[<<Previous Entry] [^^Up^^] [Next Entry>>] [Menu] [About The Guide]
Format of new executable header:
Offset  Size    Description
 00h  2 BYTEs   "NE" (4Eh 45h) signature
 02h  2 BYTEs   linker version (major, then minor)
 04h    WORD    offset from start of this header to entry table (see below)
 06h    WORD    length of entry table in bytes
 08h    DWORD   file load CRC (0 in Borland's TPW)
 0Ch    BYTE    program flags
                bits 0-1 DGROUP type
                  0 = none
                  1 = single shared
                  2 = multiple (unshared)
                  3 = (null)
                bit 2:  global initialization
                bit 3:  protected mode only
                bit 4:  8086 instructions
                bit 5:  80286 instructions
                bit 6:  80386 instructions
                bit 7:  80x87 instructions
 0Dh    BYTE    application flags
                bits 0-2: application type
                    001 full screen (not aware of Windows/P.M. API)
                    010 compatible with Windows/P.M. API
                    011 uses Windows/P.M. API
                bit 3: is a Family Application (OS/2)
                bit 5: 0=executable, 1=errors in image
                bit 6: non-conforming program (valid stack is not maintained)
                bit 7: DLL or driver rather than application
                        (SS:SP info invalid, CS:IP points at FAR init routine
                         called with AX=module handle which returns AX=0000h
                         on failure, AX nonzero on successful initialization)
 0Eh    WORD    auto data segment index
 10h    WORD    initial local heap size
 12h    WORD    initial stack size (added to data seg, 0000h if SS != DS)
 14h    DWORD   program entry point (CS:IP), "CS" is index into segment table
 18h    DWORD   initial stack pointer (SS:SP), "SS" is segment index
                if SS=automatic data segment and SP=0000h, the stack pointer is
                  set to the top of the automatic data segment, just below the
                  local heap
 1Ch    WORD    segment count
 1Eh    WORD    module reference count
 20h    WORD    length of nonresident names table in bytes
 22h    WORD    offset from start of this header to segment table (see below)
 24h    WORD    offset from start of this header to resource table
 26h    WORD    offset from start of this header to resident names table
 28h    WORD    offset from start of this header to module reference table
 2Ah    WORD    offset from start of this header to imported names table
                (array of counted strings, terminated with a string of length
                 00h)
 2Ch    DWORD   offset from start of file to nonresident names table
 30h    WORD    count of moveable entry point listed in entry table
 32h    WORD    file alignment size shift count
                0 is equivalent to 9 (default 512-byte pages)
 34h    WORD    number of resource table entries
 36h    BYTE    target operating system
                00h unknown
                01h OS/2
                02h Windows
                03h European MSDOS 4.x
                04h Windows 386
                05h BOSS (Borland Operating System Services)
 37h    BYTE    other EXE flags
                bit 0: supports long filenames
                bit 1: 2.X protected mode
                bit 2: 2.X proportional font
                bit 3: gangload area
 38h    WORD    offset to return thunks or start of gangload area
 3Ah    WORD    offset to segment reference thunks or length of gangload area
 3Ch    WORD    minimum code swap area size
 3Eh  2 BYTEs   expected Windows version (minor version first)

Format of Codeview trailer
Format of Codeview trailer (at end of executable):
Offset  Size    Description
 00h    WORD    signature 4E42h ('NB')
 02h    WORD    Microsoft debug info version number
 04h    DWORD   Codeview header offset

This page created by ng2html v1.05, the Norton guide to HTML conversion utility. Written by Dave Pearson