NE
跳到导航
跳到搜索
| 可执行文件格式 |
|---|
| Microsoft |
| *nix |
NE
导言
WIN-NE可执行格式，专为Windows 3.x设计、 称为“NE”或“New Executable”格式。同样是16位格式，它去除了MZ格式的最大大小限制。
Support
使用它的操作系统：Windows 1.01到3.xx。
该格式can在以后的32位windows系统（在VDM中）上运行，但不是本机格式
由于v8086缺少64位，因此放弃了对64位windows的支持。
深入NE文件
概述
DOS存根
DOS存根是有效的MZexe。 这使开发者能够打包MS-DOS和Win16版本的程序，但只打印“此程序需要Microsoft Windows”。 e_lfanew字段（偏移量0x3C）指向NE报头。
NE文件头
NE报头是一个具有多个特征的相对较大的结构。 由于格式年代久远，有些项目的含义不清楚。 结构如下（有些注释可能是错误的）。 If so please change):
struct NE_header {
char sig[2]; //"NE"
uint8_t MajLinkerVersion; //The major linker version
uint8_t MinLinkerVersion; //The minor linker version
uint16_t EntryTableOffset; //Offset of entry table, see below
uint16_t EntryTableLength; //Length of entry table in bytes
uint32_t FileLoadCRC; //32-bit CRC of entire contents of file
uint8_t ProgFlags; //Program flags, bitmapped
uint8_t ApplFlags; //Application flags, bitmapped
uint16_t AutoDataSegIndex; //The automatic data segment index
uint16_t InitHeapSize; //The intial local heap size
uint16_t InitStackSize; //The inital stack size
uint32_t EntryPoint; //CS:IP entry point, CS is index into segment table
uint32_t InitStack; //SS:SP inital stack pointer, SS is index into segment table
uint16_t SegCount; //Number of segments in segment table
uint16_t ModRefs; //Number of module references (DLLs)
uint16_t NoResNamesTabSiz; //Size of non-resident names table, in bytes (Please clarify non-resident names table)
uint16_t SegTableOffset; //Offset of Segment table
uint16_t ResTableOffset; //Offset of resources table
uint16_t ResidNamTable; //Offset of resident names table
uint16_t ModRefTable; //Offset of module reference table
uint16_t ImportNameTable; //Offset of imported names table (array of counted strings, terminated with string of length 00h)
uint32_t OffStartNonResTab; //Offset from start of file to non-resident names table
uint16_t MovEntryCount; //Count of moveable entry point listed in entry table
uint16_t FileAlnSzShftCnt; //File alligbment size shift count (0=9(default 512 byte pages))
uint16_t nResTabEntries; //Number of resource table entries
uint8_t targOS; //Target OS
uint8_t OS2EXEFlags; //Other OS/2 flags
uint16_t retThunkOffset; //Offset to return thunks or start of gangload area - what is gangload?
uint16_t segrefthunksoff; //Offset to segment reference thunks or size of gangload area
uint16_t mincodeswap; //Minimum code swap area size
uint8_t expctwinver[2]; //Expected windows version (minor first)
};
//Program flags
//DGroup type (what is this?)
enum dgrouptype {
none, //None
sinshared, //single shared
multiple, //Multiple
null //(null)
};
#define GLOBINIT 1<<2 //global initialization
#define PMODEONLY 1<<3 //Protetced mode only
#define INSTRUC86 1<<4 //8086 instructions
#define INSTRU286 1<<5 //80286 instructions
#define INSTRU386 1<<6 //80386 instructions
#define INSTRUx87 1<<7 //80x87 (FPU) instructions
//Application flags
//Application type
enum apptype {
none,
fullscreeen, //fullscreen (not aware of Windows/P.M. API)
winpmcompat, //compatible with Windows/P.M. API
winpmuses //uses Windows/P.M. API
};
#define OS2APP 1<<3 //OS/2 family application
//bit 4 reserved?
#define IMAGEERROR 1<<5 //errors in image/executable
#define NONCONFORM 1<<6 //non-conforming program?
#define DLL 1<<7 //DLL or driver (SS:SP invalid, CS:IP->Far INIT routine AX=HMODULE,returns AX==0 success, AX!=0 fail)
//Target Operating System
enum targetos {
unknown, //Obvious ;)
os2, //OS/2 (as if you hadn't worked that out!)
win, //Windows (Win16)
dos4, //European DOS 4.x
win386, //Windows for the 80386 (Win32s). 32 bit code.
BOSS //The boss, a.k.a Borland Operating System Services
};
//Other OS/2 flags
#define LFN 1 //OS/2 Long File Names (finally, no more 8.3 conversion :) )
#define PMODE 1<<1 //OS/2 2.x Protected Mode executable
#define PFONT 1<<2 //OS/2 2.x Proportional Fonts
#define GANGL 1<<3 //OS/2 Gangload area