[<<Previous Entry]
[^^Up^^]
[Next Entry>>]
[Menu]
[About The Guide]
Format of new executable header:
Offset Size Description
00h 2 BYTEs "NE" (4Eh 45h) signature
02h 2 BYTEs linker version (major, then minor)
04h WORD offset from start of this header to entry table (see below)
06h WORD length of entry table in bytes
08h DWORD file load CRC (0 in Borland's TPW)
0Ch BYTE program flags
bits 0-1 DGROUP type
0 = none
1 = single shared
2 = multiple (unshared)
3 = (null)
bit 2: global initialization
bit 3: protected mode only
bit 4: 8086 instructions
bit 5: 80286 instructions
bit 6: 80386 instructions
bit 7: 80x87 instructions
0Dh BYTE application flags
bits 0-2: application type
001 full screen (not aware of Windows/P.M. API)
010 compatible with Windows/P.M. API
011 uses Windows/P.M. API
bit 3: is a Family Application (OS/2)
bit 5: 0=executable, 1=errors in image
bit 6: non-conforming program (valid stack is not maintained)
bit 7: DLL or driver rather than application
(SS:SP info invalid, CS:IP points at FAR init routine
called with AX=module handle which returns AX=0000h
on failure, AX nonzero on successful initialization)
0Eh WORD auto data segment index
10h WORD initial local heap size
12h WORD initial stack size (added to data seg, 0000h if SS != DS)
14h DWORD program entry point (CS:IP), "CS" is index into segment table
18h DWORD initial stack pointer (SS:SP), "SS" is segment index
if SS=automatic data segment and SP=0000h, the stack pointer is
set to the top of the automatic data segment, just below the
local heap
1Ch WORD segment count
1Eh WORD module reference count
20h WORD length of nonresident names table in bytes
22h WORD offset from start of this header to segment table (see below)
24h WORD offset from start of this header to resource table
26h WORD offset from start of this header to resident names table
28h WORD offset from start of this header to module reference table
2Ah WORD offset from start of this header to imported names table
(array of counted strings, terminated with a string of length
00h)
2Ch DWORD offset from start of file to nonresident names table
30h WORD count of moveable entry point listed in entry table
32h WORD file alignment size shift count
0 is equivalent to 9 (default 512-byte pages)
34h WORD number of resource table entries
36h BYTE target operating system
00h unknown
01h OS/2
02h Windows
03h European MSDOS 4.x
04h Windows 386
05h BOSS (Borland Operating System Services)
37h BYTE other EXE flags
bit 0: supports long filenames
bit 1: 2.X protected mode
bit 2: 2.X proportional font
bit 3: gangload area
38h WORD offset to return thunks or start of gangload area
3Ah WORD offset to segment reference thunks or length of gangload area
3Ch WORD minimum code swap area size
3Eh 2 BYTEs expected Windows version (minor version first)
Format of Codeview trailer
Format of Codeview trailer (at end of executable):
Offset Size Description
00h WORD signature 4E42h ('NB')
02h WORD Microsoft debug info version number
04h DWORD Codeview header offset
This page created by ng2html v1.05, the Norton guide to HTML conversion utility.
Written by Dave Pearson