How to determine exe file size from it's process?
-
Exe File is deleted but its Process is still exist. Can I determine executable file size from its process on RAM?
-
Exe File is deleted but its Process is still exist. Can I determine executable file size from its process on RAM?
Doan Quynh wrote:
Exe File is deleted but its Process is still exist.
That's not possible, AFAIK. Once the .EXE starts, the file remains locked and can't be moved, renamed, opened for write access, or deleted.
Doan Quynh wrote:
Can I determine executable file size from its process on RAM?
Nope. There's no correlation between the two sizes. Had you asked about a .COM application, then yes, memory size is equal to code size in the file because .COM files were a memory-image format. How the code looked in RAM was how it looked in the file. .EXE are a segmented and packed format and can very quickly expand way beyond their file size while being loaded.
Dave Kreskowiak Microsoft MVP Visual Developer - Visual Basic
2006, 2007 -
Doan Quynh wrote:
Exe File is deleted but its Process is still exist.
That's not possible, AFAIK. Once the .EXE starts, the file remains locked and can't be moved, renamed, opened for write access, or deleted.
Doan Quynh wrote:
Can I determine executable file size from its process on RAM?
Nope. There's no correlation between the two sizes. Had you asked about a .COM application, then yes, memory size is equal to code size in the file because .COM files were a memory-image format. How the code looked in RAM was how it looked in the file. .EXE are a segmented and packed format and can very quickly expand way beyond their file size while being loaded.
Dave Kreskowiak Microsoft MVP Visual Developer - Visual Basic
2006, 2007I don't thing so.I used VS2005, net frameworrk 2.0,while .exe file started and I can still delete, move or rename it. Other way, I store it in USB, after started it, I remove USB then still only its process. I wander when .exe32 load, the length of file will load to somewhere on memory?
-
I don't thing so.I used VS2005, net frameworrk 2.0,while .exe file started and I can still delete, move or rename it. Other way, I store it in USB, after started it, I remove USB then still only its process. I wander when .exe32 load, the length of file will load to somewhere on memory?
Doan Quynh wrote:
while .exe file started and I can still delete, move or rename it
Oddly enough, for a Managed Code application (any .NET EXE), this is true. For native code applications, it's not.
Doan Quynh wrote:
I wander when .exe32 load, the length of file will load to somewhere on memory?
Nope. It's not saved anywhere. The .EXE is literally unpacked and expanded, vaguely reminicent of a .ZIP file. There is nothing that specifies the original file size.
A guide to posting questions on CodeProject[^]
Dave Kreskowiak Microsoft MVP Visual Developer - Visual Basic
2006, 2007