Appendix K: Segmented (New) .EXE File Header Format
Appendix K
Segmented (New) .EXE File Header Format
Microsoft Windows requires much more information about a program than is available in
the format of the .EXE executable file supported by MS-DOS. For example, Windows needs
to identify the various segments of a program as code segments or data segments, to identify exported and imported functions, and to store the program's resources (such as icons,
cursors, menus, and dialog-box templates). Windows must also support dynamically linkable library modules containing routines that programs and other library modules can call.
For this reason, Windows programs use an expanded .EXE header format called the New
Executable file header format. This format is used for Windows programs, Windows library modules, and resource-only files such as the Windows font resource files.
The Old Executable Header
The New Executable file header format incorporates the existing MS-DOS executable file
header format. In fact, the beginning of a New Executable file is simply a normal MS-DOS
.EXE header. The 4 bytes at offset 3CH are a pointer to the beginning of the New Executable header. (Offsets are from the beginning of the Old Executable header.)
Offset
00H
01H
3CH
Length
(bytes)
1
1
4
Contents
-
Signature byte M
Signature byte Z
Offset of New Executable header from beginning of file
This normal MS-DOS .EXE header can contain size and relocation information for a nonWindows MS-DOS program that is contained within the .EXE file along with the Windows
program. This program is run when the .EXE file is executed from the MS-DOS command
line. Most Windows programmers use a standard program that simply prints the message
This program requires Microsoft Windows.
Appendixes
1487
Appendix K: Segmented (New) .EXE File Header Format
The New Executable Header
The beginning of the New Executable file header contains information about the location
and size of various tables within the header. (Offsets are from the beginning of the New
Executable header.)
Offset
Length
(bytes)
00H
01H
02H
03H
04H
1
1
1
1
2
06H
08H
2
4
OCH
OEH
2
2
10H
2
12H
2
14H
2
16H
2
18H
2
Contents
Signature byte N
Signature byte E
LINK version number
LINK revision number
Offset of beginning of entry table relative to beginning
of New Executable header
Length of entry table
32-bit checksum of eptire contents of file, using zero
for these 4 bytes
Module flag word (see below)
Segment number of automatic data segment (0 if
neither SINGLEDATA nor MULTIPLEDATA flag is set
in flag word)
Initial size of local heap to be added to automatic data
segment (0 if there is no local heap)
Initial size of stack to be added to automatic data segment (0 for library modules)
Initial value of instruction pointer (IP) register on entry
to program
Initial segment number for setting code segment (CS)
register on entry to program
Initial value of stack pointer (SP) register on entry to
program (0 if stack segment is automatic data segment; stack should be set above static data area and
below local heap in automatic data segment)
(more)
1488
The MS-DOS Encyclopedia
Appendix K: Segmented (New) .EXE File Header Format
Offset
Length
(bytes)
lAH
2
1CH
lEH
20H
22H
2
2
2
2
24H
2
26H
2
28H
2
2AH
2
2CH
4
30H
32H
34H
2
2
12
Contents
Segment number for setting stack segment (SS) register
on entry to program (0 for library modules)
Number of entries in segment table
Number of entries in module reference table
Number of bytes in nonresident names table
Offset of beginning of segment table relative to beginning of New Executable header
Offset of beginning of resource table relative to beginning of New Executable header
Offset of beginning of resident names table relative to
beginning of New Executable header
Offset of beginning of module reference table relative
to beginning of New Executable header
Offset of beginning of imported names table relative to
beginning of New Executable header
Offset of nonresident names table relative to beginning
of file
Number of movable entry points listed in entry table
Alignment shift count (0 is equivalent to 9)
Reserved for expansion
The module flag word at offset OCH in the New Executable header is defined as shown in
Figure K-1.
1 if SINGLEDATA (library module)
0 if NOAUTODATA (library module)
1 if MULTIPLEDATA (program module)
1 if module runs in real mode
1 if module runs in protected mode
1 if module is nonconforming
(valid stack is not maintained)
1 if library module
0 if program module
Figure K-1. The moduleflag word.
Appendixes
1489
Appendix K: Segmented (New) .EXE File Header Format
The segment table
This table contains one 8-byte record for every code and data segment in the program or
library module. Each segment has an ordinal number associated with it. For example, the
first segment has an ordinal number of 1. These segment numbers are used to reference
the segments in other sections of the New Executable file. (Offsets are from the beginning
of the record.)
Offset
Length
(bytes)
00H
2
02H
04H
06H
2
2
2
Contents
Offset of segment relative to beginning of file after
shifting value left by alignment shift count
Length of segment (0000H for segment of 65536 bytes)
Segment flag word (see below)
Minimum allocation size for segment; that is, amount of
space Windows reserves in memory for segment
(0000H for minimum allocation size of 65536 bytes)
The segment flag word is defined as shown in Figure K-2.
1 if DATA
0 if CODE
1 if segment data is ITERATED
1 if segment is MOVABLE
0 if segment is FIXED
1 if segment is PURE or SHAREABLE
0 if segment is IMPURE or NONSHAREABLE
1 if segment is PRELOAD
0 if segment is LOADONCALL
1 if code segment and EXECUTEONLY
0 if data segment and READONLY
1 if segment has relocation information
1 if segment has debugging information
Reserved for protected mode
descriptor privilege level
Priority level for discarding
Figure K-2. The segment flag word.
1490 The MS-DOS Encyclopedia
Appendix K: Segmented (New) .EXE File Header Format
The resource table
Resources are segments that contain data but are not included in a program's normal data
segments. Resources are commonly used in Windows programs to store menus, dialog-box
templates, icons, cursors, and text strings, but they can also be used for any type of readonly data. Each resource has a type and a name, both of which can be represented by
either a number or an ASCII name.
The resource table begins with a resource shift count used for adjusting other values in the
table. (Offsets are from the beginning of the table.)
Offset
00H
Length
(bytes)
2
Contents
Resource shift count
This is followed by one or more resource groups, each defining one or more resources.
(Offsets are from the beginning of the group.)
Offset
00H
02H
04H
08H
Length
(bytes)
2
2
4
12 each
Contents
Resource type (0 if end of table)
If high bit set, type represented by predetermined
number (high bit not shown):
1
Cursor
2
Bitmap
Icon
3
4
Menu template
Dialog-box template
5
6
String table
7
Font directory
8
Font
Keyboard-accelerator table
9
If high bit not set, type is ASCII text string and this
value is offset from beginning of resource table,
pointing to 1-byte value with number of bytes in
string followed by string itself.
Number of resources of this type
Reserved for run-time use
Resource description
Each resource description requires 12 bytes. (Offsets are from the beginning of the
description.)
Appendixes 1491
Appendix K: Segmented (New) .EXE File Header Format
Offset
Length
(bytes)
00H
2
02H
2
04H
06H
2
2
08H
4
Contents
Offset of resource relative to beginning of file after
shifting left by resource shift count
Length of resource after shifting left by resource shift
count
Resource flag word (see below)
Resource name
If high bit set, represented by a number; otherwise,
type is ASCII text string and this value is offset from
beginning of resource table, pointing to 1-byte value
with number of bytes in string followed by string
itself.
Reserved for run-time use
The resource flag word is defined as shown in Figure K-3.
1 if resource is MOVABLE
0 if resource is FIXED
1 if resource is PURE or SHAREABLE
0 if resource is IMPURE or NONSHAREABLE
1 if resource is PRELOAD
0 if resource is LOADONCALL
Priority level for discarding
Figure K-3. The resource flag word.
The resident names table
This table contains a list of ASCII strings. The first 'string is the module name given in the
module definition file. The other strings are the names of all exported functions listed in
the module definition file that were not given explicit ordinal numbers or that were explicitly specified in the file as resident names. (Exported functions with explicit ordinal
numbers in the module definition file are listed in the nonresident names table.)
Each string is prefaced by a single byte indicating the number of characters in the string
and is followed by a word (2 bytes) referencing an element in the entry table, beginning at
1. The word that follows the module name is O. (Offsets are from the beginning of the
record.)
1492 The MS-DOS Encyclopedia
Appendix K: Segmented (New) .EXE File Header Format
Offset
Length
(bytes)
Contents
00H
01H
n +1
1
n
2
Number of bytes in string (0 if end of table)
ASCII string, not null-terminated
Index into entry table
The module reference table
The module reference table contains 2 bytes for every external module the program uses.
These 2 bytes are an offset into the imported names table.
The imported names table
The imported names table contains a list of ASCII strings. These strings are the names of
all other modules that are referenced through imported functions. The strings are prefaced
with a single byte indicating the length of the string.
For most Windows programs, the imported names table includes KERNEL, USER, and GDI,
but it can also include names of other modules, such as KEYBOARD and SOUND. (Offsets
are from the beginning of the record.)
Offset
Length
(bytes)
Contents
00H
01H
1
n
Number of bytes in name string
ASCII name string, not null-terminated
These strings do not necessarily start at the beginning of the imported names table; the
names are referenced by offsets specified in the module reference table.
The entry table
This table contains one member for every entry point in the program or library module.
(Every public FAR function or procedure in a module is an entry point.) The members in
the entry table have ordinal numbers beginning at 1. These ordinal numbers are referenced by the resident names table and the nonresident names table.
LINK versions 4.0 and later bundle the members of the entry table. Each bundle begins
with the following information. (Offsets are from the beginning of the bundle.)
Offset
Length
(bytes)
00H
01H
1
1
Contents
Number of entry points in bundle (0 if end of table)
Segment number of entry points if entry points in bundle are in single fixed segment; OFFH if entry points
in bundle are in movable segments
Appendixes 1493
Appendix K: Segmented (New) .EXE File Header Format
For a bundle containing entry points in fixed segments, each entry point requires 3 bytes.
(Offsets are from the beginning of the entry description.)
Offset
Length
(bytes)
Contents
00H
01H
1
2
Entry-point flag byte (see below)
Offset of entry point in segment
For bundles containing entry points in movable segments, each entry point requires 6
bytes. (Offsets are from the beginning of the entry description.)
Offset
00H
01H
03H
04H
Length
(bytes)
Contents
Entry-point flag byte (see below)
Interrupt 3FH instruction: CDH 3FH
Segment number of entry point
Offset of entry-point segment
1
2
1
2
The entry-point flag byte is defined as shown in Figure K-4.
7 6 5 4 3 2 1 0
L 1•if entry is exported
1 if entry uses single data
(library module)
Number of parameter words
Figure K-4. The entry-point flag.
The nonresident names table
This table contains a list of ASCII strings. The first string is the module description from
the module definition file. The other strings are the names of all exported functions listed
in the module definition file that have ordinal numbers associated with them. (Exported
functions without ordinal numbers in the module definition file are listed in the resident
names table.)
Each string is prefaced by a single byte indicating the number of characters in the string
and is followed by a word (2 bytes) referencing a member of the entry table, beginning at
1. The word that follows the module description string is 0. (Offsets are from the beginning
of the table.)
1494 The MS-DOS Encyclopedia
Appendix K: Segmented (New) .EXE File Header Format
Offset
Length
(bytes)
Contents
00H
01H
n +1
1
n
2
Number of bytes in string (0 if end of table)
ASCII string, not null-terminated
Index into entry table
The code and data segment
Following the various tables in the New Executable file header are the code and data segments of the program or library module.
If the code or data segment is flagged in the segment flag word as ITERATED, the segment
is organized as follows. (Offsets are from the beginning of the segment.)
Offset
Length
(bytes)
Contents
00H
02H
04H
2
2
n
Number of iterations of data
Number of bytes of data
Data
Otherwise, the size of the segment data is given by the length of the segment field in the
segment table.
If the segment is flagged in the segment flag word as containing relocation information,
then the relocation table begins immediately after the segment data. Windows uses the
relocation table to resolve references within the segments to functions in other segments
in the same module and to imported functions in other modules. (Offsets are from the
beginning of the table.)
Offset
Length
(bytes)
Contents
00H
2
Number of relocation items
Each relocation item requires 8 bytes. (Offsets are from the beginning of the relocation
item.)
Offset
Length
(bytes)
00H
1
Contents
Type of address to insert in segment:
01H Offset only
02H Segment only
03H Segment and offset
(more)
Appendixes
1495
Appendix K: Segmented (New) .EXE File Header Format
Offset
Length
(bytes)
01H
1
02H
2
Contents
Relocation type:
00H Internal reference
01H Imported ordinal
02H Imported name
If bit 2 set, relocation type is additive (see below)
Offset of relocation item within segment
The next 4 bytes depend on the relocation type. If the relocation type is an internal reference to a segment in the same module, these bytes are defined as follows. (Offsets are
from the beginning of the relocation item.)
Offset
Length
(bytes)
04H
1
05H
06H
1
2
•
Contents
Segment number for fixed segment; OFFH for movable
segment
0
If MOVABLE segment, ordinal number referenced in
entry table; if FIXED segment, offset into segment
If the relocation type is an imported ordinal to another module, then these bytes are
defined as follows. (Offsets are from the beginning of the relocation item.)
Offset
Length
(bytes)
Contents
04H
06H
2
2
Index into module reference table
Function ordinal number
Finally, if the relocation type is an imported name of a function in another module, these
bytes are defined as follows. (Offsets are from the beginning of the relocation item.)
Offset
Length
(bytes)
04H
06H
2
2
1496 The MS-DOS Encyclopedia
Contents
Index into module reference table
Offset within imported names table to name of imported function
Appendix K: Segmented (New) .EXE File Header Format
If the ADDITIVE flag of the relocation type is set, the address of the external function is
added to the contents of the address in the target segment. If the ADDITIVE flag is not set,
then the target contains an offset to another target within the same segment that requires
the same relocation address. This defines a chain of target addresses that get the same address. The chain is terminated with a —1 entry.
Charles Petzold
Appendixes
1497
III
">
