I went through. How does a PE file get into memory? This is not what I ask.
I want to know which sections (data, text, code, ...) of a PE file are always completely loaded into memory by the loader, regardless of the conditions?
As I understand it, none of the sections (code, data, resources, text, ...) are fully loaded, they are loaded as necessary, through the pages. If several pages of code (in the middle or at the end) are not required to process a user request, these pages will not always load.
I tried to create exe files with a lot of code with / without resources, both of which are not used at all, but every time the exe is loaded into memory, it takes up more memory than the file size. (Perhaps I was looking for the wrong column "Memory in the task manager")
Matt Pietrek writes here
It is important to note that PE files are not just mapped to memory as a single memory mapped file. Instead, the Windows boot loader looks at the PE file and decides which parts of the file should be displayed.
and
The in-memory module represents all the code, data, and resources from the executable needed by the process. Other parts of the PE file may be read but not displayed (for example, moving). Some parts may not be displayed at all, for example, when debugging information is placed at the end of the file.
In a nutshell,
1 There is an exe with a size of 1 MB, and the available memory (physical + virtual) is less than 1 MB, does it agree that the bootloader will always refuse to boot, since the available memory is smaller than the file size?
2- If an exe with a size of 1 MB takes up 2 MB of memory at boot (starts to run the first line of user code), and the available memory (physical + virtual) is 1.5 MB, is it compatible that the bootloader will always refuse to load, is there insufficient memory?
3. There is an exe of 50 MB in size (a lot of code, data and resources), but it takes 500 KB to run the first line of user code, it is not surprising that this exe will always run the first line of code if the available memory (physical + virtual) is 500 KB at least?