Differences

This shows you the differences between two versions of the page.

--- en:docs:tk:formats:newexe [2024/09/30 03:27] – prokushev
+++ en:docs:tk:formats:newexe [2026/05/15 03:41] (current) – prokushev
@@ Line 2: / Line 2: @@
 New Executable (NE) file format used by set of operating system including OS/2, Windows, Multitasking MS-DOS 4 and set of DOS Extenders. It is designed to be store on disk and in-memory usage. In-disk format is same for all OSes, but In-memory usage is mostly specific for Windows systems.
+===== New Executable header =====
 ^ Offset ^ Size ^ Name ^ Description ^
-| 00h | WORD | ne_magic | Signature word NEMAGIC |
+| 00h | WORD | ne_magic | Signature word NEMAGIC (0x4E45, 'NE') |
 | On-disk ||||
 | 02h | BYTE | ne_ver | Version number of the linker |
-| 03h | BYTE| ne_rev | Revision number of the linker |
+| 03h | BYTE | ne_rev | Revision number of the linker |
-| In-memory ||||
+| In-memory (Windows) ||||
-| 02h | WORD | count | Usage count (ne_ver/ne_rev on disk) |
+| 02h | WORD | count | Usage count  |
 | 04h | WORD | ne_enttab | Entry Table file offset, relative to the beginning of the segmented EXE header |
 | On-disk ||||
 | 06h | WORD | ne_cbenttab | Number of bytes in the entry table |
-| In-memory ||||
+| In-memory (Windows) ||||
 | 06h | WORD | next | Selector to next module |
 | On-disk ||||
 | 08h | DWORD | ne_crc | 32-bit CRC of entire contents of file. These words are taken as 00 during the calculation |
-| In-memory ||||
+| In-memory (Windows) ||||
 | 08h | WORD | dgroup_entry | Near ptr to segment entry for DGROUP |
 | 0Ah | WORD | fileinfo | Near ptr to file info (OFSTRUCT) |
@@ Line 25: / Line 27: @@
 | 12h | WORD | ne_stack | Initial size, in bytes, of stack added to the data segment. This value is zero to indicate no initial stack allocation, or when SS is not equal to DS |
 | 14h | DWORD | ne_csip | Segment number:offset of CS:IP |
-| 18h | DWORD | ne_sssp | Segment number:offset of SS:SP \\ If SS equals the automatic data segment and SP equals zero, the stack pointer is set to the top of the automatic data segment just below the additional heap area. \\ +--------------------------+\\ ! additional dynamic heap  !\\ +--------------------------+ <- SP\\ !    additional stack      !\\ +--------------------------+\\ ! loaded auto data segment !%\\ +--------------------------+ <- DS, SS |
+| 18h | DWORD | ne_sssp | Segment number:offset of SS:SP \\ If SS equals the automatic data segment and SP equals zero, the stack pointer is set to the top of the automatic data segment just below the additional heap area. \\ <code>+--------------------------+
+! additional dynamic heap  !
++--------------------------+ <- SP
+!    additional stack      !
++--------------------------+
+! loaded auto data segment !
++--------------------------+ <- DS, SS </code> |
 | 1Ch | WORD | ne_cseg | Number of entries in the Segment Table |
 | 1Eh | WORD | ne_cmod | Number of entries in the Module Reference Table |
@@ Line 38: / Line 46: @@
 | 32h | WORD | ne_align | Logical sector alignment shift count, log(base 2) of the segment sector size (default 9) |
 | 34h | WORD | ne_cres | Number of resource entries |
-| 36h | BYTE | ne_exetyp | Executable type, used by loader. 02h = WINDOWS |
+| 36h | BYTE | ne_exetyp | Executable type, used by loader. \\ 00h=Unknown (any “new‑format” OS) \\ 01h=OS/2 \\ 02h=Windows \\ 03h=European MS‑DOS 4.x \\ 04h=Windows 386 \\ 05h=BOSS (Borland Operating System Services) \\ 81h=PharLap 286<nowiki>|</nowiki>DOS-Extender, OS/2 \\ 82h=PharLap 286<nowiki>|</nowiki>DOS-Extender, Windows |
 | 37h | BYTE | ne_flagsothers | Operating system flags |
-| 38h | WORD | ??? | offset to return thunks or start of gangload area |
+| 38h | WORD | ??? | offset to return thunks or start of gangload/fastload area |
-| 3Ah | WORD | ??? | offset to segment reference thunks or length of gangload area |
+| 3Ah | WORD | ??? | offset to segment reference thunks or length of gangload/fastload area (Windows) |
-| 3Ch | WORD | ??? | minimum code swap area size |
+| 3Ch | WORD | ??? | minimum code swap area size (Windows) |
-| 3Eh | 2 BYTEs | ??? | expected Windows version (minor version first) |
+| 3Eh | 2 BYTEs | ??? | expected Windows version (minor version first) (Windows)|
+===== Flag word (ne_flags) =====
+^ Bit(s) ^ Mask ^ Name ^ Description ^
+| 0-1 | - | NOAUTODATA | No an automatic data segment |
+| 0 | 0001h | SINGLEDATA | Per-process library data (shared DGROUP) |
+| 1 | 0002h | MULTIPLEDATA | Per-instance library data |
+| 8 | 0100h | NENOTWINCOMPAT | Not compatible with PM Windowing (full screen only) (OS/2) |
+| 9 | 0200h | NEWINCOMPAT | Compatible with PM Windowing (OS/2) |
+| 10 | 0300h | NEWINAPI | Uses PM Windowing API (OS/2) |
+| 11 | 0800H | FIRSTDISC/NEBOUND | First segment in the executable file contains code that loads the application (Windows). Bound Family API (OS/2) |
+| 13 | 2000h | LINKERROR | Errors detected at link time, module will not load |
+| 14 | 4000h | NENOTMPSAFE | Non-conforming program (valid stack is not maintained) (Windows) Process is not multi‑processor safe (OS/2) |
+| 15 | 8000h | LIBRARY | Module is a dynamic‑link library (DLL) |
+===== Operating system flags (ne_flagsothers) =====
+^ Bit ^ Mask ^ Name ^ Description ^
+| 0 | 01h | NELONGNAMES | Supports long file names (OS/2) |
+| 1 | 02h | NEWINISPROT | Windows 2.x app runs in protected mode (Windows) |
+| 2 | 04h | NEWINGETPROPFON | Windows 2.x app gets proportional font (Windows) |
+| 3 | 08h | NEGANGLOAD | Contains gangload/fastload area (Windows) |
+| 7 | 80h | NEWLOAPPL | WLO application on OS/2 (markwlo.exe) (OS/2) |
 On-disk segment entry
@@ Line 53: / Line 82: @@
 | 06h | WORD | ns_minalloc | Minimum allocation size of the segment, in bytes. Total size of the segment. Zero means 64K |
-In-memory segment entry
+In-memory (Windows) segment entry
 ^ Offset ^ Size ^ Name ^ Description ^
@@ Line 62: / Line 91: @@
 | 08h | WORD | ns1_handle | Selector or handle (selector - 1) of segment in memory |
+<code c>
 struct new_segdata {
     union {
@@ Line 75: / Line 104: @@
     } ns_union;
 };
+</code>
 Relocation table header
@@ Line 88: / Line 118: @@
 | 02h | WORD | nr_soff | Offset within this segment of the source chain. If the ADDITIVE flag is set, then target value is added to the source contents, instead of replacing the source and following the chain. The source chain is an 0FFFFh terminated linked list within this segment of all references to the target |
 | Internal fixup ||||
-| 04h | char | nr_segno | ??? |
+| 04h | char | nr_segno | Segment number (for fixed segment) or 0FFh (for movable segment) |
-| 05h | char | nr_res | ??? |
+| 05h | char | nr_res | Reserved (usually zero) |
-| 06h | WORD | nr_entry | ??? |
+| 06h | WORD | nr_entry | Entry table number (for movable segment) offset segment |
 | Import ||||
 | 04h | WORD | nr_mod | ??? |
@@ Line 121: / Line 151: @@
+  * Microsoft KB: Q65122: Executable-File Header Format
+  * Windows SDK 3.1 (MSDN Library, September 1992)