linking & linkers 32-bit PE (obj=COFF)

[asmfan]

hello everyone!
i wonder which linker do you use to produce your win32 PE files? i'm looking for the best linker which gives no unneeded/extra padding and trash marks, e.g. "*Rich*" using <link.exe>, in produced executables... can U share with your experience?
demanding the cleanest binaries!:)

[dsouza123]

link.exe 
Microsoft iin the MASM32 package (or with MS Visual C++/Visual Studio)

polink.exe
Pelles C compiler package

[Mark Jones]

POLINK.exe typically produces smaller .exe's than MS Link.

[PBrennick]

PoLink, for sure.

Paul

[Vortex]

I use Pelle's powerfull linker PoLink for MS COFF object files and Digital Mars link.exe for OMF object files.

[lingo]

Mark, :lol
"POLINK.exe typically produces smaller .exe's than MS Link."

Can you proof it?

Regards,
Lingo

[Mark Jones]

Mark, :lol
"POLINK.exe typically produces smaller .exe's than MS Link."

Can you proof it?

Regards,
Lingo

Hi Lingo. Sure. Here's the results of compiling my latest project with MS Link v7.0.9210.0 and POLINK v4.0.0.0. There is nothing special or different about this project other than it is a console app with 4 modules and no resources.

MS Link: 30,208 bytes
POLINK: 27,136 bytes

Linker options were:

Code Select Expand


\masm32\bin\LINK.EXE /SUBSYSTEM:CONSOLE /RELEASE /FORCE:MULTIPLE
    /VERSION:4.0 /LIBPATH:"\masm32\lib" /OUT:"TT.exe" *.obj
\masm32\bin\POLINK.EXE /SUBSYSTEM:CONSOLE /RELEASE /FORCE:MULTIPLE
    /VERSION:4.0 /LIBPATH:"\masm32\lib" /OUT:"TT.exe" *.obj


Apparently POLINK produces smaller EXE's by better-trimming the slack space used between PE sections. I think.

[asmfan]

look what i've just found out using HIEW, OllyDbg and foobar;)
polink writes MZ/PE header better, without any odd marks, while MS link dont (I told - "%Rich%":) BUT (!) polink marks import section as WRITEABLE(!), not only INITIALIZED and READABLE and merge it automatically with <.data?> section while MS link with <.const> which is more correct i think since import table are filled (written) with addresses by windows only and should be protected.

[lingo]

Mark, :lol
" Sure. Here's the results...

Many thanks, but I expected an attachment with files
I want to compare them to understand why
"POLINK produces smaller .exe's than MS Link"

The PE standard is from MS rather than from Pelle
So if POLINK  really produce smaller ("better") code
it is some kind of modification of the MS PE standards,
hence it is probably unsafe  to use it under Windows
It is linker not compiler...


asmfan,
"polink writes MZ/PE header better, without any odd marks,
while MS link dont (I told - "%Rich%":)"

The MS "odd marks" are between DOS and PE headers and
doesn't change the total length because we will see less zeroes at the end
If they make you nervous just patch your MS Linker and your Pe header will
begin beforehand.  How to patch it?

Code Select Expand


In hiew look for similar structures:
ver.7.10.2179
.
0045E564: E8C7A6FFFF call .000458C30
0045E569: 8B8D34020000 mov ecx,[ebp][00000234]
0045E56F: 03C8 add ecx,eax ; Patch here
0045E571: 8944242C mov [esp][2C],eax
0045E575: 898D38020000 mov [ebp][00000238],ecx
0045E57B: FF15BC124000 call _tzset ; MSVCR71.dll

just substitute  03C8 (add ecx, eax)  with two nops  (9090)

ver.8.00.40426.16
.0044C5B2: E82EB8FFFF call       .000447DE5  ---↑ (A)
.0044C5B7: 8B8D60020000 mov       ecx,[ebp][00000260]
.0044C5BD: 03C8 add ecx,eax ; Patch here
.0044C5BF: 89442414 mov [esp][14],eax
.0044C5C3: 898D64020000 mov [ebp][00000264],ecx
.0044C5C9: FF15B8124000 call _tzset ;MSVCR80


Regards,
Lingo

[Mark Jones]

Mark, :lol
" Sure. Here's the results...

Many thanks, but I expected an attachment with files
I want to compare them to understand why
"POLINK produces smaller .exe's than MS Link"

Hi Lingo, I can't attach that project but it is easy enough to test it yourself. Simply compile a project as normal, then download Pelle's C v4 and recompile using POLINK, and compare the two executables. I don't think Pelle would have made the linker purposely void MS specs unless it was safe to do so. I haven't seen any issues surrounding the [smaller] executables, but one never knows.

[PBrennick]

Lingo,
You can program so there is no reason why you cannot do those tests yourself.

Paul

[Ghirai]

lingo, i've been running files linked with polink on quite a few win systems for quite some time, and i never had any problems.

[lingo]

Ghirai, :lol
"...and i never had any problems."

OK, I'm just curious why some people "prefer"
other LINKERS different than MS link

Regards,
Lingo

[Mark Jones]

One issue I've found with POLINK is that it does not make .PDB files. (Maybe a licensing issue?) It apparently does make debugging info, and I think it zips it and adds it to the end of the file. OllyDbg won't show source code if the executable is linked with POLINK.

Hmm, someone should make an Olly plugin for this if possible.

[Ghirai]

Ghirai, :lol
"...and i never had any problems."

OK, I'm just curious why some people "prefer"
other LINKERS different than MS link

Regards,
Lingo

I preffer it because it produces smaller executables, and the output is rarely detected as 'masm/whatever' by file analyzers.