Ci-dessous, les différences entre deux révisions de la page.
Les deux révisions précédentesRévision précédente | |||
back2root:ibm-pc-ms-dos:hardware:informations:executable-header-format [2023/01/16 17:54] – supprimée - modification externe (Unknown date) 127.0.0.1 | back2root:ibm-pc-ms-dos:hardware:informations:executable-header-format [2023/01/16 17:54] (Version actuelle) – ↷ Page déplacée de back2root:ibm-pc-ms-dos:informations:executable-header-format à back2root:ibm-pc-ms-dos:hardware:informations:executable-header-format frater | ||
---|---|---|---|
Ligne 1: | Ligne 1: | ||
+ | ====== Executable Header Format ====== | ||
+ | |||
+ | ==== Format of .EXE file header: ==== | ||
+ | ^ Offset | ||
+ | | 00h | 2 BYTEs | .EXE signature, either " | ||
+ | | 02h | WORD | number of bytes in last 512-byte page of executable | ||
+ | | 04h | WORD | total number of 512-byte pages in executable (includes any partial last page) | | ||
+ | | 06h | WORD | number of relocation entries | ||
+ | | 08h | WORD | header size in paragraphs | ||
+ | | 0Ah | WORD | minimum paragraphs of memory to allocation in addition to executable' | ||
+ | | 0Ch | WORD | maximum paragraphs to allocate in addition to executable' | ||
+ | | 0Eh | WORD | initial SS relative to start of executable | ||
+ | | 10h | WORD | initial SP | | ||
+ | | 12h | WORD | checksum (one's complement of sum of all words in executable) | ||
+ | | 14h | DWORD | initial CS:IP relative to start of executable | ||
+ | | 18h | WORD | offset within header of relocation table (40h for New EXE) | | ||
+ | | 1Ah | WORD | overlay number (normally 0000h = main program) | ||
+ | | ---new executable--- | ||
+ | | 1Ch | 4 BYTEs | ??? | | ||
+ | | 20h | WORD | behavior bits | | ||
+ | | 22h | 26 | BYTEs reserved for additional behavior info | | ||
+ | | 3Ch | DWORD | offset of new executable header within disk file | | ||
+ | | ---Borland TLINK--- | ||
+ | | 1Ch | 2 BYTEs | ??? (apparently always 01h 00h) | | ||
+ | | 1Eh | BYTE | signature FBh | | ||
+ | | 1Fh | BYTE | TLINK version (major in high nybble, minor in low nybble) | ||
+ | | 20h | 2 BYTEs | ??? (v2.0 apparently always 72h 6Ah, v3.0+ seems always 6Ah 72h) | | ||
+ | | ---ARJ self-extracting archive--- | ||
+ | | 1Ch | 4 BYTEs | signature " | ||
+ | | ---LZEXE 0.91 compressed executable--- | ||
+ | | 1Ch | 4 BYTEs | signature " | ||
+ | | ---PKLITE compressed executable--- | ||
+ | | 1Ch | 2 BYTEs | ??? | | ||
+ | | 1Eh | 6 BYTEs | signature " | ||
+ | | ---LHarc 1.x self-extracting archive--- | ||
+ | | 1Ch | 4 BYTEs | unused??? | ||
+ | | 20h | 3 BYTEs | jump to start of extraction code | | ||
+ | | 23h | 2 BYTEs | ??? | | ||
+ | | 25h | 12 BYTEs | signature " | ||
+ | | ---LHA 2.x self-extracting archive--- | ||
+ | | 1Ch | 8 BYTEs | ??? | | ||
+ | | 24h | 10 BYTEs | signature " | ||
+ | | ---other linkers--- | ||
+ | | 1Ch | var | optional information | ||
+ | | : | ||
+ | | N | N DWORDs | ||
+ | |||
+ | ===== Format of new executable header: ===== | ||
+ | |||
+ | ^ Offset ^ Size ^Description^ | ||
+ | | 00h |2 BYTEs |" | ||
+ | | 02h |2 BYTEs |linker version (major, then minor)| | ||
+ | | 04h| WORD |offset from start of this header to entry table (see below)| | ||
+ | | 06h| WORD |length of entry table in bytes| | ||
+ | | 08h| DWORD |file load CRC (0 in Borland' | ||
+ | | 0Ch| BYTE |program flags\\ bits 0-1 DGROUP type\\ | ||
+ | | 0Dh| BYTE |application flags\\ | ||
+ | | 0Eh| WORD |auto data segment index| | ||
+ | | 10h| WORD |initial local heap size| | ||
+ | | 12h| WORD |initial stack size (added to data seg, 0000h if SS != DS)| | ||
+ | | 14h| DWORD |program entry point (CS:IP), " | ||
+ | | 18h| DWORD |initial stack pointer (SS:SP), " | ||
+ | | 1Ch| WORD |segment count| | ||
+ | | 1Eh| WORD |module reference count| | ||
+ | | 20h| WORD |length of nonresident names table in bytes| | ||
+ | | 22h| WORD |offset from start of this header to segment table (see below)| | ||
+ | | 24h| WORD |offset from start of this header to resource table| | ||
+ | | 26h| WORD |offset from start of this header to resident names table| | ||
+ | | 28h| WORD |offset from start of this header to module reference table| | ||
+ | | 2Ah| WORD |offset from start of this header to imported names table\\ (array of counted strings, terminated with a string of length 00h)| | ||
+ | | 2Ch| DWORD |offset from start of file to nonresident names table| | ||
+ | | 30h| WORD |count of moveable entry point listed in entry table| | ||
+ | | 32h| WORD |file alignment size shift count\\ 0 is equivalent to 9 (default 512-byte pages)| | ||
+ | | 34h| WORD |number of resource table entries| | ||
+ | | 36h| BYTE |target operating system\\ | ||
+ | | 37h| BYTE |other EXE flags\\ | ||
+ | | 38h| WORD |offset to return thunks or start of gangload area| | ||
+ | | 3Ah| WORD |offset to segment reference thunks or length of gangload area| | ||
+ | | 3Ch| WORD |minimum code swap area size| | ||
+ | | 3Eh |2 BYTEs |expected Windows version (minor version first)| | ||
+ | |||
+ | ===== Format of Codeview trailer (at end of executable): | ||
+ | |||
+ | ^ Offset | ||
+ | | 00h | WORD | signature 4E42h (' | ||
+ | | 02h | WORD | Microsoft debug info version number | ||
+ | | 04h | DWORD | Codeview header offset | ||
+ | |||
+ | ==== Format of new executable segment table record: ===== | ||
+ | |||
+ | ^Offset^ Size ^Description^ | ||
+ | | 00h| WORD |offset in file (shift left by alignment shift to get byte offs)| | ||
+ | | 02h| WORD |length of image in file (0000h = 64K)| | ||
+ | | 04h| WORD |attributes\\ | ||
+ | | 06h| WORD |number of bytes to allocate for segment (0000h = 64K)| | ||
+ | |||
+ | <WRAP round box> | ||
+ | the first segment table entry is entry number 1 | ||
+ | </ | ||
+ | |||
+ | ===== Format of new executable entry table item (list): ===== | ||
+ | |||
+ | ^ Offset | ||
+ | | 00h | BYTE | number of entry points (00h if end of entry table list) ||| | ||
+ | | 01h | BYTE | segment number (00h if end of entry table list) ||| | ||
+ | | 02h | 3N BYTEs | entry records | ||
+ | | | ||
+ | | ::: | ::: | ||
+ | | ::: | ::: | ||
+ | |||
+ | ===== Format of new executable relocation data (immediately follows segment image): ===== | ||
+ | |||
+ | ^ Offset | ||
+ | | 00h | WORD | number of relocation items ||| | ||
+ | | 02h | 8N BYTEs | relocation items ||| | ||
+ | | |^ Offset | ||
+ | | ::: | ::: | 00h | BYTE | relocation type\\ 00h LOBYTE\\ 02h BASE\\ 03h PTR\\ 05h OFFS\\ 0Bh PTR48\\ 0Dh OFFS32 | ||
+ | | ::: | ::: | 01h | BYTE | flags\\ bit 2: additive | ||
+ | | ::: | ::: | 02h | WORD | offset within segment | ||
+ | | ::: | ::: | 04h | WORD | target address segment | ||
+ | | ::: | ::: | 06h | WORD | target address offset | ||
+ | |||
+ | ^ Offset | ||
+ | | 00h | WORD | alignment shift count for resource data | | ||
+ | | 02h | N RECORDs | ||
+ | |||
+ | |||
+ | ===== Format of resource record: ===== | ||
+ | |||
+ | ^ Offset | ||
+ | | 00h | WORD | type ID | | ||
+ | | | | 0000h if end of resource records\\ >= 8000h if integer type\\ else offset from start of resource table to type string | ||
+ | | 02h | WORD | number of resources of this type | | ||
+ | | 04h | DWORD | reserved for runtime use | | ||
+ | | 08h | N Resources | ||
+ | |||
+ | <WRAP round box> | ||
+ | resource type and name strings are stored immediately following the resource table, and are not null-terminated | ||
+ | </ | ||
+ | |||
+ | == Format of new executable resource entry: == | ||
+ | |||
+ | ^ Offset | ||
+ | | 00h |WORD |offset in alignment units from start of file to contents of the resource data| | ||
+ | | 02h |WORD |length of resource image in bytes| | ||
+ | | 04h |WORD |flags\\ bit 4: moveable\\ bit 5: shareable\\ bit 6: preloaded| | ||
+ | | 06h |WORD |resource ID\\ >= 8000h if integer resource\\ else offset from start of resource table to resource string| | ||
+ | | 08h |DWORD |reserved for runtime use| | ||
+ | |||
+ | <WRAP round box> | ||
+ | resource type and name strings are stored immediately following the resource table, and are not null-terminated | ||
+ | |||
+ | strings are counted strings, with a string of length 0 indicating the end of the resource table | ||
+ | </ | ||
+ | |||
+ | ===== Format of new executable module reference table [one bundle of entries]: ===== | ||
+ | |||
+ | ^ Offset | ||
+ | | 00h | ||
+ | | 01h | ||
+ | | 02h | N RECORDs | ||
+ | | | Format of segment record | ||
+ | | ::: | ||
+ | | ::: | ||
+ | | ::: | ---fixed segment--- | ||
+ | | ::: | ||
+ | | ::: | ---moveable segment--- | ||
+ | | ::: | ||
+ | | ::: | ||
+ | | ::: | ||
+ | |||
+ | <WRAP round box> | ||
+ | table entries are numbered starting from 1 | ||
+ | </ | ||
+ | |||
+ | ===== Format of new executable resident/ | ||
+ | |||
+ | ^ Offset ^ Size ^Description^ | ||
+ | |00h | BYTE |length of string (00h if end of table)| | ||
+ | | 01h |N BYTEs |ASCII text of string| | ||
+ | | N+1 |WORD |ordinal number (index into entry table)| | ||
+ | |||
+ | <WRAP round box> | ||
+ | |||
+ | the first string in the resident name table is the module name; the first entry in the nonresident name table is the module description | ||
+ | |||
+ | the strings are case-sensitive; | ||
+ | </ | ||
+ | |||
+ | ===== Format of Linear Executable (enhanced mode executable) header: ===== | ||
+ | |||
+ | ^ Offset | ||
+ | | 00h | ||
+ | | 02h | ||
+ | | 03h | ||
+ | | 04h | ||
+ | | 08h | ||
+ | | 0Ah | ||
+ | | 0Ch | ||
+ | | 10h | ||
+ | | 14h | ||
+ | | 18h | ||
+ | | | DWORD | object number | ||
+ | | | DWORD | offset | ||
+ | | 20h | ||
+ | | | DWORD | object number | ||
+ | | | DWORD | offset | ||
+ | | 28h | ||
+ | | 2Ch | ||
+ | | 30h | ||
+ | | 34h | ||
+ | | 38h | ||
+ | | 3Ch | ||
+ | | 40h | ||
+ | | 44h | ||
+ | | 48h | ||
+ | | 4CH | ||
+ | | 50h | ||
+ | | 54h | ||
+ | | 58h | ||
+ | | 5Ch | ||
+ | | 60h | ||
+ | | 64h | ||
+ | | 68h | ||
+ | | 6Ch | ||
+ | | 70h | ||
+ | | 74h | ||
+ | | 78h | ||
+ | | 7Ch | ||
+ | | 80h | ||
+ | | 84h | ||
+ | | 88h | ||
+ | | 8Ch | ||
+ | | 90h | ||
+ | | 94h | ||
+ | | 98h | ||
+ | | 9Ch | ||
+ | | A0h | ||
+ | | A4h | ||
+ | | A8h | ||
+ | | ACh | ||
+ | |||
+ | <WRAP round box> | ||
+ | used by EMM386.EXE, QEMM, and Windows 3.0 Enhanced Mode drivers | ||
+ | </ | ||
+ | |||
+ | ===== Format of object table entry: ===== | ||
+ | |||
+ | ^ Offset | ||
+ | | 00h | ||
+ | | 04h | ||
+ | | 08h | ||
+ | | 0Ch | ||
+ | | 10h | ||
+ | | 10h | ||
+ | |||
+ | ===== Format of object page map table entry: ===== | ||
+ | |||
+ | ^ Offset | ||
+ | | 00h | ||
+ | |||
+ | ===== Format of resident names table entry: ===== | ||
+ | |||
+ | ^ Offset | ||
+ | | 00h | ||
+ | | 01h | ||
+ | | N+1 | ||
+ | |||
+ | ===== Format of linear executable entry table: ===== | ||
+ | |||
+ | ^ Offset | ||
+ | | 00h | ||
+ | | 01h | ||
+ | | |^ Offset | ||
+ | | ::: | ||
+ | | ::: | ||
+ | | ::: | ||
+ | | ::: | ||
+ | | ::: | ||
+ | |||
+ | ===== Format of Borland debugging information header (following load image): ===== | ||
+ | |||
+ | ^ Offset | ||
+ | | 00h | ||
+ | | 02h | ||
+ | | 04h | ||
+ | | 08h | ||
+ | | 0Ah | ||
+ | | 0Ch | ||
+ | | 0Eh | ||
+ | | 10h | ||
+ | | 12h | ||
+ | | 14h | ||
+ | | 16h | ||
+ | | 18h | ||
+ | | 1Ah | ||
+ | | 1Ch | ||
+ | | 1Eh | ||
+ | | 20h | ||
+ | | 24h | ||
+ | | 28h | ||
+ | | 29h | ||
+ | | 2Bh | ||
+ | | 2Dh | ||
+ | | 2Eh | ||
+ | | 30h | ||
+ | | 32h | ||
+ | | 34h | ||
+ | | 36h | ||
+ | | 38h | ||
+ | | 3Ah | ||
+ | | 3Ch | ||
+ | | 3Eh | ||
+ | | 42h | ||
+ | | 44h | ||
+ | | 46h | ||
+ | | 48h | ||
+ | |||
+ | <WRAP round box> | ||
+ | additional information on the Borland debugging info may be found in Borland' | ||
+ | </ |