Make your own free website on Tripod.com
Up ] Docs Home ]

(.vxd) LINEAR-EXECUTABLE File Header Layout

Back ] Next ]

LINEAR-EXECUTABLE (LE) File Header Layout

An virtual device drivers or some other applications for Microsoft Windows or IBM OS/2 operating system which uses 32-bits segments for 80386+ contains a combination of code and data or combination of code, data, and resources. The `LINEAR-EXECUTABLE` file such as a NE Header {NEW-STYLE} EXE file also contains two headers: an MS-DOS header and a `LINEAR` EXE header. The ^Tp236 {MS-DOS (old-style) executable-file header} contains four distinct parts: a collection of header information, a reserved section, a pointer to a `LINEAR` exe header, and a stub program. The following illustrations shows the MS-DOS executable-file header:

Beginning of file 00h MS-DOS Header Info
20h Reserved
3Ch LE header offset
40h MS-DOS stub program
Beginning of `LE` header ...
...
...

If word value at offset 18h is 40h or greater, the dword value at 3Ch is an offset to a `LE` header

MS-DOS uses stub program to display a message if Windows or OS/2 has not been loaded when the user attempts to run a program.

The `LINEAR` executable-file header contains information that the loader requires for segmented executable files. This information includes the linker version number, data specified by linker, data specified by resource compiler, tables of segment data, tables of resource data, and so on. The following illustrations shows the LE file header:

Begin of file
...
...
End of MS-DOS header MS-DOS Stub Program
Beginning of `LE` header Information block
Object table
Object page map table
Object iterate data map table
Resource table
Resident-names table
Entry table
Module directives table
Fix-up page table
Fix-up record table
Imported modules name table
Imported procedures name table
Per-page checksum table
Code and data segments Code or Data Segment 1
Code or Data Segment 2
...
...
...
Code or Data Segment n
Non-resident table
End of file

Header Information Block Layout

The `information block` in the LE header contains the linker version number, length of various tables that further describe the executable file, the offsets from the beginning of the header to the beginning of these tables, the heap and stack sizes, and so on. The following list summarizes the contents of the header `information block` ( the locations are relative to the beginning of the block):

Offset Size Contents
+0h 2 Specifies the signature word 'LE' (4Ch 45H)
+2h 1 Byte order:
00h little-endian
non-zero big-endian
+3h 1 Word order:
00h little-endian
non-zero big-endian
+4h 4 Executable format level
+8h 2 CPU type:
01h Intel 80286 or upwardly compatible
02h Intel 80386 or upwardly compatible
03h Intel 80486 or upwardly compatible
04h Intel 80586 or upwardly compatible
20h Intel i860 (N10) or compatible
21h Intel "N11" or compatible
40h MIPS Mark I ( R2000, R3000) or compatible
41h MIPS Mark II ( R6000 ) or compatible
42h MIPS Mark III ( R4000 ) or compatible
+0Ah 2 Target operating system:
01h OS/2
02h Windows
03h DOS 4.x
04h Windows 386
+0Ch 4 Module version
+10h 4 Module type flags
+14h 4 Number of memory pages
+18h 4 Initial object CS number
+1Ch 4 Initial EIP
+20h 4 Initial object SS number
+24h 4 Initial ESP
+28h 4 Memory page size
+2Ch 4 Bytes on last page
+30h 4 Fix-up section size
+34h 4 Fix-up section checksum
+38h 4 Loader section size
+3Ch 4 Loader section checksum
+40h 4 Offset of object table
+44h 4 Object table entries
+48h 4 Object page map offset
+4Ch 4 Object iterate data map offset
+50h 4 Resource table offset
+54h 4 Resource table entries
+58h 4 Resident names table offset
+5Ch 4 Entry table offset
+60h 4 Module directives table offset
+64h 4 Module directives entries
+68h 4 Fix-up page table offset
+6Ch 4 Fix-up record table offset
+70h 4 Imported modules name table offset
+74h 4 Imported modules count
+78h 4 Imported procedure name table offset
+7Ch 4 Per-page checksum table offset
+80h 4 Data pages offset from top of file
+84h 4 Preload page count
+88h 4 Non-resident names table offset from top of file
+8Ch 4 Non-resident names table length
+90h 4 Non-resident names table checksum
+94h 4 Automatic data object
+98h 4 Debug information offset
+9C 4 Debug information length
+A0h 4 Preload instance pages number
+A4h 4 Demand instance pages number
+A8h 4 Extra heap allocation
+ACh 4 ???


Header Information Block Flags Layout

Bits Contents Bits Contents
0 16 Reserved
1 17 Reserved
2 Initialization ( Only for DLL ):
0 Global
1 Per-Process
18 Reserved
3 19 Reserved
4 No internal fixup in exe image 20 Reserved
5 No external fixup in exe image 21 Reserved
6 22 Reserved
7 23 Reserved
8
0 Unknown
1 Incompatible with PM windowing
2 Compatible with PM windowing
3 Uses PM windowing API
24 Reserved
9 25 Reserved
10 26 Reserved
11 27 Reserved
12 28 Reserved
13 Module not loadable 29 Reserved
14 30 Reserved
15 Module is DLL rather then program 31 Reserved

Header Object Table Layout

The object table contains information that describes each segment in an executable file. This information includes segment length, segment type, and segment-relocation data. The following list summarizes the values found in in the segment table ( the locations are relative to the beginning of each entry):

Offset Size Contents
+0h 4 Virtual segment size in bytes
+4h 4 Relocation base address
+8h 4 Object flags
+0Ch 4 Page map index
+10h 4 Page map entries
+14h 4 ???

Header Object Flags Layout

Bits Contents Bits Contents
0 16 Reserved
1 17 Reserved
2 18 Reserved
3 19 Reserved
4 20 Reserved
5 21 Reserved
6 22 Reserved
7 23 Reserved
8 24 Reserved
9 25 Reserved
10 26 Reserved
11 27 Reserved
12 28 Reserved
13 29 Reserved
14 30 Reserved
15 31 Reserved