MS-DOS EXE

From Just Solve the File Format Problem
(Difference between revisions)
Jump to: navigation, search
(Added sample files)
Line 6: Line 6:
 
|kaitai struct=dos_mz
 
|kaitai struct=dos_mz
 
}}
 
}}
−
'''MS-DOS EXE''', also known as '''MZ''' format, is an executable file format used mainly by [[MS-DOS]]. It is the successor of [[DOS executable (.com)|COM]]. A number of other executable formats are extensions of it; see [[EXE]] for those formats.
+
'''MS-DOS EXE''' (or '''DOS EXE'''), also known as '''MZ''' format, is an executable file format used mainly by [[MS-DOS]]. It is the successor of [[DOS executable (.com)|COM]]. A number of other executable formats are extensions of it; see [[EXE]] for those formats.
 +
 
 +
== Format details ==
 +
=== Header structure ===
 +
DOS EXE files begin with a fixed 28-byte header.
 +
 
 +
The field names in this table are taken from the IMAGE_DOS_HEADER structure defined in modern Windows SDKs. Byte order is little-endian.
 +
 
 +
{| class="wikitable"
 +
! Offset !! Type !! Name !! Description and remarks
 +
|-
 +
|0 || byte[2] || e_magic || Signature - ASCII "<code>MZ</code>" or "<code>ZM</code>"
 +
|-
 +
|2 || uint16 || e_cblp || If nonzero, the number of bytes in the last page
 +
|-
 +
|4 || uint16 || e_cp || Number of 512-byte pages in the file, not counting the "overlay" segment
 +
|-
 +
|6 || uint16 || e_crlc || Number of relocations
 +
|-
 +
|8 || uint16 || e_cparhdr || Header size, in 16-byte paragraphs
 +
|-
 +
|10 || uint16 || e_minalloc || Minimum allocation
 +
|-
 +
|12 || uint16 || e_maxalloc || Maximum allocation
 +
|-
 +
|14 || int16  || e_ss || Initial SS register
 +
|-
 +
|16 || uint16 || e_sp || Initial SP register
 +
|-
 +
|18 || uint16 || e_csum || Checksum - Usually unused and set to 0
 +
|-
 +
|20 || uint16 || e_ip || Initial IP register
 +
|-
 +
|22 || int16  || e_cs || Initial CS register
 +
|-
 +
|24 || uint16 || e_lfarlc || Relocation table offset, in bytes from the start of the file
 +
|-
 +
|26 || uint16 || e_ovno || Overlay number (or other custom data) - Usually unused
 +
|}
  
 
== Identification ==
 
== Identification ==

Revision as of 19:34, 3 July 2022

File Format
Name MS-DOS EXE
Ontology
Extension(s) .exe
PRONOM x-fmt/409
Kaitai Struct Spec dos_mz.ksy

MS-DOS EXE (or DOS EXE), also known as MZ format, is an executable file format used mainly by MS-DOS. It is the successor of COM. A number of other executable formats are extensions of it; see EXE for those formats.

Contents

Format details

Header structure

DOS EXE files begin with a fixed 28-byte header.

The field names in this table are taken from the IMAGE_DOS_HEADER structure defined in modern Windows SDKs. Byte order is little-endian.

Offset Type Name Description and remarks
0 byte[2] e_magic Signature - ASCII "MZ" or "ZM"
2 uint16 e_cblp If nonzero, the number of bytes in the last page
4 uint16 e_cp Number of 512-byte pages in the file, not counting the "overlay" segment
6 uint16 e_crlc Number of relocations
8 uint16 e_cparhdr Header size, in 16-byte paragraphs
10 uint16 e_minalloc Minimum allocation
12 uint16 e_maxalloc Maximum allocation
14 int16 e_ss Initial SS register
16 uint16 e_sp Initial SP register
18 uint16 e_csum Checksum - Usually unused and set to 0
20 uint16 e_ip Initial IP register
22 int16 e_cs Initial CS register
24 uint16 e_lfarlc Relocation table offset, in bytes from the start of the file
26 uint16 e_ovno Overlay number (or other custom data) - Usually unused

Identification

An MS-DOS EXE file begins with an ASCII signature of "MZ" (or, rarely, "ZM"), followed by a series of 16-bit fields. The field at offset 24 (the relocation table offset) is usually (but apparently not always) less than 64, and at least 28. A value of 64 or more, or 0, suggests the format may not be MS-DOS EXE.

It's not clear whether there is any completely reliable way to identify an MS-DOS EXE, except in the negative (i.e. it begins with "MZ", and is not a valid NE, PE, etc., file).

Sample files

Links

Retrieved from "http://fileformats.archiveteam.org/index.php?title=MS-DOS_EXE&oldid=42898"
Personal tools
Namespaces

Variants
Actions
Navigation
Toolbox