.EXE File Format – The DOS and LX headers

DOS header

The first 64 bytes are an MZ header with the extended fields of Windows and OS/2 programs. DOS reads the first 28 bytes and runs the stub; OS/2 reads only the signature and e_lfanew.

00000000  4D 5A 80 00 01 00 00 00 04 00 00 00 FF FF 00 00  MZ..............
00000010  B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00  ........@.......
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00  ................

e_lfanew

The 32-bit word at 0x3C is the file offset of the LX header. The explorer follows it and checks the header it finds; see Telling it apart. Table offsets in the LX header are mostly counted from this offset, not from the start of the file.

DOS stub

The stub is the DOS program that runs when the file is started under DOS. It starts after the DOS header, at e_cparhdr × 16, and the explorer takes it to end where the DOS header says its image ends, or at the LX header if that comes first. The explorer disassembles it as 16-bit code. It usually prints a message and exits:

00000040  0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 74 68  ........!..L.!th
00000050  69 73 20 69 73 20 61 6E 20 4F 53 2F 32 20 6C 69  is is an OS/2 li
00000060  6E 65 61 72 20 65 78 74 65 6E 64 65 64 20 64 79  near extended dy
00000070  6E 61 6D 69 63 20 6C 69 6E 6B 20 6C 69 62 72 61  namic link libra
00000080  72 79 0D 0A 24 00 00 00 00 00 00 00 00 00 00 00  ry..$...........

0E           push cs
1F           pop ds             ; DS = CS, so DX can point into the stub
BA 0E 00     mov dx, 0x000E     ; the message, 14 bytes in
B4 09        mov ah, 9
CD 21        int 21h            ; DOS: print the $-terminated string at DS:DX
B8 01 4C     mov ax, 0x4C01
CD 21        int 21h            ; DOS: exit with return code 1

Bytes between the end of the stub, as its header gives its size, and the LX header are shown as “After the DOS stub”: padding, or, as here, the end of a stub that runs on past its stated size. Bytes between the DOS header’s 64 bytes and the end of the header it states are “Rest of the DOS header”. A DOS relocation table, if there is one, belongs to the stub too.

LX header

The LX header is 196 bytes (0xC4). Offsets below are from its start. The layout is IBM’s up to 0xA8; the stack size and the reserved bytes after it are from Open Watcom’s exeflat.h, which pads the header to 196 bytes.

Signature

The two bytes 4C 58, LX in ASCII.

Byte and word order

The byte order at 0x02 and the word order at 0x03 are 0 for little-endian, and 1 would mean big-endian. Only little-endian files are known, and the explorer turns down any other value.

Format level

The version of the format, 0. A loader refuses a module with any other level, and so does the explorer.

CPU type

These are IBM’s values. Other tools also list values for later Intel processors and for the Intel i860 and MIPS processors, which the explorer accepts too; their exact numbers were not confirmed, and no file examined for this site uses them. The explorer disassembles the code of the x86 types as x86.

OS type

The System Shock sound drivers below say 1, OS/2, although they are loaded by a DOS program.

Module version

A 32-bit version number of the module itself, set by the linker from the program; 0 in many files. It is not the version of the format.

Module flags

Counts

The header gives the size of each table as a count beside its offset: pages (0x14), objects (0x44), resources (0x54), module directives (0x64) and imported modules (0x74), and the size of the non-resident name table in bytes (0x8C). The number of preload pages (0x84) and of instance pages in the preload and demand sections (0xA0, 0xA4) are for the loader; the explorer shows them without using them.

Entry point and stack

The entry point is given as an object number, from 1, and an offset in that object (0x18, 0x1C); the initial stack the same way (0x20, 0x24). An object number of 0 means there is none, as in A32SBFM.DLL below. The entry points that other modules use are in the entry table. The automatic data object (0x94) is for 16-bit compatibility.

Page size

The size of a page in memory, usually 4,096 bytes. In LX a page stored in the file can be shorter: each page entry gives how many bytes are stored, and the rest of the page is zeros. The explorer wants a power of two, not 0 and at most 1 MB.

Page offset shift

Page offsets in the object page table are shifted left by this many bits. A shift of 12 means offsets count in 4,096-byte units, so pages start at multiples of 4,096 bytes from the data pages; a shift of 0 lets them start at any byte. LE has the size of the last page in the same place, which is one of the changes that make LX a separate format. The explorer turns down a shift above 24.

Sections and checksums

The tables fall into two sections. The loader section starts at the object table and holds the tables the loader keeps in memory; the fixup section is the fixup page table, the fixup records and the import tables. The header gives each one’s size and a checksum, and a checksum of the non-resident name table (0x90). The checksums are 0 in the example below, and the explorer shows them without checking them.

In A32SBFM.DLL the fixup section is 0xADB bytes, from the fixup page table at +0x108 to the end of the import procedure table at +0xBE3. Its loader section, 0xB1F bytes from the object table at +0xC4, ends at the same place.

Table offsets

Most tables are located by an offset from the start of the LX header: the object table, the object page table, the resource table, the resident names, the entry table, the module directives, the fixup page table, the fixup records, the import module and procedure tables and the per-page checksums. Three are file offsets: the iterated pages (0x4C), the non-resident names (0x88) and, below, the data pages and the debug information. An empty table has an offset of 0, or the offset of the next table, with a count of 0.

The explorer lays every table out where its offset says, fills the gaps between them, and reports a table that runs past the end of the file or into another.

Data pages

The file offset from which the page offsets in the object page table count; see Object pages.

Heap and stack sizes

The heap size at 0xA8 is for 16-bit compatibility. The stack size at 0xAC and the 20 reserved bytes after it are not in IBM’s 1992 description, which stops at 0xA8; they are from Open Watcom’s header.

Debug information

The file offset and size of debug information, in whatever format the linker chose, such as CodeView, Watcom’s own or IBM’s HLL. The explorer shows it as bytes, and marks CodeView data by its NB signature. When the size is a whole number of 28-byte entries that make sense as debug directory entries, as Microsoft’s linker writes in LE files, it shows those entries instead.

Module directives

The module directives table holds instructions for the loader, 8 bytes each:

IBM’s numbers are 0x8001 verify record, 0x0002 language information, 0x0003 co-processor required support table and 0x0004 thread state initialisation. None of the files examined for this site has any directives.

Overlay

Bytes after the last page, table or block the header points to are an overlay, which the loader does not load. The explorer shows them as one block and says what they hold when it can tell, such as an archive or installer data, or zero bytes.

Worked example

The LX header of A32SBFM.DLL, at 0x90:

00000090  4C 58 00 00 00 00 00 00 02 00 01 00 00 00 00 00  LX..............
000000A0  10 82 00 00 04 00 00 00 00 00 00 00 00 00 00 00
000000B0  00 00 00 00 00 00 00 00 00 10 00 00 0C 00 00 00
000000C0  DB 0A 00 00 00 00 00 00 1F 0B 00 00 00 00 00 00
000000D0  C4 00 00 00 01 00 00 00 DC 00 00 00 00 00 00 00
000000E0  FC 00 00 00 00 00 00 00 FC 00 00 00 07 01 00 00
000000F0  00 00 00 00 00 00 00 00 08 01 00 00 1C 01 00 00
00000100  E2 0B 00 00 00 00 00 00 E2 0B 00 00 00 00 00 00
00000110  00 0E 00 00 00 00 00 00 00 00 00 00 00 00 00 00
…           (zero to 0x153)