en:docs:tk:formats:exe

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision		Previous revision
en:docs:tk:formats:exe [2024/09/22 12:28] – created prokusheven:docs:tk:formats:exe [2024/09/23 05:49] (current) – prokushev
Line 1: Line 1:
 +====== DOS Executable file format ======
 +
 +  * All multi-byte values are stored LSB first. One block is 512 bytes, one paragraph is 16 bytes. 
 +  * If the word at offset 02h is 4, it should be treated as 00h, since pre-1.10 versions of the MS linker set it that way.
 +  *  If both minimum and maximum allocation (offset 0Ah/0Ch) are zero, the program is loaded as high in memory as possible (DOS only checks the maximum allocation, however).
 +  *  The maximum allocation is set to FFFFh by default.
 +  *  Additional data may be contained in the file beyond the end of the load image described by the .EXE header; this data may be overlays, the actual executable for newer-format executables, or debugging information (see #01600,#01624).
 +  *  Relocations entries need not be in any particular order, although they are typically stored in order from beginning to end of the load image. 
 +
 ^ Offset ^ Size ^ Name ^ Description ^ ^ Offset ^ Size ^ Name ^ Description ^
-| 00h | WORD | e_magic | 0x4d, 0x5a. This is the "magic number" of an EXE file. The first byte of the file is 0x4d and the second is 0x5a. |+| 00h | WORD | e_magic | 0x4d, 0x5a or 0x5a, 0x4d. This is the "magic number" of an EXE file |
 | 02h | WORD | e_cblp  | The number of bytes in the last block of the program that are actually used. If this value is zero, that means the entire last block is used (i.e. the effective value is 512). | | 02h | WORD | e_cblp  | The number of bytes in the last block of the program that are actually used. If this value is zero, that means the entire last block is used (i.e. the effective value is 512). |
 | 04h | WORD | e_cp | Number of blocks in the file that are part of the EXE file. If [02-03] is non-zero, only that much of the last block is used. | | 04h | WORD | e_cp | Number of blocks in the file that are part of the EXE file. If [02-03] is non-zero, only that much of the last block is used. |
Line 14: Line 23:
 | 18h | WORD | e_lfarlc | Offset of the first relocation item in the file. | | 18h | WORD | e_lfarlc | Offset of the first relocation item in the file. |
 | 1Ah | WORD | e_ovno | Overlay number. Normally zero, meaning that it's the main program. | | 1Ah | WORD | e_ovno | Overlay number. Normally zero, meaning that it's the main program. |
-| 1Ch | WORD | e_res[ERES1WDS] | | +| 1Ch | DWORD | e_res | | 
-|  | WORD | e_oemid | | +| 20h | WORD | e_oemid | | 
-|  | WORD | e_oeminfo | | +| 22h | WORD | e_oeminfo | | 
-|  | WORD | e_res2[ERES2WDS] | | +| 24h | 24 WORD | e_res2 | | 
-|  | DWORD | e_lfanew |+| 2ch | DWORD | e_lfanew | Offset of the first byte of extended header (NE, LX, LE, PE...) | 
 + 
 + 
 +Relocation table entry 
 + 
 +^ Offset ^ Size ^ Name ^ Description ^ 
 +| 00h | WORD | offset | | 
 +| 02h | WORD | segment | |