.EXE

MS-DOS and Windows programs

Introduction

.exe is the extension for programs on MS-DOS, Windows and OS/2. Three different formats have used it, each building on the one before: the MS-DOS MZ format from 1983, the 16-bit Windows NE format from 1985, and the PE format used by 32-bit and 64-bit Windows since 1993.

All three start with the bytes MZ. Each newer format keeps a complete MS-DOS program at the front of the file, the stub, so that running it under DOS prints a message such as “This program cannot be run in DOS mode” instead of crashing. The real header comes after the stub, and its position is stored at offset 0x3C. The NE and PE formats are also used for libraries and drivers, under extensions such as .dll, .drv and .sys.

Variations

MS-DOS executable (MZ)

The executable format of MS-DOS, used from DOS 2.0 in 1983 and named after the initials of Mark Zbikowski, one of its designers. An MZ program is 16-bit x86 code with a short header and a table of relocations, which DOS uses to adjust the program’s segment addresses to wherever it was loaded.

The file starts with MZ and has no second header. Either the relocation table offset at 0x18 is below 0x40, or the 32-bit value at 0x3C does not point to NE or PE\0\0 inside the file.

16-bit Windows executable (NE)

The New Executable format of 16-bit Windows, from Windows 1.0 to 3.11, and of the first versions of OS/2. It splits code and data into segments that can be loaded and moved on demand, imports functions from other modules by name or number, and stores resources such as icons, menus and dialogs inside the file.

The file starts with MZ, and the 32-bit offset at 0x3C points to the bytes NE. Bit 15 of the flags word at offset 0x0C of the NE header is set for a library.

Windows Portable Executable (PE)

The format of programs and libraries on 32-bit and 64-bit Windows since Windows NT 3.1 in 1993, also used for UEFI firmware applications. Built on the COFF object format, it holds code and data in sections, with tables of imports, exports, resources and relocations that let Windows load it at any address.

The file starts with MZ, and the 32-bit offset at 0x3C points to the four bytes PE\0\0. The optional header’s magic number, 0x10B or 0x20B, tells 32-bit from 64-bit, and the IMAGE_FILE_DLL flag marks a library.