I got this book: " "Introduction to Mfc Programming With Visual C++" by Richard M. Jones (2000). This book did the trick. I just code for fun and now I'm into playing chess more rather than programming, having done pretty much everything I wanted to do in programming, primarily using C#, including Azure cloud and web functions and writing a chess program. At some point I might learn assembly language just for fun, after I get the GM title, lol.

[@jochenvanaelten16]

I don't know if you already did this but you can remove the whole DOS Header. Only MZ has to remain. The only thing between MZ and PE are 2 dots like this : 4D 5A 00 00 50 45 Which translate to MZ..PE. You can shave allot of bytes this way.

[@tiger12506]

I went deep down this sort of rabbit hole back in the 2000s. Imagine how much easier it was before ASLR... Malware and binary protection systems alike used techniques like that of removing and/or messing up the import tables so that people could not as easily depack executables and modify out protection. Lots of reversing tools of the era: LordPE, ImportREC, etc. that helped in that regard.

[@paulwratt]

Has anyone heard of, or used, a project from around 2000 called SpAsm or SpAsm32 - its a self compiling Windows Assembler with a built in Editor, where the programs sources are stored at the end of the executable - yes its a _single file EXE+SRC_

[@MWGrossmann]

…and no, it's not "Hello World". We did some really neat stuff on the 6502 Atari, built on the 8080 Apple. I still have no clue how you managed to top score on Tempest (I owned one) without the spinner.

[@AUATUWVSH]

>library elimination by implementing required functions in "your own code" why yes i also do this in java, not like it matters much cense the JRE is several hundred megs, but beats having a 700MB application where 99.9% of the code goes unused

[@johnbillings5260]

The Darwin Device. My brother-in-law once found out how powerful even low voltage, current can be when he thought he could bridge a laser assembly printed flex cable for a PS1 that got sliced when he was disassembling it. He had no knowledge of data vs power lines or anything and just used a gun wrapper to bridge the whole dame thing together. He was messing with it for a while or so I thought and then I heard a quiet "Turn it off.. turn it off..." I nonchalantly walked over and power the PS1 AND him off then had a good laugh. Don't mess around with anything that looks like it could be on Big Clive's videos!

[@kristinaolson2429]

Enjoyed as someone who has been involved programming DOS int13 stuff then Windows for decades. Let me point out that as someone also on the spectrum I'll note that the video doesn't show the assembled, crinkled, ASM app actually running. Sorry that's the photographer in me. Video or it didn't happen ;) LOL

[@TedSeeber]

Back in Windows 3.1 days- At Casino Software Company of America- but really at our Casino Software Company of Canada offices in Richmond BC- the dealers were abusing our rented equipment by playing solitare on breaks. They were getting there by bringing up Taskman to end-task our software. So we had a little coding challenge- who could write the smallest EXE to do NOTHING to replace taskman.exe with? For compilers, we had Borland C++, Borland Delphi, and Microsoft Visual Basic. We also had one guy skilled in ASM. Smallest VB exe (and remember, this was basically On_Load{End}: 26k Smallest Delphi exe: 15k Smallest Borland C++: 35 bytes Smallest ASM: 15 bytes The ASM version of taskman.exe that did nothing, is what all the casino floor installs got for the next 4 casinos.

[@RealCadde]

Neat, but what would happen if you made a zero byte exe replace taskman? Would the system just kill itself? Because that makes no sense to me, it should just recover and forget about ever trying. Also makes me feel like there really should be a way to make CTRL+ALT+DEL not bring up taskman but something else, because everyone and their mother has done something to block users from using the OS behind some foreground application on windows. Would make more sense if MS provided a means of changing the default behavior to nothing at all, at the users own peril should something go wrong where they would need taskman.

[@TedSeeber]

@@RealCadde tried that, you get an "invalid EXE header" (remember, this is DOS) error code. This was in the early 1990s- not modern windows at all. Windows back then was more of a multitasking shell sitting on top of DOS.

[@RealCadde]

@@TedSeeber Right, but is it fatal? Users shouldn't be pressing CTRL+ALT+DEL and a messagebox popping up is not a major concern. Is it?

[@TedSeeber]

@@RealCadde I was a junior developer back then. The reason for the "do nothing" version was that our lead programmer got snarky and originally wrote a VB program that brought up a modal dialog box that said "You are under control of the Master Programmer. We see you trying to play games when you are working. Don't do this again!!!!"

[@RealCadde]

@@TedSeeber Lead programmer and VB program doesn't sit right with me hahah. Also, i would have just brought up a picture of Dennis Nedry from Jurassic Park. Yes, that reference might have been in the future in this case... And it would definitely take up more space. Cool that you managed to make a 15 byte executable, i just felt going to all that effort in the first place was excessive. Just remove the file or replace with empty one. And it makes me think... Why didn't MS release a barebones windows that didn't come with anything extra for machines that literally only were supposed to run a single application under a windows environment?