.EXE

Introduction

NE, short for New Executable, is the format of programs and libraries for 16-bit Windows, from Windows 1.0 to Windows 3.11, and for the first versions of OS/2. It added what DOS programs lacked: code and data split into segments that can be loaded and moved on demand, imports from other modules by name or number, and resources such as icons, menus and dialogs stored inside the file.

The same format is used for programs (.exe), libraries (.dll) and drivers (.drv). Windows 3.x font files (.fon) are NE files that hold only resources. Modern 64-bit Windows no longer runs NE programs. See all the .EXE variations.

Structure

An NE file begins with an MS-DOS MZ header and stub program. The 32-bit offset at 0x3C points to the 64-byte NE header, which starts with NE. The header holds the program’s entry point, stack, flags and target system, and the offsets of a set of tables. Most offsets are relative to the start of the NE header; the non-resident name table’s offset is from the start of the file. The segments themselves are stored at positions given in sectors, whose size is set by the alignment shift count in the header.

Telling .EXE files apart

MS-DOS, Windows and OS/2 programs all start with MZ. The newer formats add a 32-bit offset, e_lfanew, at 0x3C, pointing to a second header. Read the bytes there:

• NE means a 16-bit Windows NE program, this format.
• LE means a Linear Executable.
• LX means an OS/2 LX program.
• PE\0\0 means a Windows PE program.
• Anything else, or an offset past the end of the file, means a plain MS-DOS program.

To tell an NE program from a DLL, check bit 15 of the flags word at offset 0x0C of the NE header, which is set for a library.

Links