.EXE

Introduction

LX, the Linear eXecutable format, is the format of 32-bit programs (.exe) and libraries (.dll) on IBM’s OS/2, from OS/2 2.0 in 1992 onwards, and on its successors eComStation and ArcaOS. Device drivers for OS/2 use it too.

LX is a close relative of the LE format used by Windows VxD drivers, with changes to how pages are stored in the file. Earlier 16-bit OS/2 programs use NE. See all the .EXE variations.

Structure

An LX file begins with an MS-DOS MZ header and stub program. The 32-bit offset at 0x3C points to the LX header, which starts with LX, then a byte order and a word order (0 for little-endian), the format level, the CPU and target system, the module’s version and flags, and the number of pages.

As in LE, code and data are held in objects split into pages. The header gives the positions of the object table, the object page table, the resource table, the resident and non-resident name tables, the entry table, the fixup tables and the imported module and procedure names. Page offsets in the file are shifted left by a count stored in the header, and a page can be stored compressed.

Telling .EXE files apart

MS-DOS, Windows and OS/2 programs all start with MZ. The newer formats add a 32-bit offset, e_lfanew, at 0x3C, pointing to a second header. Read the bytes there:

• LX means an OS/2 LX program, this format.
• LE means a Linear Executable.
• NE means a 16-bit Windows or OS/2 NE program.
• PE\0\0 means a Windows PE program.
• Anything else, or an offset past the end of the file, means a plain MS-DOS program.

Links