Differences

This shows you the differences between two versions of the page.

--- en:docs:tk:formats:newexe [2024/10/13 14:35] – prokushev
+++ en:docs:tk:formats:newexe [2026/05/15 03:41] (current) – prokushev
@@ Line 2: / Line 2: @@
 New Executable (NE) file format used by set of operating system including OS/2, Windows, Multitasking MS-DOS 4 and set of DOS Extenders. It is designed to be store on disk and in-memory usage. In-disk format is same for all OSes, but In-memory usage is mostly specific for Windows systems.
+===== New Executable header =====
 ^ Offset ^ Size ^ Name ^ Description ^
-| 00h | WORD | ne_magic | Signature word NEMAGIC |
+| 00h | WORD | ne_magic | Signature word NEMAGIC (0x4E45, 'NE') |
 | On-disk ||||
 | 02h | BYTE | ne_ver | Version number of the linker |
-| 03h | BYTE| ne_rev | Revision number of the linker |
+| 03h | BYTE | ne_rev | Revision number of the linker |
-| In-memory ||||
+| In-memory (Windows) ||||
-| 02h | WORD | count | Usage count (ne_ver/ne_rev on disk) |
+| 02h | WORD | count | Usage count  |
 | 04h | WORD | ne_enttab | Entry Table file offset, relative to the beginning of the segmented EXE header |
 | On-disk ||||
 | 06h | WORD | ne_cbenttab | Number of bytes in the entry table |
-| In-memory ||||
+| In-memory (Windows) ||||
 | 06h | WORD | next | Selector to next module |
 | On-disk ||||
 | 08h | DWORD | ne_crc | 32-bit CRC of entire contents of file. These words are taken as 00 during the calculation |
-| In-memory ||||
+| In-memory (Windows) ||||
 | 08h | WORD | dgroup_entry | Near ptr to segment entry for DGROUP |
 | 0Ah | WORD | fileinfo | Near ptr to file info (OFSTRUCT) |
@@ Line 25: / Line 27: @@
 | 12h | WORD | ne_stack | Initial size, in bytes, of stack added to the data segment. This value is zero to indicate no initial stack allocation, or when SS is not equal to DS |
 | 14h | DWORD | ne_csip | Segment number:offset of CS:IP |
-| 18h | DWORD | ne_sssp | Segment number:offset of SS:SP \\ If SS equals the automatic data segment and SP equals zero, the stack pointer is set to the top of the automatic data segment just below the additional heap area. \\ +--------------------------+\\ ! additional dynamic heap  !\\ +--------------------------+ <- SP\\ !    additional stack      !\\ +--------------------------+\\ ! loaded auto data segment !%\\ +--------------------------+ <- DS, SS |
+| 18h | DWORD | ne_sssp | Segment number:offset of SS:SP \\ If SS equals the automatic data segment and SP equals zero, the stack pointer is set to the top of the automatic data segment just below the additional heap area. \\ <code>+--------------------------+
+! additional dynamic heap  !
++--------------------------+ <- SP
+!    additional stack      !
++--------------------------+
+! loaded auto data segment !
++--------------------------+ <- DS, SS </code> |
 | 1Ch | WORD | ne_cseg | Number of entries in the Segment Table |
 | 1Eh | WORD | ne_cmod | Number of entries in the Module Reference Table |
@@ Line 38: / Line 46: @@
 | 32h | WORD | ne_align | Logical sector alignment shift count, log(base 2) of the segment sector size (default 9) |
 | 34h | WORD | ne_cres | Number of resource entries |
-| 36h | BYTE | ne_exetyp | Executable type, used by loader. 02h = WINDOWS |
+| 36h | BYTE | ne_exetyp | Executable type, used by loader. \\ 00h=Unknown (any “new‑format” OS) \\ 01h=OS/2 \\ 02h=Windows \\ 03h=European MS‑DOS 4.x \\ 04h=Windows 386 \\ 05h=BOSS (Borland Operating System Services) \\ 81h=PharLap 286<nowiki>|</nowiki>DOS-Extender, OS/2 \\ 82h=PharLap 286<nowiki>|</nowiki>DOS-Extender, Windows |
 | 37h | BYTE | ne_flagsothers | Operating system flags |
-| 38h | WORD | ??? | offset to return thunks or start of gangload area |
+| 38h | WORD | ??? | offset to return thunks or start of gangload/fastload area |
-| 3Ah | WORD | ??? | offset to segment reference thunks or length of gangload area |
+| 3Ah | WORD | ??? | offset to segment reference thunks or length of gangload/fastload area (Windows) |
-| 3Ch | WORD | ??? | minimum code swap area size |
+| 3Ch | WORD | ??? | minimum code swap area size (Windows) |
-| 3Eh | 2 BYTEs | ??? | expected Windows version (minor version first) |
+| 3Eh | 2 BYTEs | ??? | expected Windows version (minor version first) (Windows)|
+===== Flag word (ne_flags) =====
+^ Bit(s) ^ Mask ^ Name ^ Description ^
+| 0-1 | - | NOAUTODATA | No an automatic data segment |
+| 0 | 0001h | SINGLEDATA | Per-process library data (shared DGROUP) |
+| 1 | 0002h | MULTIPLEDATA | Per-instance library data |
+| 8 | 0100h | NENOTWINCOMPAT | Not compatible with PM Windowing (full screen only) (OS/2) |
+| 9 | 0200h | NEWINCOMPAT | Compatible with PM Windowing (OS/2) |
+| 10 | 0300h | NEWINAPI | Uses PM Windowing API (OS/2) |
+| 11 | 0800H | FIRSTDISC/NEBOUND | First segment in the executable file contains code that loads the application (Windows). Bound Family API (OS/2) |
+| 13 | 2000h | LINKERROR | Errors detected at link time, module will not load |
+| 14 | 4000h | NENOTMPSAFE | Non-conforming program (valid stack is not maintained) (Windows) Process is not multi‑processor safe (OS/2) |
+| 15 | 8000h | LIBRARY | Module is a dynamic‑link library (DLL) |
+===== Operating system flags (ne_flagsothers) =====
+^ Bit ^ Mask ^ Name ^ Description ^
+| 0 | 01h | NELONGNAMES | Supports long file names (OS/2) |
+| 1 | 02h | NEWINISPROT | Windows 2.x app runs in protected mode (Windows) |
+| 2 | 04h | NEWINGETPROPFON | Windows 2.x app gets proportional font (Windows) |
+| 3 | 08h | NEGANGLOAD | Contains gangload/fastload area (Windows) |
+| 7 | 80h | NEWLOAPPL | WLO application on OS/2 (markwlo.exe) (OS/2) |
 On-disk segment entry
@@ Line 53: / Line 82: @@
 | 06h | WORD | ns_minalloc | Minimum allocation size of the segment, in bytes. Total size of the segment. Zero means 64K |
-In-memory segment entry
+In-memory (Windows) segment entry
 ^ Offset ^ Size ^ Name ^ Description ^
@@ Line 62: / Line 91: @@
 | 08h | WORD | ns1_handle | Selector or handle (selector - 1) of segment in memory |
+<code c>
 struct new_segdata {
     union {
@@ Line 75: / Line 104: @@
     } ns_union;
 };
+</code>
 Relocation table header
@@ Line 121: / Line 151: @@
+  * Microsoft KB: Q65122: Executable-File Header Format
+  * Windows SDK 3.1 (MSDN Library, September 1992)