EXE

EXE is the executable file format developed by the Microsoft company for the following operating systems: Windows, DOS, OS/2.

The EXE file contains series of instructions for the processor to be executed.

Magic number of the EXE file format is: 0x4d 0x5a (which means, each EXE file starts with the ASCII string called "MZ".

Formats of the EXE file

DOS

• 16-bit DOS MZ Executable (MZ)

 * The original DOS executable format, identifiable by the ASCII letters "MZ" at the start of the file.
 * Later formats retain an MZ DOS stub header for backward compatibility.

• 16-bit New Executable (NE)

 * Introduced in multitasking MS-DOS 4.0.
 * Used in 16-bit OS/2 and Windows, identifiable by "NE" in ASCII.

OS/2

• 32-bit Linear Executable (LX)

 * Introduced in OS/2 2.0 and identifiable by "LX" in ASCII.
 * Runs only on OS/2 2.0 and higher.

• Mixed 16/32-bit Linear Executable (LE)

 * Introduced in OS/2 2.0, identifiable by "LE" in ASCII.
 * Used for VxD drivers on Windows 3.x, OS/2, and Windows 9x.

Windows

• 32-bit Portable Executable (PE)

The PE format is used by Windows 95 and higher.

 * Introduced with Windows NT, structured as "fat binaries" with a DOS-specific and Windows-specific section.
 * The DOS stub (a minimal DOS program) displays "This program cannot be run in DOS mode." Custom DOS stubs can be created.
 * The Windows part starts with "PE\\0\\0" (ASCII for "PE" with two null bytes).

• 64-bit Portable Executable (PE32+)

 * Introduced with 64-bit Windows, an extended PE format with wider fields.
 * Often allows code to run in either 32-bit or 64-bit mode.
 * Includes a DOS stub for compatibility.

Other Formats

• Additional EXE formats include W3 (used in WIN386.EXE), W4 (compressed LE files in VMM32.VXD), and others like DL, MP, P2, and P3 (used by Phar Lap extenders).

Parts of the PE EXE file

EXE file consists of the following parts: headers, sections

EXE headers

• MS-DOS Header
• PE Header

MS-DOS Header

Its length is 64 bytes and contains the relocation information. This header is intended for MS-DOS operating system.

Purpose of this header is to show an error message, if such an EXE file is started on the MS-DOS operating system, which is only for historical purposes.

• Usual text of the message is: This program cannot be run in DOS mode

External links

https://eshagalawatta.medium.com/analyzing-structure-of-executable-programs-exe-files-821b2d531a4

https://en.wikipedia.org/wiki/.exe