I need to differentiate a 32 bit PE from a 16 bit DOS MZ. What is the correct way to do it? I can use heuristics like looking for the PE header, but I feel like it's not necessarily deterministic
2 Answers
All DOS style executables have an 'MZ' as the first two bytes.
To identify an MSDOS executable vs. the multitude of other variants the best bet seems to be to read the position of the relocation table at offset 0x0018 in the file, if this is greater than 0x0040 (into the file) it is not just plain DOS.
To specifically identify the executable as a 'PE' executable there is a pointer at offset 0x003C in the file. This is an offset within the file the will have the bytes 'PE' and two nuls. Other MSDOS 'MZ' variants will use the same location to put other codes eg: 'NE', 'W3', 'LE' etc.
'PE' style executables also come in many forms, I expect you'll be interested in 32bit vs. 64bit at the very least.
Probably the ultimate authority on this sort of thing is the Unix 'file' command, it's designed to reliably identify ANY file type by investigating it's contents. The MSDOS part is listed here. Microsoft is NOT a reliable authority on this because they ignore non-Microsoft information.
A plain DOS EXE header is only 28 (0x1C
) bytes long and is usually followed by the DOS relocation table if present. The IMAGE_DOS_HEADER
struct
of the NT PE header is much larger at 64 (0x40) bytes as it has been extended for the various other Windows executable formats. This header size difference is why the answer from @user3710044 is not only the fastest but its reliable: an EXE is plain DOS if the relocation table [e_lfarlc] < 0x40).
As long as you realize that the e_lfanew
member (an offset to a number of possible "extended" headers) does not exist in a plain DOS executable, you can also use the following logic to distinguish between the various MZ-style formats:
If the beginning of the file does not begin with "MZ" or "ZM", it is not an DOS or Windows executable image. Otherwise you may have one of the following types of executable formats: plain DOS, NE (Windows 16-bit), LE (16-bit VXD), PE32, or PE32+ (PE64).
Determine if you have a plain DOS executable by looking at the
e_lfanew
value. A plain DOS executable will have an out-of-rangee_lfanew
pointing outside of the limits of the file, a zero, or if the offset happens to be in range, the signature at its offset won't match any signatures below.Try to match the signature of the "in-range" offset pointed to by
e_lfanew
with the following WORD or DWORD values:"PE" followed by two zero bytes if the image is a PE32 or PE32+ (PE64) and is further determined by the "magic" in the NT Optional Header "NE" indicates the image is a 16-bit Windows executable "LE" indicates the image is a 16-bit Virtual Device Driver (VXD)
More obscure signatures (referenced from Ralph Brown's INT 21/AH=4Bh):
LX variant of LE used in OS/2 2.x
W3 Windows WIN386.EXE file; a collection of LE files
W4 Windows95 VMM32.VXD file
DL HP 100LX/200LX system manager compliant executable (.EXM)
MP old PharLap .EXP
P2 PharLap 286 .EXP
P3 PharLap 386 .EXP
-
1It's incorrect that
LE
indicates that the file contains 16-bit code. For example, the file VIPX.386 (Windows 3.1) contains 32-bit code, as indicated by the target operating system LE header field (Windows 386) and bit 13 of the flags field of the object table entry. More info about LE and LX headers: program-transformation.org/Transform/PcExeFormat– ptsApr 7, 2020 at 16:49 -
Correct statement about
LE
: typically either 32-bit virtual device driver (VxD) on Windows 3.x, Windows 95, Windows 98 and Windows Me, or 32-bit DOS executable (typically compiled and linked by the Watcom C/C++ compiler). AnLE
file can contain 16-bit and 32-bit code (even in the same file), butLE
files with any 16-bit code are extremely rare, I couldn't find any.– ptsApr 7, 2020 at 17:08 -
Correct statement about
LX
: typically 32-bit OS/2 2.x executable. AnLX
file can contain 16-bit and 32-bit code (even in the same file), butLX
files with any 16-bit code are extremely rare, I couldn't find any.LX
andLE
are very similar, program-transformation.org/Transform/PcExeFormat contains some differences.– ptsApr 7, 2020 at 17:11