#1
  1. No Profile Picture
    Contributing User
    Devshed Novice (500 - 999 posts)

    Join Date
    Jan 2002
    Location
    Seattle WA
    Posts
    863
    Rep Power
    14

    The structure of an EXE.


    So for the first time, I actually browsed one of my exe files in a hex editor. I was pretty amazed at what I saw. I have a 140 kB exe, and within it, I have huge blocks of repeating bytes. The worse one I found was 65kB of consecutive null bytes. Other blocks existed too, none of them as big, and not always null bytes either.

    What purpose do these blocks serve? Is it space for the locals and such that are declared as the program executes?
  2. #2
  3. Banned ;)
    Devshed Supreme Being (6500+ posts)

    Join Date
    Nov 2001
    Location
    Woodland Hills, Los Angeles County, California, USA
    Posts
    9,616
    Rep Power
    4247
    I think what you're seeing is part of the EXE file header. In a DOS EXE file, the first 256 bytes formed the EXE header. They have extended it quite a bit for Windows. The header gave the OS loader information on how to load the various parts of the EXE file (code segments vs data segments) into memory. In DOS, the .com files did not have this header, since the code and data segments were the same and hence .com programs could not exceed 64K in size.

    The first two bytes of an EXE are always MZ (which is what identifies it as an EXE. If the file did not contain this, DOS would treat it as a .COM file irrespective of the .EXE extension). Supposedly MZ stands for Mark Zbikowski (spelling?), who was an early programmer at Microsoft. The rest of the header contains information about various program segments. Not all of the header fields were used for every executable, so a lot of them may be zero. For more info on these fields:
    http://support.microsoft.com/default...b;EN-US;q65122
  4. #3
  5. No Profile Picture
    Contributing User
    Devshed Novice (500 - 999 posts)

    Join Date
    Jan 2002
    Location
    Seattle WA
    Posts
    863
    Rep Power
    14
    Hmm. That's neat. I was wondering what exactly made an exe what it is. It just shocked me that over 50% of my file size was 'nothing'.

IMN logo majestic logo threadwatch logo seochat tools logo