winexe.txt

windows exe文件的结构、初始化

Executable-File Header Format (3.1)

An executable (.EXE) file for the Windows operating system 
contains a combination of code and data or a combination of 
code, data, and resources. The executable file also contains 
two headers: an MS-DOS header and a Windows header. The next 
two sections describe these headers; the third section 
describes the code and data contained in a Windows executable 
file. 

MS-DOS Header

The MS-DOS (old-style) executable-file header contains four 
distinct parts: a collection of header information (such as 
the signature word, the file size, and so on), a reserved 
section, a pointer to a Windows header (if one exists), and a 
stub program. The following illustration shows the MS-DOS 
executable-file header: 
If the word value at offset 18h is 40h or greater, the word 
value at 3Ch is typically an offset to a Windows header. 
Applications must verify this for each executable-file header 
being tested, because a few applications have a different 
header style. 
MS-DOS uses the stub program to display a message if Windows 
has not been loaded when the user attempts to run a program. 

Windows Header

The Windows (new-style) executable-file header contains 
information that the loader requires for segmented executable 
files. This information includes the linker version number, 
data specified by the linker, data specified by the resource 
compiler, tables of segment data, tables of resource data, 
and so on. The following illustration shows the Windows 
executable-file header: 
The following sections describe the entries in the Windows 
executable-file header. 

Information Block

The information block in the Windows header contains the 
linker version number, the lengths of various tables that 
further describe the executable file, the offsets from the 
beginning of the header to the beginning of these tables, the 
heap and stack sizes, and so on. The following list 
summarizes the contents of the header information block (the 
locations are relative to the beginning of the block): 

Location Description
00h      Specifies the signature word. The low byte contains 
         "N" (4Eh) and the high byte contains "E" (45h). 
02h      Specifies the linker version number. 
03h      Specifies the linker revision number. 
04h      Specifies the offset to the entry table (relative to 
         the beginning of the header). 
06h      Specifies the length of the entry table, in bytes. 
08h      Reserved. 
0Ch      Specifies flags that describe the contents of the 
         executable file. This value can be one or more of the 
         following bits: 

         Bit Meaning
         0   The linker sets this bit if the executable-file 
             format is SINGLEDATA. An executable file with 
             this format contains one data segment. This bit 
             is set if the file is a dynamic-link library 
             (DLL). 
         1   The linker sets this bit if the executable-file 
             format is MULTIPLEDATA. An executable file with 
             this format contains multiple data segments. This 
             bit is set if the file is a Windows application. 
             If neither bit 0 nor bit 1 is set, the 
             executable-file format is NOAUTODATA. An 
             executable file with this format does not contain 
             an automatic data segment. 
         2   Reserved. 
         3   Reserved. 
         8   Reserved. 
         9   Reserved. 
         11  If this bit is set, the first segment in the 
             executable file contains code that loads the 
             application. 
         13  If this bit is set, the linker detects errors at 
             link time but still creates an executable file. 
         14  Reserved. 
         15  If this bit is set, the executable file is a 
             library module. 
             If bit 15 is set, the CS:IP registers point to an 
             initialization procedure called with the value in 
             the AX register equal to the module handle. The 
             initialization procedure must execute a far 
             return to the caller. If the procedure is 
             successful, the value in AX is nonzero. 
             Otherwise, the value in AX is zero. 
             The value in the DS register is set to the 
             library's data segment if SINGLEDATA is set. 
             Otherwise, DS is set to the data segment of the 
             application that loads the library. 
0Eh      Specifies the automatic data segment number. (0Eh is 
         zero if the SINGLEDATA and MULTIPLEDATA bits are 
         cleared.) 
10h      Specifies the initial size, in bytes, of the local 
         heap. This value is zero if there is no local 
         allocation. 
12h      Specifies the initial size, in bytes, of the stack. 
         This value is zero if the SS register value does not 
         equal the DS register value. 
14h      Specifies the segment:offset value of CS:IP. 
18h      Specifies the segment:offset value of SS:SP. 
         The value specified in SS is an index to the module's 
         segment table. The first entry in the segment table 
         corresponds to segment number 1. 
         If SS addresses the automatic data segment and SP is 
         zero, SP is set to the address obtained by adding the 
         size of the automatic data segment to the size of the 
         stack. 
1Ch      Specifies the number of entries in the segment table. 
1Eh      Specifies the number of entries in the 
         module-reference table. 
20h      Specifies the number of bytes in the nonresident-name 
         table. 
22h      Specifies a relative offset from the beginning of the 
         Windows header to the beginning of the segment table. 
24h      Specifies a relative offset from the beginning of the 
         Windows header to the beginning of the resource 
         table. 
26h      Specifies a relative offset from the beginning of the 
         Windows header to the beginning of the resident-name 
         table. 
28h      Specifies a relative offset from the beginning of the 
         Windows header to the beginning of the 
         module-reference table. 
2Ah      Specifies a relative offset from the beginning of the 
         Windows header to the beginning of the imported-name 
         table. 
2Ch      Specifies a relative offset from the beginning of the 
         file to the beginning of the nonresident-name table. 
30h      Specifies the number of movable entry points. 
32h      Specifies a shift count that is used to align the 
         logical sector. This count is log2 of the segment 
         sector size. It is typically 4, although the default 
         count is 9. (This value corresponds to the /alignment
         [/a] linker switch. When the linker command line 
         contains /a:16, the shift count is 4. When the linker 
         command line contains /a:512, the shift count is 9.) 
34h      Specifies the number of resource segments. 
36h      Specifies the target operating system, depending on 
         which bits are set: 

         Bit Meaning

         0   Operating system format is unknown. 
         1   Reserved. 
         2   Operating system is Microsoft Windows. 
         3   Reserved. 
         4   Reserved. 
37h      Specifies additional information about the executable 
         file. It can be one or more of the following values: 

         Bit Meaning

         1   If this bit is set, the executable file contains 
             a Windows 2.x application that runs in version 3.x
              protected mode. 
         2   If this bit is set, the executable file contains 
             a Windows 2.x application that supports 
             proportional fonts. 
         3   If this bit is set, the executable file contains 
             a fast-load area. 
38h      Specifies the offset, in sectors, to the beginning of 
         the fast-load area. (Only Windows uses this value.) 
3Ah      Specifies the length, in sectors, of the fast-load 
         area. (Only Windows uses this value.) 
3Ch      Reserved. 
3Eh      Specifies the expected version number for Windows. 
         (Only Windows uses this value.) 

Segment Table

The segment table contains information that describes each 
segment in an executable file. This information includes the 
segment length, segment type, and segment-relocation data. 
The following list summarizes the values found in the segment 
table (the locations are relative to the beginning of each 
entry): 

Location Description

00h      Specifies the offset, in sectors, to the segment data 
         (relative to the beginning of the file). A value of 
         zero means no data exists. 
02h      Specifies the length, in bytes, of the segment, in 
         the file. A value of zero indicates that the segment 
         length is 64K, unless the selector offset is also 
         zero. 
04h      Specifies flags that describe the contents of the 
         executable file. This value can be one or more of the 
         following: 

         Bit Meaning

         0   If this bit is set, the segment is a data 
             segment. Otherwise, the segment is a code 
             segment. 
         1   If this bit is set, the loader has allocated 
             memory for the segment. 
         2   If this bit is set, the segment is loaded. 
         3   Reserved. 
         4   If this bit is set, the segment type is MOVABLE.
             Otherwise, the segment type is FIXED. 
         5   If this bit is set, the segment type is PURE or 
             SHAREABLE. Otherwise, the segment type is IMPURE
             or NONSHAREABLE.
         6   If this bit is set, the segment type is PRELOAD.
             Otherwise, the segment type is LOADONCALL.
         7   If this bit is set and the segment is a code 
             segment, the segment type is EXECUTEONLY. If this 
             bit is set and the segment is a data segment, the 
             segment type is READONLY. 
         8   If this bit is set, the segment contains 
             relocation data. 
         9   Reserved. 
         10  Reserved. 
         11  Reserved. 
         12  If this bit is set, the segment is discardable. 
         13  Reserved. 
         14  Reserved. 
         15  Reserved. 
06h      Specifies the minimum allocation size of the segment, 
         in bytes. A value of zero indicates that the minimum 
         allocation size is 64K. 

Resource Table

The resource table describes and identifies the location of 
each resource in the executable file. The table has the 
following form: 
WORD     rscAlignShift;
TYPEINFO rscTypes[];
WORD     rscEndTypes;
BYTE     rscResourceNames[];
BYTE     rscEndNames;
Following are the members in the resource table: 
rscAlignShift    Specifies the alignment shift count for 
                 resource data. When the shift count is used 
                 as an exponent of 2, the resulting value 
                 specifies the factor, in bytes, for computing 
                 the location of a resource in the executable 
                 file. 
rscTypes         Specifies an array of TYPEINFO structures 
                 containing information about resource types. 
                 There must be one TYPEINFO structure for each 
                 type of resource in the executable file. 
rscEndTypes      Specifies the end of the resource type 
                 definitions. This member must be zero. 
rscResourceNames Specifies the names (if any) associated with 
                 the resources in this table. Each name is 
                 stored as consecutive bytes; the first byte 
                 specifies the number of characters in the 
                 name. 
rscEndNames      Specifies the end of the resource names and 
                 the end of the resource table. This member 
                 must be zero.