exe format

ne exe format
intel byte order

information from file format list 2.0 by max maischein.

the ne exe files are the new exe files used by windows and os/2 executables.
they contain a small mz exe which prints "this program requires microsoft
windows" or something similar but some files contain both dos and windows
versions of the executable. the position of the new exe header can be found
in the old exe header - see the mz exe topic for further information. all
offsets within this header are from the start of the header if not noted

offset count type description
0000h 2 char id='ne'
0002h 1 byte linker major version
0003h 1 byte linker minor version
0004h 1 word offset of entry table (see below)
0006h 1 word length of entry table in bytes
0008h 1 dword file load crc (0 in borland's tpw)
000ch 1 byte program flags, bitmapped :
0-1 - dgroup type :
0 - none
1 - single shared
2 - multiple
3 - (null)
2 - global initialization
3 - protected mode only
4 - 8086 instructions
5 - 80286 instructions
6 - 80386 instructions
7 - 80x87 instructions
000dh 1 byte application flags, bitmapped
0-2 - application type
1 - full screen (not aware of
windows/p.m. api)
2 - compatible with windows/p.m. api
3 - uses windows/p.m. api
3 - os/2 family application
4 - reserved?
5 - errors in image/executable
6 - "non-conforming program" whatever
7 - dll or driver (ss:sp info invalid, cs:ip
points at far init routine called with
ax=module handle which returns ax=0000h
on failure, ax nonzero on successful
000eh 1 byte auto data segment index
0010h 1 word initial local heap size
0012h 1 word initial stack size
0014h 1 dword entry point (cs:ip),
cs is index into segment table
0018h 1 dword initial stack pointer (ss:sp)
ss is index into segment table
001ch 1 word segment count
001eh 1 word module reference count
0020h 1 word size of nonresident names table in bytes
0022h 1 word offset of segment table (see below)
0024h 1 word offset of resource table
0026h 1 word offset of resident names table
0028h 1 word offset of module reference table
002ah 1 word offset of imported names table
(array of counted strings, terminated with a
string of length 00h)
002ch 1 dword offset from start of file to nonresident
names table
0030h 1 word count of moveable entry point listed in
entry table
0032h 1 word file alignment size shift count
0 is equivalent to 9 (default 512-byte pages)
0034h 1 word number of resource table entries
0036h 1 byte target operating system
0 - unknown
1 - os/2
2 - windows
3 - european ms-dos 4.x
4 - windows 386
5 - boss (borland operating system services)
0037h 1 byte other os/2 exe flags, bitmapped
0 - long filename support
1 - 2.x protected mode
2 - 2.x proportional fonts
3 - executable has gangload area
0038h 1 word offset to return thunks or start of gangload
area - whatever that means.
003ah 1 word offset to segment reference thunks or length
of gangload area.
003ch 1 word minimum code swap area size
003eh 2 byte expected windows version (minor version first)

reference:windows 3.1 sdk programmer's reference, vol 4.
see also:exe,mz exe