2

I need to differentiate a 32 bit PE from a 16 bit DOS MZ. What is the correct way to do it? I can use heuristics like looking for the PE header, but I feel like it's not necessarily deterministic

1
  • 3
    It's not "just an heuristic". All executables have a 16-bit loader, and for 32-bit (which can be LE as well), the header provides exactly the necessary information. How would the OS else know?
    – Jongware
    Mar 2, 2015 at 7:27

2 Answers 2

6

All DOS style executables have an 'MZ' as the first two bytes.
To identify an MSDOS executable vs. the multitude of other variants the best bet seems to be to read the position of the relocation table at offset 0x0018 in the file, if this is greater than 0x0040 (into the file) it is not just plain DOS.

To specifically identify the executable as a 'PE' executable there is a pointer at offset 0x003C in the file. This is an offset within the file the will have the bytes 'PE' and two nuls. Other MSDOS 'MZ' variants will use the same location to put other codes eg: 'NE', 'W3', 'LE' etc.

'PE' style executables also come in many forms, I expect you'll be interested in 32bit vs. 64bit at the very least.

Probably the ultimate authority on this sort of thing is the Unix 'file' command, it's designed to reliably identify ANY file type by investigating it's contents. The MSDOS part is listed here. Microsoft is NOT a reliable authority on this because they ignore non-Microsoft information.

3

A plain DOS EXE header is only 28 (0x1C) bytes long and is usually followed by the DOS relocation table if present. The IMAGE_DOS_HEADER struct of the NT PE header is much larger at 64 (0x40) bytes as it has been extended for the various other Windows executable formats. This header size difference is why the answer from @user3710044 is not only the fastest but its reliable: an EXE is plain DOS if the relocation table [e_lfarlc] < 0x40).

As long as you realize that the e_lfanew member (an offset to a number of possible "extended" headers) does not exist in a plain DOS executable, you can also use the following logic to distinguish between the various MZ-style formats:

  1. If the beginning of the file does not begin with "MZ" or "ZM", it is not an DOS or Windows executable image. Otherwise you may have one of the following types of executable formats: plain DOS, NE (Windows 16-bit), LE (16-bit VXD), PE32, or PE32+ (PE64).

  2. Determine if you have a plain DOS executable by looking at the e_lfanew value. A plain DOS executable will have an out-of-range e_lfanew pointing outside of the limits of the file, a zero, or if the offset happens to be in range, the signature at its offset won't match any signatures below.

  3. Try to match the signature of the "in-range" offset pointed to by e_lfanew with the following WORD or DWORD values:

    "PE" followed by two zero bytes if the image is a PE32 or PE32+ (PE64) and is further determined by the "magic" in the NT Optional Header
    "NE" indicates the image is a 16-bit Windows executable
    "LE" indicates the image is a 16-bit Virtual Device Driver (VXD)
    

More obscure signatures (referenced from Ralph Brown's INT 21/AH=4Bh):

LX     variant of LE used in OS/2 2.x
W3     Windows WIN386.EXE file; a collection of LE files
W4     Windows95 VMM32.VXD file
DL     HP 100LX/200LX system manager compliant executable (.EXM)
MP     old PharLap .EXP
P2     PharLap 286 .EXP
P3     PharLap 386 .EXP
3
  • 1
    It's incorrect that LE indicates that the file contains 16-bit code. For example, the file VIPX.386 (Windows 3.1) contains 32-bit code, as indicated by the target operating system LE header field (Windows 386) and bit 13 of the flags field of the object table entry. More info about LE and LX headers: program-transformation.org/Transform/PcExeFormat
    – pts
    Apr 7, 2020 at 16:49
  • Correct statement about LE: typically either 32-bit virtual device driver (VxD) on Windows 3.x, Windows 95, Windows 98 and Windows Me, or 32-bit DOS executable (typically compiled and linked by the Watcom C/C++ compiler). An LE file can contain 16-bit and 32-bit code (even in the same file), but LE files with any 16-bit code are extremely rare, I couldn't find any.
    – pts
    Apr 7, 2020 at 17:08
  • Correct statement about LX: typically 32-bit OS/2 2.x executable. An LX file can contain 16-bit and 32-bit code (even in the same file), but LX files with any 16-bit code are extremely rare, I couldn't find any. LX and LE are very similar, program-transformation.org/Transform/PcExeFormat contains some differences.
    – pts
    Apr 7, 2020 at 17:11

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.