Format of Program Segment Prefix (PSP)

[ Back ] [ Next ]

Offset	Size	Description
00h	2 BYTEs	INT 20 instruction for CP/M CALL 0 program termination the CDh 20h here is often used as a signature for a valid PSP
02h	WORD	segment of first byte beyond memory allocated to program
04h	BYTE	(DOS) unused filler (OS/2) count of fake DOS version returns
05h	BYTE	CP/M CALL 5 service request (FAR CALL to absolute 000C0h) BUG: (DOS 2+ DEBUG) PSPs created by DEBUG point at 000BEh
06h	WORD	CP/M compatibility--size of first segment for .COM files
08h	2 BYTEs	remainder of FAR JMP at 05h
0Ah	DWORD	stored INT 22 termination address
0Eh	DWORD	stored INT 23 control-Break handler address
12h	DWORD	DOS 1.1+ stored INT 24 critical error handler address
16h	WORD	segment of parent PSP
18h	20 BYTEs	DOS 2+ Job File Table, one byte per file handle, FFh = closed
2Ch	WORD	DOS 2+ segment of environment for process (see #01379)
2Eh	DWORD	DOS 2+ process's SS:SP on entry to last INT 21 call
32h	WORD	DOS 3+ number of entries in JFT (default 20)
34h	DWORD	DOS 3+ pointer to JFT (default PSP:0018h)
38h	DWORD	DOS 3+ pointer to previous PSP (default FFFFFFFFh in 3.x) used by SHARE in DOS 3.3
3Ch	BYTE	DOS 4+ (DBCS) interim console flag (see AX=6301h) Novell DOS 7 DBCS interim flag as set with AX=6301h (possibly also used by Far East MS-DOS 3.2-3.3)
3Dh	BYTE	(APPEND) TrueName flag (see INT 2F/AX=B711h)
3Eh	BYTE	(Novell NetWare) flag: next byte initialized if CEh (OS/2) capabilities flag
3Fh	BYTE	(Novell NetWare) Novell task number if previous byte is CEh
40h	2 BYTEs	DOS 5+ version to return on INT 21/AH=30h
42h	WORD	(MSWindows3) selector of next PSP (PDB) in linked list Windows keeps a linked list of Windows programs only
44h	WORD	(MSWindows3) "PDB_Partition"
46h	WORD	(MSWindows3) "PDB_NextPDB"
48h	BYTE	(MSWindows3) bit 0 set if non-Windows application (WINOLDAP)
49h	BYTE	unused by DOS versions <= 6.00
4Ch	WORD	(MSWindows3) "PDB_EntryStack"
4Eh	2 BYTEs	unused by DOS versions <= 6.00
50h	3 BYTEs	DOS 2+ service request (INT 21/RETF instructions)
53h	2 BYTEs	unused in DOS versions <= 6.00
55h	7 BYTEs	unused in DOS versions <= 6.00; can be used to make first FCB into an extended FCB
5Ch	16 BYTEs	first default FCB, filled in from first command line argument overwrites second FCB if opened
6Ch	16 BYTEs	second default FCB, filled in from second command line argument overwrites beginning of command line if opened
7Ch	4 BYTEs	unused
80h	128 BYTEs	command line / default DTA command tail is BYTE for length of tail, N BYTEs for the tail, followed by a BYTE containing 0Dh

Note:

In DOS v3+, the limit on simultaneously open files may be increased by allocating memory for a new open file table, filling it with FFh, copying the first 20 bytes from the default table, and adjusting the pointer and count at 34h and 32h. However, DOS will only copy the first 20 file handles into a child PSP (including the one created on EXEC).
In an OS/2 DOS box, values of D0h-FEh in the open file table indicate device drivers.
Network redirectors based on the original MS-Net implementation use values of 80h-FEh in the open file table to indicate remote files; Novell NetWare also uses values from FEh down to 80h or one more than FILES= (whichever is greater) to indicate remote files (except on OS/2, where is uses CFh down to 80h).
MS-DOS 5.00 incorrectly fills the FCB fields when loading a program high; the first FCB is empty and the second contains the first parameter.
Some DOS extenders place protected-mode values in various PSP fields such as the "parent" field, which can confuse PSP walkers. Always check either for the CDh 20h signature or that the suspected PSP is at the beginning of a memory block which owns itself (the preceding paragraph should be a valid MCB with "owner" the same as the suspected PSP).
Novell NetWare updates the fields at offsets 3Eh and 3Fh without checking that a legal PSP segment is current; see AH=50h for further discussion.
For 4DOS and Windows95, the command tail may be more than 126 characters; in that case, the length byte will be set to 7Fh (with an 0Dh in the 127th position at offset FFh), and the first 126 characters will be stored in the PSP, with the entire command line in the environment variable CMDLINE; under at least some versions of 4DOS, the byte at offset FFh is *not* set to 0Dh, so there is no terminating carriage return in the PSP's command tail.

Bugs:

When shelling out from the Borland Pascal 7.00 IDE, overly-long command lines will not be delimited by a 0Dh character, and the length byte is set to 80h! A workaround is to always patch in a 0Dh at the last position of the command line buffer before scanning the command line.