[<<Previous Entry] [^^Up^^] [Next Entry>>] [Menu] [About The Guide]
Format of Linear Executable (enhanced mode executable) header:
Offset  Size    Description
 00h  2 BYTEs   "LE" (4Ch 45h) signature
 02h    BYTE    byte order (00h = little-endian, nonzero = big-endian)
 03h    BYTE    word order (00h = little-endian, nonzero = big-endian)
 04h    DWORD   executable format level
 08h    WORD    CPU type (see also INT 15/AH=C9h)
                01h Intel 80286 or upwardly compatible
                02h Intel 80386 or upwardly compatible
                03h Intel 80486 or upwardly compatible
                04h Intel 80586 or upwardly compatible
                20h Intel i860 (N10) or compatible
                21h Intel "N11" or compatible
                40h MIPS Mark I (R2000, R3000) or compatible
                41h MIPS Mark II (R6000) or compatible
                42h MIPS Mark III (R4000) or compatible
 0Ah    WORD    target operating system
                01h OS/2
                02h Windows
                03h DOS4.x
                04h Windows 386
 0Ch    DWORD   module version
 10h    DWORD   module type
                bit 2: initialization (only for DLLs)
                        0 = global
                        1 = per-process
                bit 4: no internal fixups in executable image
                bit 5: no external fixups in executable image
                bits 8,9,10:
                        0 = unknown
                        1 = incompatible with PM windowing \
                        2 = compatible with PM windowing    > (only for
                        3 = uses PM windowing API          /    programs)
                bit 13: module not loadable (only for programs)
                bit 15: module is DLL rather than program
 14h    DWORD   number of memory pages
 18h    Initial CS:EIP
        DWORD   object number
        DWORD   offset
 20h    Initial SS:ESP
        DWORD   object number
        DWORD   offset
 28h    DWORD   memory page size
 2Ch    DWORD   bytes on last page
 30h    DWORD   fixup section size
 34h    DWORD   fixup section checksum
 38h    DWORD   loader section size
 3Ch    DWORD   loader section checksum
 40h    DWORD   offset of object table (see below)
 44h    DWORD   object table entries
 48h    DWORD   object page map table offset
 4CH    DWORD   object iterate data map offset
 50h    DWORD   resource table offset
 54h    DWORD   resource table entries
 58h    DWORD   resident names table offset
 5Ch    DWORD   entry table offset
 60h    DWORD   module directives table offset
 64h    DWORD   Module Directives entries
 68h    DWORD   Fixup page table offset
 6Ch    DWORD   Fixup record table offset
 70h    DWORD   imported modules name table offset
 74h    DWORD   imported modules count
 78h    DWORD   imported procedures name table offset
 7Ch    DWORD   per-page checksum table offset
 80h    DWORD   data pages offset
 84h    DWORD   preload page count
 88h    DWORD   non-resident names table offset
 8Ch    DWORD   non-resident names table length
 90h    DWORD   non-resident names checksum
 94h    DWORD   automatic data object
 98h    DWORD   debug information offset
 9Ch    DWORD   debug information length
 A0h    DWORD   preload instance pages number
 A4h    DWORD   demand instance pages number
 A8h    DWORD   extra heap allocation
 ACh    ???     (at most 24 additional bytes here)
Note:   used by EMM386.EXE, QEMM, and Windows 3.0 Enhanced Mode drivers

This page created by ng2html v1.05, the Norton guide to HTML conversion utility. Written by Dave Pearson