LINEAR-EXECUTABLE (LE) File Header Layout
An virtual device drivers or some other applications for Microsoft Windows or
IBM OS/2 operating system which uses 32-bits segments for 80386+ contains a combination of code and data or combination of
code, data, and resources. The `LINEAR-EXECUTABLE` file such as a NE Header {NEW-STYLE} EXE file also contains two headers: an
MS-DOS header and a `LINEAR` EXE header. The ^Tp236 {MS-DOS (old-style) executable-file header} contains four distinct parts: a collection of header
information, a reserved section, a pointer to a `LINEAR` exe header, and a stub program. The following illustrations shows the MS-DOS executable-file header:
| Beginning of file |
00h |
MS-DOS Header Info |
| 20h |
Reserved |
| 3Ch |
LE header offset |
| 40h |
MS-DOS stub program |
| Beginning of `LE` header |
|
... |
| |
... |
| |
... |
If word value at offset 18h is 40h or greater, the dword value at 3Ch is an offset to a `LE` header
MS-DOS uses stub program to display a message if Windows or OS/2 has not been loaded when the user attempts to run a program.
The `LINEAR` executable-file header contains information that the loader requires for segmented executable files. This information includes the linker version number, data specified by linker, data specified by resource compiler, tables of segment data, tables of resource data, and so on. The following illustrations shows the LE file header:
Header Information Block Layout
The `information block` in the LE header contains the linker version number, length of various tables that further describe the executable file, the offsets from the beginning of the header to the
beginning of these tables, the heap and stack sizes, and so on. The following list summarizes the contents of the header `information block` ( the locations are relative to the beginning of the block):
| Offset |
Size |
Contents |
| +0h |
2 |
Specifies the signature word 'LE' (4Ch 45H) |
| +2h |
1 |
Byte order:
| 00h |
little-endian |
| non-zero |
big-endian |
|
| +3h |
1 |
Word order:
| 00h |
little-endian |
| non-zero |
big-endian |
|
| +4h |
4 |
Executable format level |
| +8h |
2 |
CPU type:
| 01h |
Intel 80286 or upwardly compatible |
| 02h |
Intel 80386 or upwardly compatible |
| 03h |
Intel 80486 or upwardly compatible |
| 04h |
Intel 80586 or upwardly compatible |
| 20h |
Intel i860 (N10) or compatible |
| 21h |
Intel "N11" or compatible |
| 40h |
MIPS Mark I ( R2000, R3000) or compatible |
| 41h |
MIPS Mark II ( R6000 ) or compatible |
| 42h |
MIPS Mark III ( R4000 ) or compatible |
|
| +0Ah |
2 |
Target operating system:
| 01h |
OS/2 |
| 02h |
Windows |
| 03h |
DOS 4.x |
| 04h |
Windows 386 |
|
| +0Ch |
4 |
Module version |
| +10h |
4 |
Module type flags |
| +14h |
4 |
Number of memory pages |
| +18h |
4 |
Initial object CS number |
| +1Ch |
4 |
Initial EIP |
| +20h |
4 |
Initial object SS number |
| +24h |
4 |
Initial ESP |
| +28h |
4 |
Memory page size |
| +2Ch |
4 |
Bytes on last page |
| +30h |
4 |
Fix-up section size |
| +34h |
4 |
Fix-up section checksum |
| +38h |
4 |
Loader section size |
| +3Ch |
4 |
Loader section checksum |
| +40h |
4 |
Offset of object table |
| +44h |
4 |
Object table entries |
| +48h |
4 |
Object page map offset |
| +4Ch |
4 |
Object iterate data map offset |
| +50h |
4 |
Resource table offset |
| +54h |
4 |
Resource table entries |
| +58h |
4 |
Resident names table offset |
| +5Ch |
4 |
Entry table offset |
| +60h |
4 |
Module directives table offset |
| +64h |
4 |
Module directives entries |
| +68h |
4 |
Fix-up page table offset |
| +6Ch |
4 |
Fix-up record table offset |
| +70h |
4 |
Imported modules name
table offset |
| +74h |
4 |
Imported modules count |
| +78h |
4 |
Imported procedure name
table offset |
| +7Ch |
4 |
Per-page checksum table offset |
| +80h |
4 |
Data pages offset from top of file |
| +84h |
4 |
Preload page count |
| +88h |
4 |
Non-resident names table offset from top of file |
| +8Ch |
4 |
Non-resident names table length |
| +90h |
4 |
Non-resident names table checksum |
| +94h |
4 |
Automatic data object |
| +98h |
4 |
Debug information offset |
| +9C |
4 |
Debug information length |
| +A0h |
4 |
Preload instance pages number |
| +A4h |
4 |
Demand instance pages number |
| +A8h |
4 |
Extra heap allocation |
| +ACh |
4 |
??? |
Header Information Block Flags Layout
| Bits |
Contents |
Bits |
Contents |
| 0 |
|
16 |
Reserved |
| 1 |
|
17 |
Reserved |
| 2 |
Initialization ( Only for DLL ):
|
18 |
Reserved |
| 3 |
|
19 |
Reserved |
| 4 |
No internal fixup in exe image |
20 |
Reserved |
| 5 |
No external fixup in exe image |
21 |
Reserved |
| 6 |
|
22 |
Reserved |
| 7 |
|
23 |
Reserved |
| 8 |
| 0 |
Unknown |
| 1 |
Incompatible with PM windowing |
| 2 |
Compatible with PM windowing |
| 3 |
Uses PM windowing API |
|
24 |
Reserved |
| 9 |
25 |
Reserved |
| 10 |
26 |
Reserved |
| 11 |
|
27 |
Reserved |
| 12 |
|
28 |
Reserved |
| 13 |
Module not loadable |
29 |
Reserved |
| 14 |
|
30 |
Reserved |
| 15 |
Module is DLL rather then program |
31 |
Reserved |
Header Object Table Layout
The object table contains information that describes each segment in an executable file. This information includes segment length, segment type,
and segment-relocation data. The following list summarizes the values found in in the segment table ( the locations are relative to the beginning of each entry):
| Offset |
Size |
Contents |
| +0h |
4 |
Virtual segment size in bytes |
| +4h |
4 |
Relocation base address |
| +8h |
4 |
Object flags |
| +0Ch |
4 |
Page map index |
| +10h |
4 |
Page map entries |
| +14h |
4 |
??? |
Header Object Flags Layout
| Bits |
Contents |
Bits |
Contents |
| 0 |
|
16 |
Reserved |
| 1 |
|
17 |
Reserved |
| 2 |
|
18 |
Reserved |
| 3 |
|
19 |
Reserved |
| 4 |
|
20 |
Reserved |
| 5 |
|
21 |
Reserved |
| 6 |
|
22 |
Reserved |
| 7 |
|
23 |
Reserved |
| 8 |
|
24 |
Reserved |
| 9 |
25 |
Reserved |
| 10 |
26 |
Reserved |
| 11 |
|
27 |
Reserved |
| 12 |
|
28 |
Reserved |
| 13 |
|
29 |
Reserved |
| 14 |
|
30 |
Reserved |
| 15 |
|
31 |
Reserved |