MZ: Difference between revisions

← Older edit

MZ (view source)

Revision as of 16:44, 28 February 2024

2,297 bytes added , 4 months ago

→‎PE Extension: corre

[unchecked revision]

VisualWikitext

Anonymous user

osdev>Sjk

Revision as of 07:22, 18 September 2020 (view source) osdev>Unprotectedmode No edit summary ← Older edit		Latest revision as of 16:44, 28 February 2024 (view source) osdev>Sjk (→‎PE Extension: corre)
(10 intermediate revisions by 5 users not shown)
Line 1: {{File formats}} The MS-DOS EXE format, also known as MZ after its signature (the initials of Microsoft engineer Mark ~~Zbykowski~~Zbikowski), was introduced with MSPC-DOS 21.0 (pre-release version 1.0.90 only sported the simple [[COM]] format; note in DOS 1.x the DOS kernel doesn't support EXEs and the EXE loader is in COMMAND.COM; in DOS 2.x and later it was moved into the DOS kernel). It is designed as a relocatable executable running under real mode. As such, only DOS and Windows 9x/Me can use this format natively, but there are several free DOS emulators (e.g., [http://www.dosbox.com/ DOSBox]) that support it and that run under various operating systems (e.g., Linux, Amiga, Windows NT, etc.). Although they can exist on their own, MZ executables are embedded in all [[NE]], [[LE]], and [[PE]] executables, usually as stubs so that when they are ran under DOS, they display: This program cannot be run in MS-DOS mode. However, they can also be used so that a single executable can provide 2 ports of the same application (e.g., one for DOS and one for Windows). Windows 9x will run the MZ executable if the program is started from the command line prompt, or the PE executable if started normally. In the case of boot loaders, they can help provide a DOS version, ~~esp.~~especially since ~~(U)EFI~~UEFI requires the PE format, which contains a MZ executable. ==MZ File Structure== MZ executables only consists of 2 structures: the header and the relocation table. The header, which is followed by the program image, looks like this: Line 46: \| Header size \| word \| The number of paragraphs taken up by the header. It can be any value, as the loader just uses it to find where the actual executable data starts. It may be larger than what the "standard" fields take up, and you may use it if you want to include your own header metadata, or put the relocation table there, or use it for any other purpose. ~~\| The number of paragraphs taken up by the header.~~ \|- \| 10 Line 108: \| Files sometimes contain extra information for the main's program overlay management. \|} ~~''Note:~~ A paragraph is 16 bytes in size. A page (or block) is ~~[http://www.delorie.com/djgpp/doc/exe/ apparently]~~ 512 bytes long.''▼ If both the minimum and maximum allocation fields are cleared, MS-DOS will attempt to load the executable as high as possible in memory. Otherwise, the image will be loaded just above the 256-byte PSP structure, in low memory.▼ ===Relocations=== After loading the executable into memory, the program loader goes through every entry in relocation table. For each relocation entry, the loader adds the start segment address into word value pointed to by the segment:offset pair. So, for example, a relocation entry 0001:001A will make the loader add start segment address to the value at offset 10x10+0x1A=0x2A within the program data. Each pointer in the relocation table looks as such:▼ {\| {{wikitable}}▼ \|-▼ ! colspan=2\|Offset ! Field▼ ! Size ! Description \|-▼ \| 20▼ \| 0x00 \| Offset▼ \| word \| Offset of the relocation within provided segment. \|-▼ \| 2▼ \| 0x02 \| Segment▼ \| word \| Segment of the relocation, relative to the load segment address. \|}▼ CS and SS registers are relocated in a similar fashion. ==Initial Program State== ES and DS registers both point to the segment containing the PSP structure. * CS equals value specified in the header, relocated by adding the start segment address to it. * IP equals value specified in the header. Note, that unlike in [[COM]] executables, MZ programs don't start at offset 0x100. * SS equals value specified in the header, relocated, just like CS. * SP equals value specified in the header. * AL is 0x00 if the first FCB in the PSP has a valid drive identifier, 0xFF otherwise. * AH is the same as AL, but for the second FCB in the PSP. * All other registers may, or may not be set to 0. You should consider them undefined. ==PE Extension== With the advent of the [[PE]] executable, Microsoft added items to the MZ header, as defined in WinNT.h (Actually, that's incorrect – this extension was originally added in the New Executable format, which was first released as part of Windows 1.0 in 1985, and the multitasking MS-DOS 4.0 in 1986. The "PE header start" is called "e_lfanew" in Microsoft's headers, since it was originally the pointer to the NE header, although later was also used for LE, LX and PE; in principle it can be used for any executable format which is defined as an extension of MZ.) {\| {{wikitable}} Line 141 ⟶ 187: \| 20 bytes \|- \| 5060 \| ~~0x32~~0x3C \| PE header start \| dword \| Starting address of the PE header \|} ▲''Note: A paragraph is 16 bytes in size. A page (or block) is [http://www.delorie.com/djgpp/doc/exe/ apparently] 512 bytes.'' ▲Each pointer in the relocation table looks as such: ▲{\| {{wikitable}} ▲\|- ▲!Field ~~!Size (in bytes)~~ ▲\|- ▲\| Offset ▲\| 2 ▲\|- ▲\| Segment ▲\| 2 ▲\|} ▲If both the minimum and maximum allocation fields are cleared, MS-DOS will attempt to load the executable as high as possible in memory. Otherwise, the image will be loaded just above the 256-byte PSP structure, in low memory. ==See Also== Line 171 ⟶ 199: * [http://www.pinvoke.net/default.aspx/Structures.IMAGE_DOS_HEADER IMAGE_DOS_HEADER] * [https://marcin-chwedczuk.github.io/a-closer-look-at-portable-executable-msdos-stub A closer look at Portable Executable MS-DOS Stub] * [https://github.com/FDOS/kernel/blob/master/kernel/task.c#L601 FreeDOS kernel's MZ loader source code] [[Category:Executable Formats]]