1. Assembly 2005, Helsinki, July 20051 Crinkler - compressing Windows 4k intros to EXE files Aske Simon Christensen Rune L. H. Stubbe

2. Assembly 2005, Helsinki, July 20052 Overview Background Compression method Function import Header layout Demo Future plans

3. Assembly 2005, Helsinki, July 20053 Why another one? EXE optimizerCAB compressorBAT inserter EXE file BAT file Most common method: CAB dropping Dropping is a mess We want EXE files!

4. Assembly 2005, Helsinki, July 20054 How is Crinkler different? The normal build process: CompilerAssemberLinkerCruncher C/C++ files ASM files object / library files EXE file

5. Assembly 2005, Helsinki, July 20055 How is Crinkler different? The Crinkler way: CompilerAssemberCrinkler C/C++ files ASM files object / library files EXE file

6. Assembly 2005, Helsinki, July 20056 Why another one? Control over code and data placement –Choose base address –Optimize order for best compression –Separate code and data –Put in extra code Import code Code transformations

7. Assembly 2005, Helsinki, July 20057 Compression method Context modelling + Much better compression ratio than LZX + Well suited for small amounts of data + Small decompression code (< 250 bytes) + Pays off even with the extra header - Extremely slow - Very memory-hungry

8. Assembly 2005, Helsinki, July 20058 Data compression basics Take advantage of self-similarity Find patterns and eliminate them Dictionary compression Statistical compression

9. Assembly 2005, Helsinki, July 20059 Dictionary compression LZ77: Refer repetitions back to original Reasonable compression ratio Fast compression Very fast decompression MISSISSIPPIMISS ISSI PPI

10. Assembly 2005, Helsinki, July 200510 Estimate probability distribution of each symbol based on earlier data PPM: Problem: local MISSISSIPPI Statistical compression

11. Assembly 2005, Helsinki, July 200511 MISSISSIPPI Context modelling Generalization of PPM Look at combinations of recent symbols A bit mask describes a model Problem: Many masks to choose from 00000100

12. Assembly 2005, Helsinki, July 200512 Implementation Estimation for each single bit Context is current byte + selection of last 8 Estimate the best collection of masks Estimate the best weights of the masks Keep track of contexts in a hash table Ignore hash collisions Find hash table size with few collisions

13. Assembly 2005, Helsinki, July 200513 Function import Import by name: Name of each function –The import table is a big part of an EXE file Import by ordinal: Number instead of name –Much smaller but quite incompatible Import by hash: Hash code of each function –Small and compatible –Not supported directly Import by hashed ordinal range

14. Assembly 2005, Helsinki, July 200514 Header optimization DOS header Section header PE offset DOS stub PE header Data directories 544 bytes!

15. Assembly 2005, Helsinki, July 200515 Header optimization DOS header Section header PE offset DOS stub PE header Data directories

16. Assembly 2005, Helsinki, July 200516 Header optimization DOS header Section header PE offset DOS stub PE header Data directories

17. Assembly 2005, Helsinki, July 200517 Header optimization DOS header Section header PE offset DOS stub PE header Data directories Ignored

18. Assembly 2005, Helsinki, July 200518 Header optimization DOS header Section header PE offset DOS stub PE header Data directories Ignored 196 bytes!

19. Assembly 2005, Helsinki, July 200519 Header optimization DOS header Section header PE offset DOS stub PE header Data directories Hash code 124 bytes + 18 hash codes!

20. Assembly 2005, Helsinki, July 200520 Demo

21. Assembly 2005, Helsinki, July 200521 Future plans Windows 2000 compatibility Even better compression Section reordering Transformations More feedback 64k specialized version

22. Assembly 2005, Helsinki, July 200522 Thank you Questions? Comments? Suggestions?