.EXE File Format – The object table

OS/2 executable (LX)

An LX module’s code and data are held in objects, the 32-bit successors of segments. The object table lists them: for each one its size and address in memory, its flags, and which entries of the object page table hold its pages. It is at the header’s object table offset (0x40, from the start of the LX header), with as many entries as the header’s object count (0x44). Objects are numbered from 1.

Object entry

Each entry is 24 bytes:

OffsetSizeFieldMeaning
04Virtual sizeThe size of the object in memory.
44Relocation baseThe address the object is linked to run at.
84FlagsAccess, residency and the 32-bit flag.
124Page table indexIts first entry in the object page table, from 1.
164Page table entriesHow many pages it has.
204ReservedZero.

The object’s pages are entries index to index + entries − 1 of the page table; page j of the object (from 0) is loaded at the relocation base plus j × the page size.

Object flags

The bits are IBM’s, with Open Watcom’s names:

BitMeaning
0x0001Readable.
0x0002Writable.
0x0004Executable: the object holds code.
0x0008Resource object.
0x0010Discardable.
0x0020Shared.
0x0040Has preload pages.
0x0080Has invalid pages.
0x0700Residency: 0x100 has zero-filled pages, 0x200 resident, 0x300 resident and contiguous, 0x400 resident and long-lockable.
0x100016:16 alias required.
0x2000Big/default: a 32-bit object. In code, the default operand and address size is 32 bits.
0x4000Conforming, for code.
0x8000I/O privilege.

The explorer disassembles executable objects (0x0004) as 32-bit code when 0x2000 is set and as 16-bit code otherwise. A 32-bit object’s addresses count from its relocation base; a 16-bit object’s count from 0, as offsets in its segment. See the x86 instruction reference.

Worked example

00000154  50 3D 00 00 00 00 01 00 05 20 00 00 01 00 00 00  P=....... ......
00000164  04 00 00 00 00 00 00 00
The object table of A32SBFM.DLL, at 0xC4 from its LX header
ObjectSizeBaseFlagsPages
10x3D50 (15,696 bytes)0x000100000x2005: readable, executable, 32-bit1 to 4

The driver is a single 32-bit object, readable and executable, linked at 0x10000; four 4,096-byte pages hold its 15,696 bytes. The explorer shows its code with addresses from 0x10000.