New Executable

New Executable (also known by its header identification NE) is a 16-bit x86 executable format created by Microsoft in the 1980s. It was used for Windows applications from Windows 1.0 up to Windows Me, including components of Windows itself, in Multitasking MS-DOS, and in OS/2 (from 2.x along with Linear Executable). Allegedly, it was also used for Windows 386 and for something called Borland Operating System Services.

Compared to the previous MZ format, whose primary feature are relocations, NE introduces the possibility of dynamic linking. Executables linked to the main one are called modules, later also dynamic-link library (DLLs). Non-DLL executables usually have an .exe extension, although a .com extension is also possible. DLLs on OS/2 have an .dll extension (.exe in early version); on Windows, the extension can be .exe, .dll, .drv or .fon.

New Executable is also called segmented executable, reflecting the fact it contains segments of code and data to be loaded into memory using segmentation (as opposed to a linear executable).

History

The New Executable format was created in 1984 for MS-DOS and Windows, with its main feature being dynamic linking, needed especially for Windows applications to call into GDI and the kernel.

It first appeared in Windows 1.0 DR5, dated October 1984. Some, but not all of the files in DR5 contain an MZ stub. The format is quite different from its later versions, for more information, see New Executable (Windows 1.0 DR5).

The next year, Windows 1.0 Alpha introduced an improved version of the format with a mandatory MZ stub and an NE header offset field, still incompatible with newer versions.

Later in 1985, Windows 1.0 Beta improved the format once more. This version is the mostly compatible with later NE and continued to be used in Windows 1.0, Windows 2.0 and DOS 4 through 1985, 1986, and 1987. It is also the version described by old versions of newexe.h, as distributed in the early MS OS/2 SDKs, and the CHS release of Word for Windows source code.

Protected mode executables were introduced in 1986 with early versions of DOS 5.0, utilizing bits in the segment flag word to indicate the ring the segment runs in. Due to API incompatibilities, it is not possible to build a DOS executable to run in both modes out of the box.

Windows 2.1 and OS/2 1.1 (TODO: look through 1.1 betas for when exactly the change happened) introduced the OS field into the NE format in 1988, allowing differentiating between Windows and OS/2 executables (older versions either didn't use the field at all or used it for something else). This was the last major format change. IBM OS/2 Developer's Toolkit has newexe.h describing this version of the format.

NE was gradually replaced with PE in Windows 95 and higher and Windows NT, and with LX in OS/2 2.0 and higher. However, classical Windows up to Me contains 16-bit code in the OS itself, and the same possibly applies to OS/2.

Header

Various flags, used/unused, undocumented flags.

Sections

Dynamic linking, segmenting.

Linking

NE executables are created from so-called 80x86 relocatables (also known as Relocatable Object Module Format and OMF) using a linker, typically called LINK4.EXE or LINK.EXE. Older toolchains differentiate betwen LINK4.EXE (produces NE binaries) and LINK.EXE (produces MZ binaries); newer toolchains like Microsoft C 6.00 have only LINK.EXE (variously known as Segmented-Exectuable Linker and Linker/2) and the target executable format is controlled by the /L switch (/Lp for NE, /Lr for MZ).

During the development of the NE format, a different approach was used.

Reverse engineering

Microsoft SDKs ships EXEHDR.EXE, which can show the header of segmented executables. Windows CodeBack is a DOS-based tool for dumping NE binaries. A newer tool was developed as a part of the open-source Semblance project.

Cross-compatibility

In some cases, NE executables for one OS can be run on a different OS, with or without emulation. This happens when the system calls between the systems either overlap, or are implemented in a compatibility layer, and at the same time, the application doesn't use any other specific functions. OS/2 supports running Windows binaries through WinOS/2 since 2.0, and with some limitations through Windows Libraries for OS/2 since 1.2. Windows 1.x and possibly later versions can run binaries for Multitasking DOS 4.0, provided they do not use any DOSCALLS functions or INT 21h API specific to this version of DOS.