
Executable-File Header Format (3.1)

An executable (.EXE) file for the Windows operating system 
contains a combination of code and data or a combination of 
code, data, and resources. The executable file also contains 
two headers: an MS-DOS header and a Windows header. The next 
two sections describe these headers; the third section 
describes the code and data contained in a Windows executable 
file. 

MS-DOS Header

The MS-DOS (old-style) executable-file header contains four 
distinct parts: a collection of header information (such as 
the signature word, the file size, and so on), a reserved 
section, a pointer to a Windows header (if one exists), and a 
stub program. The following illustration shows the MS-DOS 
executable-file header: 
If the word value at offset 18h is 40h or greater, the word 
value at 3Ch is typically an offset to a Windows header. 
Applications must verify this for each executable-file header 
being tested, because a few applications have a different 
header style. 
MS-DOS uses the stub program to display a message if Windows 
has not been loaded when the user attempts to run a program. 

Windows Header

The Windows (new-style) executable-file header contains 
information that the loader requires for segmented executable 
files. This information includes the linker version number, 
data specified by the linker, data specified by the resource 
compiler, tables of segment data, tables of resource data, 
and so on. The following illustration shows the Windows 
executable-file header: 
The following sections describe the entries in the Windows 
executable-file header. 

Information Block

The information block in the Windows header contains the 
linker version number, the lengths of various tables that 
further describe the executable file, the offsets from the 
beginning of the header to the beginning of these tables, the 
heap and stack sizes, and so on. The following list 
summarizes the contents of the header information block (the 
locations are relative to the beginning of the block): 

Location Description
00h      Specifies the signature word. The low byte contains 
         "N" (4Eh) and the high byte contains "E" (45h). 
02h      Specifies the linker version number. 
03h      Specifies the linker revision number. 
04h      Specifies the offset to the entry table (relative to 
         the beginning of the header). 
06h      Specifies the length of the entry table, in bytes. 
08h      Reserved. 
0Ch      Specifies flags that describe the contents of the 
         executable file. This value can be one or more of the 
         following bits: 

         Bit Meaning
         0   The linker sets this bit if the executable-file 
             format is SINGLEDATA. An executable file with 
             this format contains one data segment. This bit 
             is set if the file is a dynamic-link library 
             (DLL). 
         1   The linker sets this bit if the executable-file 
             format is MULTIPLEDATA. An executable file with 
             this format contains multiple data segments. This 
             bit is set if the file is a Windows application. 
             If neither bit 0 nor bit 1 is set, the 
             executable-file format is NOAUTODATA. An 
             executable file with this format does not contain 
             an automatic data segment. 
         2   Reserved. 
         3   Reserved. 
         8   Reserved. 
         9   Reserved. 
         11  If this bit is set, the first segment in the 
             executable file contains code that loads the 
             application. 
         13  If this bit is set, the linker detects errors at 
             link time but still creates an executable file. 
         14  Reserved. 
         15  If this bit is set, the executable file is a 
             library module. 
             If bit 15 is set, the CS:IP registers point to an 
             initialization procedure called with the value in 
             the AX register equal to the module handle. The 
             initialization procedure must execute a far 
             return to the caller. If the procedure is 
             successful, the value in AX is nonzero. 
             Otherwise, the value in AX is zero. 
             The value in the DS register is set to the 
             library's data segment if SINGLEDATA is set. 
             Otherwise, DS is set to the data segment of the 
             application that loads the library. 
0Eh      Specifies the automatic data segment number. (0Eh is 
         zero if the SINGLEDATA and MULTIPLEDATA bits are 
         cleared.) 
10h      Specifies the initial size, in bytes, of the local 
         heap. This value is zero if there is no local 
         allocation. 
12h      Specifies the initial size, in bytes, of the stack. 
         This value is zero if the SS register value does not 
         equal the DS register value. 
14h      Specifies the segment:offset value of CS:IP. 
18h      Specifies the segment:offset value of SS:SP. 
         The value specified in SS is an index to the module's 
         segment table. The first entry in the segment table 
         corresponds to segment number 1. 
         If SS addresses the automatic data segment and SP is 
         zero, SP is set to the address obtained by adding the 
         size of the automatic data segment to the size of the 
         stack. 
1Ch      Specifies the number of entries in the segment table. 
1Eh      Specifies the number of entries in the 
         module-reference table. 
20h      Specifies the number of bytes in the nonresident-name 
         table. 
22h      Specifies a relative offset from the beginning of the 
         Windows header to the beginning of the segment table. 
24h      Specifies a relative offset from the beginning of the 
         Windows header to the beginning of the resource 
         table. 
26h      Specifies a relative offset from the beginning of the 
         Windows header to the beginning of the resident-name 
         table. 
28h      Specifies a relative offset from the beginning of the 
         Windows header to the beginning of the 
         module-reference table. 
2Ah      Specifies a relative offset from the beginning of the 
         Windows header to the beginning of the imported-name 
         table. 
2Ch      Specifies a relative offset from the beginning of the 
         file to the beginning of the nonresident-name table. 
30h      Specifies the number of movable entry points. 
32h      Specifies a shift count that is used to align the 
         logical sector. This count is log2 of the segment 
         sector size. It is typically 4, although the default 
         count is 9. (This value corresponds to the /alignment
         [/a] linker switch. When the linker command line 
         contains /a:16, the shift count is 4. When the linker 
         command line contains /a:512, the shift count is 9.) 
34h      Specifies the number of resource segments. 
36h      Specifies the target operating system, depending on 
         which bits are set: 

         Bit Meaning

         0   Operating system format is unknown. 
         1   Reserved. 
         2   Operating system is Microsoft Windows. 
         3   Reserved. 
         4   Reserved. 
37h      Specifies additional information about the executable 
         file. It can be one or more of the following values: 

         Bit Meaning

         1   If this bit is set, the executable file contains 
             a Windows 2.x application that runs in version 3.x
              protected mode. 
         2   If this bit is set, the executable file contains 
             a Windows 2.x application that supports 
             proportional fonts. 
         3   If this bit is set, the executable file contains 
             a fast-load area. 
38h      Specifies the offset, in sectors, to the beginning of 
         the fast-load area. (Only Windows uses this value.) 
3Ah      Specifies the length, in sectors, of the fast-load 
         area. (Only Windows uses this value.) 
3Ch      Reserved. 
3Eh      Specifies the expected version number for Windows. 
         (Only Windows uses this value.) 

Segment Table

The segment table contains information that describes each 
segment in an executable file. This information includes the 
segment length, segment type, and segment-relocation data. 
The following list summarizes the values found in the segment 
table (the locations are relative to the beginning of each 
entry): 

Location Description

00h      Specifies the offset, in sectors, to the segment data 
         (relative to the beginning of the file). A value of 
         zero means no data exists. 
02h      Specifies the length, in bytes, of the segment, in 
         the file. A value of zero indicates that the segment 
         length is 64K, unless the selector offset is also 
         zero. 
04h      Specifies flags that describe the contents of the 
         executable file. This value can be one or more of the 
         following: 

         Bit Meaning

         0   If this bit is set, the segment is a data 
             segment. Otherwise, the segment is a code 
             segment. 
         1   If this bit is set, the loader has allocated 
             memory for the segment. 
         2   If this bit is set, the segment is loaded. 
         3   Reserved. 
         4   If this bit is set, the segment type is MOVABLE.
             Otherwise, the segment type is FIXED. 
         5   If this bit is set, the segment type is PURE or 
             SHAREABLE. Otherwise, the segment type is IMPURE
             or NONSHAREABLE.
         6   If this bit is set, the segment type is PRELOAD.
             Otherwise, the segment type is LOADONCALL.
         7   If this bit is set and the segment is a code 
             segment, the segment type is EXECUTEONLY. If this 
             bit is set and the segment is a data segment, the 
             segment type is READONLY. 
         8   If this bit is set, the segment contains 
             relocation data. 
         9   Reserved. 
         10  Reserved. 
         11  Reserved. 
         12  If this bit is set, the segment is discardable. 
         13  Reserved. 
         14  Reserved. 
         15  Reserved. 
06h      Specifies the minimum allocation size of the segment, 
         in bytes. A value of zero indicates that the minimum 
         allocation size is 64K. 

Resource Table

The resource table describes and identifies the location of 
each resource in the executable file. The table has the 
following form: 
WORD     rscAlignShift;
TYPEINFO rscTypes[];
WORD     rscEndTypes;
BYTE     rscResourceNames[];
BYTE     rscEndNames;
Following are the members in the resource table: 
rscAlignShift    Specifies the alignment shift count for 
                 resource data. When the shift count is used 
                 as an exponent of 2, the resulting value 
                 specifies the factor, in bytes, for computing 
                 the location of a resource in the executable 
                 file. 
rscTypes         Specifies an array of TYPEINFO structures 
                 containing information about resource types. 
                 There must be one TYPEINFO structure for each 
                 type of resource in the executable file. 
rscEndTypes      Specifies the end of the resource type 
                 definitions. This member must be zero. 
rscResourceNames Specifies the names (if any) associated with 
                 the resources in this table. Each name is 
                 stored as consecutive bytes; the first byte 
                 specifies the number of characters in the 
                 name. 
rscEndNames      Specifies the end of the resource names and 
                 the end of the resource table. This member 
                 must be zero. 

Type Information

The TYPEINFO structure has the following form: 
typedef struct _TYPEINFO {
    WORD        rtTypeID;
    WORD        rtResourceCount;
    DWORD       rtReserved;
    NAMEINFO    rtNameInfo[];
} TYPEINFO;
Following are the members in the TYPEINFO structure: 
rtTypeID       Specifies the type identifier of the resource. 
               This integer value is either a resource-type 
               value or an offset to a resource-type name. If 
               the high bit in this member is set (0x8000), 
               the value is one of the following resource-type 
               values: 

               Value            Resource type

               RT_ACCELERATOR   Accelerator table 
               RT_BITMAP        Bitmap 
               RT_CURSOR        Cursor 
               RT_DIALOG        Dialog box 
               RT_FONT          Font component 
               RT_FONTDIR       Font directory 
               RT_GROUP_CURSOR  Cursor directory 
               RT_GROUP_ICON    Icon directory 
               RT_ICON          Icon 
               RT_MENU          Menu 
               RT_RCDATA        Resource data 
               RT_STRING        String table 
               If the high bit of the value in this member is 
               not set, the value represents an offset, in 
               bytes relative to the beginning of the resource 
               table, to a name in the rscResourceNames
               member. 
rtResourceCount    Specifies the number of resources of this 
               type in the executable file. 
rtReserved     Reserved. 
rtNameInfo     Specifies an array of	NAMEINFO structures 
               containing information about individual 
               resources. The rtResourceCount member specifies 
               the number of structures in the array. 

Name Information

The NAMEINFO structure has the following form: 
typedef struct _NAMEINFO {
    WORD rnOffset;
    WORD rnLength;
    WORD rnFlags;
    WORD rnID;
    WORD rnHandle;
    WORD rnUsage;
} NAMEINFO;
Following are the members in the NAMEINFO structure: 
rnOffset Specifies an offset to the contents of the resource 
         data (relative to the beginning of the file). The 
         offset is in terms of alignment units specified by 
         the rscAlignShift member at the beginning of the 
         resource table. 
rnLength Specifies the resource length, in bytes. 
rnFlags  Specifies whether the resource is fixed, preloaded, 
         or shareable. This member can be one or more of the 
         following values: 

         Value  Meaning

         0x0010 Resource is movable (MOVEABLE). Otherwise, it 
                is fixed. 
         0x0020 Resource can be shared (PURE). 
         0x0040 Resource is preloaded (PRELOAD). Otherwise, it 
                is loaded on demand. 
rnID     Specifies or points to the resource identifier. If 
         the identifier is an integer, the high bit is set 
         (8000h). Otherwise, it is an offset to a resource 
         string, relative to the beginning of the resource 
         table. 
rnHandle Reserved. 
rnUsage  Reserved. 

Resident-Name Table

The resident-name table contains strings that identify 
exported functions in the executable file. As the name 
implies, these strings are resident in system memory and are 
never discarded. The resident-name strings are case-sensitive 
and are not null-terminated. The following list summarizes 
the values found in the resident-name table (the locations 
are relative to the beginning of each entry): 

Location Description

00h      Specifies the length of a string. If there are no 
         more strings in the table, this value is zero. 
01h - xxhSpecifies the resident-name text. This string is 
         case-sensitive and is not null-terminated. 
xxh + 01hSpecifies an ordinal number that identifies the 
         string. This number is an index into the entry table. 
The first string in the resident-name table is the module 
name. 

Module-Reference Table

The module-reference table contains offsets for module names 
stored in the imported-name table. Each entry in this table 
is 2 bytes long. 

Imported-Name Table

The imported-name table contains the names of modules that 
the executable file imports. Each entry contains two parts: a 
single byte that specifies the length of the string and the 
string itself. The strings in this table are not 
null-terminated. 

Entry Table

The entry table contains bundles of entry points from the 
executable file (the linker generates each bundle). The 
numbering system for these ordinal values is 1-based--that 
is, the ordinal value corresponding to the first entry point 
is 1. 
The linker generates the densest possible bundles under the 
restriction that it cannot reorder the entry points. This 
restriction is necessary because other executable files may 
refer to entry points within a given bundle by their ordinal 
values. 
The entry-table data is organized by bundle, each of which 
begins with a 2-byte header. The first byte of the header 
specifies the number of entries in the bundle (a value of 00h 
designates the end of the table). The second byte specifies 
whether the corresponding segment is movable or fixed. If the 
value in this byte is 0FFh, the segment is movable. If the 
value in this byte is 0FEh, the entry does not refer to a 
segment but refers, instead, to a constant defined within the 
module. If the value in this byte is neither 0FFh nor 0FEh, 
it is a segment index. 

For movable segments, each entry consists of 6 bytes and has 
the following form: 

Location Description

00h      Specifies a byte value. This value can be a 
         combination of the following bits: 

         Bit(s)    Meaning

         0     If this bit is set, the entry is exported. 
         1     If this bit is set, the segment uses a global 
               (shared) data segment. 
         3-7   If the executable file contains code that 
               performs ring transitions, these bits specify 
               the number of words that compose the stack. At 
               the time of the ring transition, these words 
               must be copied from one ring to the other. 
01h      Specifies an int 3fh instruction. 
03h      Specifies the segment number. 
04h      Specifies the segment offset. 

For fixed segments, each entry consists of 3 bytes and has the 
following form: 

Location Description

00h      Specifies a byte value. This value can be a 
         combination of the following bits: 

         Bit(s)    Meaning

         0     If this bit is set, the entry is exported. 
         1     If this bit is set, the entry uses a global 
               (shared) data segment. (This may be set only 
               for SINGLEDATA library modules.) 
         3-7   If the executable file contains code that 
               performs ring transitions, these bits specify 
               the number of words that compose the stack. At 
               the time of the ring transition, these words 
               must be copied from one ring to the other. 
01h      Specifies an offset. 

Nonresident-Name Table

The nonresident-name table contains strings that identify 
exported functions in the executable file. As the name 
implies, these strings are not always resident in system 
memory and are discardable. The nonresident-name strings are 
case-sensitive; they are not null-terminated. The following 
list summarizes the values found in the nonresident-name 
table (the specified locations are relative to the beginning 
of each entry): 

Location Description

00h      Specifies the length, in bytes, of a string. If this 
         byte is 00h, there are no more strings in the table. 
01h - xxhSpecifies the nonresident-name text. This string is 
         case-sensitive and is not null-terminated. 
xx + 01h Specifies an ordinal number that is an index to the 
         entry table. 
The first name that appears in the nonresident-name table is 
the module description string (which was specified in the 
module-definition file). 

Code Segments and Relocation Data

Code and data segments follow the Windows header. Some of the 
code segments may contain calls to functions in other 
segments and may, therefore, require relocation data to 
resolve those references. This relocation data is stored in a 
relocation table that appears immediately after the code or 
data in the segment. The first 2 bytes in this table specify 
the number of relocation items the table contains. A 
relocation item is a collection of bytes specifying the 
following information: 
  Address type (segment only, offset only, segment and 
  offset) 
  Relocation type (internal reference, imported ordinal, 
  imported name) 
  Segment number or ordinal identifier (for internal 
  references) 
  Reference-table index or function ordinal number (for 
  imported ordinals) 
  Reference-table index or name-table offset (for imported 
  names) 
Each relocation item contains 8 bytes of data, the first byte 
of which specifies one of the following relocation-address 
types: 

Value  Meaning

0      Low byte at the specified offset 
2      16-bit selector 
3      32-bit pointer 
5      16-bit offset 
11     48-bit pointer 
13     32-bit offset 
The second byte specifies one of the following relocation 
types: 

Value  Meaning

0      Internal reference 
1      Imported ordinal 
2      Imported name 
3      OSFIXUP
The third and fourth bytes specify the offset of the 
relocation item within the segment. 
If the relocation type is imported ordinal, the fifth and 
sixth bytes specify an index to a module's reference table and 
the seventh and eighth bytes specify a function ordinal value. 
If the relocation type is imported name, the fifth and sixth 
bytes specify an index to a module's reference table and the 
seventh and eighth bytes specify an offset to an imported-name 
table. 
If the relocation type is internal reference and the segment 
is fixed, the fifth byte specifies the segment number, the 
sixth byte is zero, and the seventh and eighth bytes specify 
an offset to the segment. If the relocation type is internal 
reference and the segment is movable, the fifth byte specifies 
0FFh, the sixth byte is zero; and the seventh and eighth bytes 
specify an ordinal value found in the segment's entry table. 
