Jump to navigation Jump to search
This page is a stub.
You can help the wiki by accurately adding more contents to it.
Executable Formats

16 bit:
Mixed (16/32 bit):
32/64 bit:




The WIN-NE executable format, designed for Windows 3.x, was the "NE", or "New Executable" format. Again, a 16bit format, it alleviated the maximum size restrictions that the MZ format had.


Operating Systems that use it: Windows 1.01 through 3.xx. The format can be run on later 32 bit windows systems (in a VDM), but is not the native format.
Because of 64 bit lack of v8086, support is discarded on 64 bit windows.

Inside the NE file


DOS Stub

The DOS stub is a valid MZ exe. This enables the developer to package both an MS-DOS and Win16 version of the program, but normally just prints "This Program requires Microsoft Windows". The e_lfanew field (offset 0x3C) points to the NE header.

NE Header

The NE header is a relatively large structure with multiple characteristics. Because of the age of the format some items are unclear in meaning. The structure is as below (some comments may be wrong. If so please change):

struct NE_header {
    char sig[2];                 //"NE"
    uint8_t MajLinkerVersion;    //The major linker version
    uint8_t MinLinkerVersion;    //The minor linker version
    uint16_t EntryTableOffset;   //Offset of entry table, see below
    uint16_t EntryTableLength;   //Length of entry table in bytes
    uint32_t FileLoadCRC;        //32-bit CRC of entire contents of file
    uint8_t ProgFlags;           //Program flags, bitmapped
    uint8_t ApplFlags;           //Application flags, bitmapped
    uint16_t AutoDataSegIndex;   //The automatic data segment index
    uint16_t InitHeapSize;       //The initial local heap size
    uint16_t InitStackSize;      //The initial stack size
    uint32_t EntryPoint;         //CS:IP entry point, CS is index into segment table
    uint32_t InitStack;          //SS:SP initial stack pointer, SS is index into segment table
    uint16_t SegCount;           //Number of segments in segment table
    uint16_t ModRefs;            //Number of module references (DLLs)
    uint16_t NoResNamesTabSiz;   //Size of non-resident names table, in bytes (Please clarify non-resident names table)
    uint16_t SegTableOffset;     //Offset of Segment table
    uint16_t ResTableOffset;     //Offset of resources table
    uint16_t ResidNamTable;      //Offset of resident names table
    uint16_t ModRefTable;        //Offset of module reference table
    uint16_t ImportNameTable;    //Offset of imported names table (array of counted strings, terminated with string of length 00h)
    uint32_t OffStartNonResTab;  //Offset from start of file to non-resident names table
    uint16_t MovEntryCount;      //Count of moveable entry point listed in entry table
    uint16_t FileAlnSzShftCnt;   //File alignment size shift count (0=9(default 512 byte pages))
    uint16_t nResTabEntries;     //Number of resource table entries
    uint8_t targOS;              //Target OS
    uint8_t OS2EXEFlags;         //Other OS/2 flags
    uint16_t retThunkOffset;     //Offset to return thunks or start of gangload area - what is gangload?
    uint16_t segrefthunksoff;    //Offset to segment reference thunks or size of gangload area
    uint16_t mincodeswap;        //Minimum code swap area size
    uint8_t expctwinver[2];      //Expected windows version (minor first)

//Program flags
//DGroup type (what is this?)
enum dgrouptype {
    none,         //None
    sinshared,    //single shared
    multiple,     //Multiple
    null          //(null)

#define GLOBINIT 1<<2     //global initialization
#define PMODEONLY 1<<3    //Protected mode only
#define INSTRUC86 1<<4    //8086 instructions
#define INSTRU286 1<<5    //80286 instructions
#define INSTRU386 1<<6    //80386 instructions
#define INSTRUx87 1<<7    //80x87 (FPU) instructions

//Application flags
//Application type
enum apptype {
    fullscreeen,    //fullscreen (not aware of Windows/P.M. API)
    winpmcompat,    //compatible with Windows/P.M. API
    winpmuses       //uses Windows/P.M. API
#define OS2APP 1<<3    //OS/2 family application
//bit 4 reserved?
#define IMAGEERROR 1<<5    //errors in image/executable
#define NONCONFORM 1<<6    //non-conforming program?
#define DLL        1<<7    //DLL or driver (SS:SP invalid, CS:IP->Far INIT routine AX=HMODULE,returns AX==0 success, AX!=0 fail)

//Target Operating System
enum targetos {
    unknown,    //Obvious ;)
    os2,        //OS/2 (as if you hadn't worked that out!)
    win,        //Windows (Win16)
    dos4,       //European DOS  4.x
    win386,     //Windows for the 80386 (Win32s). 32 bit code.
    BOSS        //The boss, a.k.a Borland Operating System Services
//Other OS/2 flags
#define LFN 1        //OS/2 Long File Names (finally, no more 8.3 conversion :) )
#define PMODE 1<<1   //OS/2 2.x Protected Mode executable
#define PFONT 1<<2   //OS/2 2.x Proportional Fonts
#define GANGL 1<<3   //OS/2 Gangload area

See Also