The NE EXE File Format

The NE EXE File Format

Original Documentation

The NE EXE files are the new exe files used by windows and OS/2 executables.
They contain a small MZ EXE which prints "This program requires Microsoft
Windows" or something similar but Some files contain both DOS and Windows
versions of the executable. The position of the new EXE header can be found
in the old exe header - see the MZ EXE topic for further information. All
offsets within this header are from the start of the header if not noted

OFFSET              Count TYPE   Description
0000h                   2 char   ID='NE'
0002h                   1 byte   Linker major version
0003h                   1 byte   Linker minor version
0004h                   1 word   Offset of entry table (see below)
0006h                   1 word   Length of entry table in bytes
0008h                   1 dword  File load CRC (0 in Borland's TPW)
000Ch                   1 byte   Program flags, bitmapped :
								 0-1 - DGroup type :
									   0 - none
									   1 - single shared
									   2 - multiple
									   3 - (null)
								   2 - Global initialization
								   3 - Protected mode only
								   4 - 8086 instructions
								   5 - 80286 instructions
								   6 - 80386 instructions
								   7 - 80x87 instructions
000Dh                   1 byte   Application flags, bitmapped
								 0-2 - Application type
									   1 - Full screen (not aware of
										   Windows/P.M. API)
									   2 - Compatible with Windows/P.M. API
									   3 - Uses Windows/P.M. API
								   3 - OS/2 family application
								   4 - reserved?
								   5 - Errors in image/executable
								   6 - "non-conforming program" whatever
								   7 - DLL or driver (SS:SP info invalid, CS:IP
									   points at FAR init routine called with
									   AX=module handle which returns AX=0000h
									   on failure, AX nonzero on successful
000Eh                   1 byte   Auto data segment index
0010h                   1 word   Initial local heap size
0012h                   1 word   Initial stack size
0014h                   1 dword  Entry point (CS:IP),
								 CS is index into segment table
0018h                   1 dword  Initial stack pointer (SS:SP)
								 SS is index into segment table
001Ch                   1 word   Segment count
001Eh                   1 word   Module reference count
0020h                   1 word   Size of nonresident names table in bytes
0022h                   1 word   Offset of segment table (see below)
0024h                   1 word   Offset of resource table
0026h                   1 word   Offset of resident names table
0028h                   1 word   Offset of module reference table
002Ah                   1 word   Offset of imported names table
								 (array of counted strings, terminated with a
								  string of length 00h)
002Ch                   1 dword  Offset from start of file to nonresident
								 names table
0030h                   1 word   Count of moveable entry point listed in
								 entry table
0032h                   1 word   File alignment size shift count
								  0 is equivalent to 9 (default 512-byte pages)
0034h                   1 word   Number of resource table entries
0036h                   1 byte   Target operating system
								  0 - unknown
								  1 - OS/2
								  2 - Windows
								  3 - European MS-DOS 4.x
								  4 - Windows 386
								  5 - BOSS (Borland Operating System Services)
0037h                   1 byte   Other OS/2 EXE flags, bitmapped
								 0 - Long filename support
								 1 - 2.x protected mode
								 2 - 2.x proportional fonts
								 3 - Executable has gangload area
0038h                   1 word   Offset to return thunks or start of gangload
								 area - whatever that means.
003Ah                   1 word   offset to segment reference thunks or length
								 of gangload area.
003Ch                   1 word   Minimum code swap area size
003Eh                   2 byte   Expected Windows version (minor version first)

REFERENCE:Windows 3.1 SDK Programmer's Reference, Vol 4.

This information is from and is used with permission.

More Resources