EXE

File Format
Name	EXE
Ontology	Electronic File Formats Executables EXE
Extension(s)	.exe

EXE most commonly refers to a family of executable file formats. It includes the original MS-DOS EXE format, and a number of newer formats built on top of that format. Most of them use the same .exe file extension.

Although all members of the EXE family have a file signature of "MZ", it seems that the term "MZ format" is generally used to mean only MS-DOS EXE (i.e. files designed for MS-DOS).

EXE files designed for operating systems other than MS-DOS usually contain a short program (called a DOS stub) which, when executed by DOS, prints a message like "This program cannot be run in DOS mode" or "This program requires Microsoft Windows", and immediately exits. Some programs contain a more functional DOS stub, e.g. the Windows 9x registry editor.

Unrelated usage

Note .EXE is also used as an executable extension on some other operating systems, such as OpenVMS, TOPS-10, TOPS-20, RSX-11, etc. The file formats used by those operating systems are completely unrelated to those used by MS-DOS/PC-DOS and its descendants (OS/2, Windows, EFI, etc.) However, historically speaking, that's likely where Microsoft got the .EXE file extension from (early in Microsoft's history, they used TOPS-10 as a hosted cross-development environment for their microcomputer products, before switching to their own Unix distribution, Xenix, on PDP-11s.)

OpenVMS VAX and Alpha used their own proprietary executable format; GNU binutils has some knowledge of it (at least the Alpha version, which was based on the VAX version but with some incompatible changes). .EXE files on OpenVMS Itanium and x86-64 are in ELF format.

Formats

This is an incomplete outline of the EXE family of formats.

• EXE
  • MS-DOS EXE
  • NE (New Executable, 16-bit)
  • Linear Executable
    • LE (mixed 16/32-bit)
    • LX (32-bit)
  • PE (Portable Executable)
    • PE32 (32-bit Windows)
    • PE32+ (64-bit Windows)

Identification

All EXE formats start with ASCII signature "MZ" or, rarely, "ZM".

The byte at offset 3 should be 0x00 or 0x01, as it is the high byte of a field whose valid values are 0 through 511. However, EXE files for which this is not the case do exist, and may be tolerated by the OS.

The starting point for identifying extended formats is the field at offset 60, which if present, points to an extended header.

Sample files

• dexvert samples — executable/exe

Links

• Ralf Brown's Interrupt List, INT 21h, Function 4Bh, describes lots of the "older" style EXE formats
• EXE Explorer utility

See also the articles for the specific EXE formats.