.EXE

16-bit Windows executable (NE)

Introduction

NE, short for New Executable, is the format of programs and libraries for 16-bit Windows, from Windows 1.0 to Windows 3.11, and for the first versions of OS/2. It added what DOS programs lacked: code and data split into segments that can be loaded and moved on demand, imports from other modules by name or number, and resources such as icons, menus and dialogs stored inside the file.

The same format is used for programs (.exe), libraries (.dll) and drivers (.drv). Windows 3.x font files (.fon) are NE files that hold only resources. Modern 64-bit Windows no longer runs NE programs. See all the .EXE variations.

Software

Structure

An NE file begins with an MS-DOS MZ header and stub program. The 32-bit offset at 0x3C points to the 64-byte NE header, which starts with NE. The header holds the program’s entry point, stack, flags and target system, and the offsets of a set of tables. Most offsets are relative to the start of the NE header; the non-resident name table’s offset is from the start of the file. The segments themselves are stored at positions given in sectors, whose size is set by the alignment shift count in the header.

  1. 0x00MZ header and DOS stub, with e_lfanew at 0x3Cvaries
  2. e_lfanewNE header: NE, entry point, flags, table offsets64 bytes
  3. …segment table: position, size and flags of each segment8 bytes each
  4. …resource table: icons, menus, dialogs and other resourcesvaries
  5. …resident name table, module reference table, imported names tablevaries
  6. …entry table: the functions the module exportsvaries
  7. …non-resident name tablevaries
  8. …segment data, each with its relocations, and resource datavaries
A 16-bit Windows NE executable.

Telling .EXE files apart

An MS-DOS program, a 16-bit Windows program and a modern Windows program all start with MZ. Windows programs add a 32-bit offset, e_lfanew, at 0x3C, pointing to a second header. Read the bytes there:

  • NE means a 16-bit Windows NE program, this format.
  • PE\0\0 means a Windows PE program.
  • Anything else, or an offset past the end of the file, means a plain MS-DOS program.

To tell an NE program from a DLL, check bit 15 of the flags word at offset 0x0C of the NE header, which is set for a library.