EXE
From Just Solve the File Format Problem
(Difference between revisions)
(Category:Microsoft) |
|||
| Line 4: | Line 4: | ||
|extensions={{ext|exe}} | |extensions={{ext|exe}} | ||
}} | }} | ||
| − | |||
The EXE [[Executables|executable]] format has its root in [[MS-DOS]] and is still widely used today. The first versions were pure 16 bit [[MS-DOS EXE|DOS executables]], identified by either "MZ" or "ZM" as the first two bytes. Later on, lots of additional formats were added, like Windows' [[NE]] (New Executable) extension, [[OS/2]]'s LE and LX (Linear Executable), and later Win32's [[PE|PE executable]] (a variant of [[COFF]]), as well as some DOS extenders adding overlays, resources and other information into it. | The EXE [[Executables|executable]] format has its root in [[MS-DOS]] and is still widely used today. The first versions were pure 16 bit [[MS-DOS EXE|DOS executables]], identified by either "MZ" or "ZM" as the first two bytes. Later on, lots of additional formats were added, like Windows' [[NE]] (New Executable) extension, [[OS/2]]'s LE and LX (Linear Executable), and later Win32's [[PE|PE executable]] (a variant of [[COFF]]), as well as some DOS extenders adding overlays, resources and other information into it. | ||
| Line 30: | Line 29: | ||
* [http://www.textfiles.com/programming/FORMATS/exefs.pro DOS EXE format] | * [http://www.textfiles.com/programming/FORMATS/exefs.pro DOS EXE format] | ||
* [http://www.forensicswiki.org/wiki/Portable_Executable_Format Forensics Wiki: Portable Executable Format] | * [http://www.forensicswiki.org/wiki/Portable_Executable_Format Forensics Wiki: Portable Executable Format] | ||
| + | |||
| + | [[Category:Microsoft]] | ||
Revision as of 02:40, 9 May 2014
The EXE executable format has its root in MS-DOS and is still widely used today. The first versions were pure 16 bit DOS executables, identified by either "MZ" or "ZM" as the first two bytes. Later on, lots of additional formats were added, like Windows' NE (New Executable) extension, OS/2's LE and LX (Linear Executable), and later Win32's PE executable (a variant of COFF), as well as some DOS extenders adding overlays, resources and other information into it.
Formats
This is an incomplete outline of the EXE family of formats.
- EXE
- MS-DOS EXE
- NE (New Executable, 16-bit)
- Linear Executable
- LE (mixed 16/32-bit)
- LX (32-bit)
- PE (Portable Executable)
- PE32 (32-bit Windows)
- PE32+ (64-bit Windows)
Related formats
EXE files often contain embedded "resources", such as icons. Utilities such as 7-Zip can be used to extract them.
Resources
- Ralf Brown's Interrupt List, INT 21h, Function 4Bh, describes lots of the "older" style EXE formats
- Microsoft has a document on the PE specification
- article on the PE format as used by Windows NT 3 by Johannes Plachy
- Linear Executable (LX) file format here (mirror here and here)
- Another copy of above file (not stuck in an iframe)
- DOS EXE format
- Forensics Wiki: Portable Executable Format
