MS-DOS EXE
MS-DOS EXE (or DOS EXE), also known as MZ format, is an executable file format used mainly by MS-DOS. It is the successor of COM. A number of other executable formats are extensions of it; see EXE for those formats.
Contents[hide] |
Format details
Header structure
DOS EXE files begin with a fixed 28-byte header.
The field names in this table are taken from the IMAGE_DOS_HEADER structure defined in modern Windows SDKs. Byte order is little-endian.
Offset | Type | Name | Description and remarks |
---|---|---|---|
0 | byte[2] | e_magic | Signature - ASCII "MZ " or "ZM "
|
2 | uint16 | e_cblp | If nonzero, the number of bytes in the last page |
4 | uint16 | e_cp | Number of 512-byte pages in the file, not counting the "overlay" segment |
6 | uint16 | e_crlc | Number of relocations |
8 | uint16 | e_cparhdr | Header size, in 16-byte paragraphs |
10 | uint16 | e_minalloc | Minimum allocation |
12 | uint16 | e_maxalloc | Maximum allocation |
14 | int16 | e_ss | Initial SS register |
16 | uint16 | e_sp | Initial SP register |
18 | uint16 | e_csum | Checksum - Usually unused and set to 0 |
20 | uint16 | e_ip | Initial IP register |
22 | int16 | e_cs | Initial CS register |
24 | uint16 | e_lfarlc | Relocation table offset, in bytes from the start of the file |
26 | uint16 | e_ovno | Overlay number (or other custom data) - Usually unused |
Identification
An MS-DOS EXE file begins with an ASCII signature of "MZ
" (or, rarely, "ZM
"), followed by a series of 16-bit fields. The field at offset 24 (the relocation table offset) is usually (but apparently not always) less than 64, and at least 28. A value of 64 or more, or 0, suggests the format may not be MS-DOS EXE.
It's not clear whether there is any completely reliable way to identify an MS-DOS EXE, except in the negative (i.e. it begins with "MZ", and is not a valid NE, PE, etc., file).
Sample files
Links
- Wikipedia article
- MZ, from the OSDev Wiki
- http://www.delorie.com/djgpp/doc/exe/
- DOS EXE format
- EXE Explorer utility
- Ralf Brown's Interrupt Reference has an extensive list of (mostly older) MZ-based executable formats