.EXE

Introduction

LE, the Linear Executable format, holds 32-bit code for the flat memory model of the Intel 386. Its best-known use is for Windows virtual device drivers (VxDs): the .386 drivers of Windows 3.x in 386 enhanced mode, and the .vxd drivers of Windows 95, 98 and Me.

Some DOS extenders use it too. Many 32-bit DOS games and programs built with the Watcom C compiler are LE files run by the DOS/4GW extender, which is bound into the front of the .exe as its stub. OS/2 2.0 uses a close relative, LX. See all the .EXE variations.

Structure

An LE file begins with an MS-DOS MZ header and stub program; for a DOS extender program, the stub is the extender itself. The 32-bit offset at 0x3C points to the LE header, which starts with LE, then a byte order and a word order (0 for little-endian), the format level, the CPU and target system, the module’s version and flags, and the number of memory pages.

The rest of the header locates the module’s tables. Code and data are held in objects, the 32-bit equivalent of segments, and each object is split into pages, usually 4096 bytes. An object table lists the objects, a page table maps their pages to the file, and fixup tables say which addresses to adjust when the pages are loaded. The resident name and entry tables list the module’s name and its exported entry points.

Telling .EXE files apart

MS-DOS, Windows and OS/2 programs all start with MZ. The newer formats add a 32-bit offset, e_lfanew, at 0x3C, pointing to a second header. Read the bytes there:

• LE means a Linear Executable, this format.
• LX means an OS/2 LX program.
• NE means a 16-bit Windows NE program.
• PE\0\0 means a Windows PE program.
• Anything else, or an offset past the end of the file, means a plain MS-DOS program.

LE and LX headers are laid out almost the same way. One difference is the field at 0x2C: in LE it is the number of bytes in the last page, in LX a shift count applied to page offsets.

Links