📄 exewin.htm
字号:
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=gb2312">
<title>executable</title>
<meta name="generator" content="microsoft frontpage 3.0">
</head>
<body background="../jpg/di1.JPG">
<p align="center"><font size="6" color="#0000ff">executable-file format</font></p>
<div align="center"><center>
<table border="0" width="88%">
<tr>
<td width="100%">.exe executable-file header format (3.1)<br>
<br>
an executable (.exe) file for the microsoft windows operating system contains a
combination of code and data or a combination <br>
of code, data, and resources. the executable file also contains two headers: an ms-dos
header and a windows header. the <br>
next two sections describe these headers; the third section describes the code and data
contained in a windows executable file. <br>
<br>
ms-dos header<br>
<br>
the ms-dos (old-style) executable-file header contains four distinct parts: a collection
of header information (such as the <br>
signature word, the file size, and so on), a reserved section, a pointer to a windows
header (if one exists), and a stub program. <br>
the following illustration shows the ms-dos executable-file header: <br>
if the word value at offset 18h is 40h or greater, the word value at 3ch is typically an
offset to a windows header. applications <br>
must verify this for each executable-file header being tested, because a few applications
have a different header style. <br>
ms-dos uses the stub program to display a message if windows has not been loaded when the
user attempts to run a <br>
program. <br>
for more information about the ms-dos executable-file header, see the microsoft ms-dos
programmer's reference <br>
(redmond, washington: microsoft press, 1991). <br>
<br>
windows header<br>
<br>
the windows (new-style) executable-file header contains information that the loader
requires for segmented executable files. <br>
this information includes the linker version number, data specified by the linker, data
specified by the resource compiler, tables <br>
of segment data, tables of resource data, and so on. the following illustration shows the
windows executable-file header: <br>
the following sections describe the entries in the windows executable-file header. <br>
<br>
information block<br>
<br>
the information block in the windows header contains the linker version number, the
lengths of various tables that further <br>
describe the executable file, the offsets from the beginning of the header to the
beginning of these tables, the heap and stack <br>
sizes, and so on. the following list summarizes the contents of the header information
block (the locations are relative to the <br>
beginning of the block): <br>
<br>
location description<br>
<br>
00h specifies the signature word. the low byte contains "n"
(4eh) and the high byte contains "e" (45h). <br>
02h specifies the linker version number. <br>
03h specifies the linker revision number. <br>
04h specifies the offset to the entry table (relative to the beginning
of the header). <br>
06h specifies the length of the entry table, in bytes. <br>
08h reserved. <br>
0ch specifies flags that describe the contents of the executable file.
this value can be one or more of the following bits: <br>
<br>
bit meaning<br>
<br>
0 the linker sets this bit if the executable-file format is singledata.
an executable file with this format <br>
contains one data segment. this bit is set if the file is a dynamic-link library (dll). <br>
1 the linker sets this bit if the executable-file format is
multipledata. an executable file with this format <br>
contains multiple data segments. this bit is set if the file is a windows application. <br>
<br>
if neither bit 0 nor bit 1 is set, the executable-file format is noautodata. an executable
file with this format <br>
does not contain an automatic data segment. <br>
<br>
2 reserved. <br>
3 reserved. <br>
8 reserved. <br>
9 reserved. <br>
11 if this bit is set, the first segment in the executable file contains
code that loads the application. <br>
13 if this bit is set, the linker detects errors at link time but still
creates an executable file. <br>
14 reserved. <br>
15 if this bit is set, the executable file is a library module. <br>
<br>
if bit 15 is set, the cs:ip registers point to an initialization procedure called with the
value in the ax register <br>
equal to the module handle. the initialization procedure must execute a far return to the
caller. if the <br>
procedure is successful, the value in ax is nonzero. otherwise, the value in ax is zero. <br>
the value in the ds register is set to the library's data segment if singledata is set.
otherwise, ds is set <br>
to the data segment of the application that loads the library. <br>
<br>
0eh specifies the automatic data segment number. (0eh is zero if the
singledata and multipledata bits are <br>
cleared.) <br>
10h specifies the initial size, in bytes, of the local heap. this value
is zero if there is no local allocation. <br>
12h specifies the initial size, in bytes, of the stack. this value is
zero if the ss register value does not equal the ds <br>
register value. <br>
14h specifies the segment:offset value of cs:ip. <br>
18h specifies the segment:offset value of ss:sp. <br>
<br>
the value specified in ss is an index to the module's segment table. the first entry in
the segment table <br>
corresponds to segment number 1. <br>
if ss addresses the automatic data segment and sp is zero, sp is set to the address
obtained by adding the size of <br>
the automatic data segment to the size of the stack. <br>
<br>
1ch specifies the number of entries in the segment table. <br>
1eh specifies the number of entries in the module-reference table. <br>
20h specifies the number of bytes in the nonresident-name table. <br>
22h specifies a relative offset from the beginning of the windows header
to the beginning of the segment table. <br>
24h specifies a relative offset from the beginning of the windows header
to the beginning of the resource table. <br>
26h specifies a relative offset from the beginning of the windows header
to the beginning of the resident-name table. <br>
28h specifies a relative offset from the beginning of the windows header
to the beginning of the module-reference table. <br>
2ah specifies a relative offset from the beginning of the windows header
to the beginning of the imported-name table. <br>
2ch specifies a relative offset from the beginning of the file to the
beginning of the nonresident-name table. <br>
<br>
30h specifies the number of movable entry points. <br>
32h specifies a shift count that is used to align the logical sector.
this count is log2 of the segment sector size. it is <br>
typically 4, although the default count is 9. (this value corresponds to the /alignment
[/a] linker switch. when the <br>
linker command line contains /a:16, the shift count is 4. when the linker command line
contains /a:512, the shift <br>
count is 9.) <br>
34h specifies the number of resource segments. <br>
36h specifies the target operating system, depending on which bits are
set: <br>
<br>
bit meaning<br>
<br>
0 operating system format is unknown. <br>
1 reserved. <br>
2 operating system is microsoft windows. <br>
3 reserved. <br>
4 reserved. <br>
<br>
37h specifies additional information about the executable file. it can
be one or more of the following values: <br>
<br>
bit meaning<br>
<br>
1 if this bit is set, the executable file contains a windows 2.x
application that runs in version 3.x protected <br>
mode. <br>
2 if this bit is set, the executable file contains a windows 2.x
application that supports proportional fonts. <br>
3 if this bit is set, the executable file contains a fast-load area. <br>
<br>
38h specifies the offset, in sectors, to the beginning of the fast-load
area. (only windows uses this value.) <br>
3ah specifies the length, in sectors, of the fast-load area. (only
windows uses this value.) <br>
3ch reserved. <br>
3eh specifies the expected version number for windows. (only windows
uses this value.) <br>
<br>
segment table<br>
<br>
the segment table contains information that describes each segment in an executable file.
this information includes the <br>
segment length, segment type, and segment-relocation data. the following list summarizes
the values found in the segment <br>
table (the locations are relative to the beginning of each entry): <br>
<br>
location description<br>
<br>
00h specifies the offset, in sectors, to the segment data (relative to
the beginning of the file). a value of zero means no <br>
data exists. <br>
02h specifies the length, in bytes, of the segment, in the file. a value
of zero indicates that the segment length is 64k, <br>
unless the selector offset is also zero. <br>
04h specifies flags that describe the contents of the executable file.
this value can be one or more of the following: <br>
<br>
bit meaning<br>
<br>
0 if this bit is set, the segment is a data segment. otherwise, the
segment is a code segment. <br>
1 if this bit is set, the loader has allocated memory for the segment. <br>
2 if this bit is set, the segment is loaded. <br>
3 reserved. <br>
4 if this bit is set, the segment type is movable. otherwise, the
segment type is fixed. <br>
5 if this bit is set, the segment type is pure or shareable. otherwise,
the segment type is impure or <br>
nonshareable. <br>
6 if this bit is set, the segment type is preload. otherwise, the
segment type is loadoncall. <br>
7 if this bit is set and the segment is a code segment, the segment type
is executeonly. if this bit is set <br>
and the segment is a data segment, the segment type is readonly. <br>
<br>
8 if this bit is set, the segment contains relocation data. <br>
9 reserved. <br>
10 reserved. <br>
11 reserved. <br>
12 if this bit is set, the segment is discardable. <br>
13 reserved. <br>
14 reserved. <br>
15 reserved. <br>
<br>
06h specifies the minimum allocation size of the segment, in bytes. a
value of zero indicates that the minimum allocation <br>
size is 64k. <br>
<br>
resource table<br>
<br>
the resource table describes and identifies the location of each resource in the
executable file. the table has the following form: <br>
<br>
<br>
<br>
word rscalignshift;<br>
typeinfo rsctypes[];<br>
word rscendtypes;<br>
byte rscresourcenames[];<br>
byte rscendnames;<br>
<br>
following are the members in the resource table: <br>
<br>
rscalignshift specifies the alignment shift count for resource data.
when the shift count is used as an exponent of 2, <br>
the resulting value specifies the factor, in bytes, for computing the location of a
resource in the <br>
executable file. <br>
rsctypes specifies an array of typeinfo structures containing
information about resource types. there must <br>
be one typeinfo structure for each type of resource in the executable file. <br>
rscendtypes specifies the end of the resource type definitions. this
member must be zero. <br>
rscresourcenames specifies the names (if any) associated with the
resources in this table. each name is stored as <br>
consecutive bytes; the first byte specifies the number of characters in the name. <br>
rscendnames specifies the end of the resource names and the end of the
resource table. this member must be <br>
zero. <br>
<br>
type information<br>
<br>
the typeinfo structure has the following form: <br>
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -