[Autogenerated] how can you see the stack sizes that are stored in the p header?
One way of doing that is by opening the developer command
window for the visual studio that you have and then
running a tool called dump bin.
So dumping is generic tool that allows us to see
whatever is going on inside the p.
It has many options what they want to do here is look at the header so we
can select a file such as Explorer and we know that would explore the
maximum size should have been 512 kilobytes.
And uh and so well I guess uh it's not heather, it's headers probably.
And so you can see some data about the headers and
if we go all the way to the top,
we'll see that the stack size also here somewhere.
Let me just press control F and try to find something.
Well I guess uh the terminal here doesn't support search in the normal way.
At least the expected way like the command window.
Anyway, we can find that manually.
So let's do that.
Here it is.
We can see the stack size that is reserved.
So we can see the value here is 8 80,000 hex, which means that's 512 kilobytes.
And the size of the state commit is 000,
which in hacks is actually is 56 kilobytes.
And this explains the values that we've seen in Vienna map.
Of course if you're using some other tool that has some
graphical user interface that would be much easier,
such as using Total pE So I can go to see windows here and then find
Explorer or any other executable that I'd like and we can see here
in the header information about the stack reserve and commit to see
the same numbers but they also get their interpretation here in
human readable form.
So that's why we've seen 56 kilobytes as the initial commit in VM
app and unless a thread needed more than that,
it would just remain at 56 kilobytes being committed
upfront when that thread stack was created.
Whereas 512 kilobytes here is the maximum So we can open any
executable or that we want And see what's going on there.
So for example, let's grab something else like perhaps a reg,
edit the registry, Editori in windows.
So if you look at that we can see the numbers here are
essentially are similar but definitely not the same.
So the maximum stack size is the same as explorers configured by explorer.
But the initial commit is only 16 kill bytes because the
developer of rigid he doesn't think that most threats need
that much tax space initially.
So there's no point in committing large tax space up front.
So I decided to use 16 kilobytes only.
Still it is possible to make changes on the thread by thread basis using
the great threat function as I'll show you in the next module in any case
when you're building your own applications.
So here's an example from a previous module.
If I go to the properties in visual studio for this
project and I go to Linker and system here.
We can see there's information here about setting the stack,
reserve size and commit initial committed size.
So you can see that default here in fact,
is one megabyte and this is what we get by default.
If we don't do anything and here the default says is four
kilobytes as I mentioned in the slides.
And so if you want to change that,
you can and this will simply change those values in the p header and the
loader of course will take note and create the appropriate stuck in the
appropriate size based on your settings.
So it's something you can change if you're writing your own applications,
it's all it's possible to change that by using a tool such
as Edit Bean or other p editing tools.
But of course that will avoid the signature of the binary if it exists.
And so usually we don't do that.
But if you're writing more application,
of course you have full control over these values