New Executable

New Executable (also known by its header identification NE) is a 16-bit x86 executable format created by Microsoft in the 1980s. It was used for Windows applications from Windows 1.0 up to Windows Me, including components of Windows itself, and in OS/2 (from 2.x along with Linear Executable). Allegedly, it was also used in European MS-DOS 4.0 (also known as Multitasking MS-DOS), for Win32s applications, and for something called Borland Operating System Services.

Compared to the previous MZ format, whose primary feature are relocations, NE introduces the possibility of dynamic linking. Executables linked to the main one are called modules, later also dynamic-link library (DLLs). Non-DLL executables usually have an .exe extension, although a .com extension is also possible. DLLs on OS/2 have an .dll extension; on Windows, their extension can be .exe, .dll, .drv or .fon.

New Executable is also called segmented executable, reflecting the fact it contains segments of code and data to be loaded into memory using segmentation (as opposed to a linear executable).

History

The format first appeared in 1985 with the release of Windows 1.0. However, it is implied that it was originally designed for OS/2, whose development started earlier the same year under the name DOS 5.0 and CP/DOS, and DOS 4.0 (so-called Multitasking MS-DOS) before that. For Windows, it was the sole executable format for user applications until 3.1, and continued to be supported until Windows 10 (except 64-bit versions of Windows). For OS/2, it had this status until OS/2 2.0, and is natively supported in all subsequent versions of OS/2 (except OS/2 for PowerPC). For DOS, it was dropped together with the original DOS 4.0 being dropped in favor of IBM DOS 4.0 and OS/2.

It was gradually replaced with PE in Windows 95 and higher and Windows NT, and with LX in OS/2 2.0 and higher. However, classical Windows up to Me contains 16-bit code in the OS itself, and the same possibly applies to OS/2.

Header

Various flags, used/unused, undocumented flags (like OS/2 compatability override mentioned in WLO article).

Sections

Dynamic linking, segmenting.

Linking

NE executables are created from so-called 80x86 relocatables (also known as Relocatable Object Module Format and OMF) using a linker, typically called LINK4.EXE or LINK.EXE. Older toolchains differentiate betwen LINK4.EXE (produces NE binaries) and LINK.EXE (produces MZ binaries); newer toolchains like Microsoft C 6.00 have only LINK.EXE and the target executable format is controlled by the /L switch (/Lp for NE, /Lr for MZ).

Reverse engineering

Windows CodeBack is a DOS-based tool for dumping NE binaries. A newer tool was developed as a part of the open-source Semblance project.

Cross-compatibility

In some cases, NE executables for one OS can be run on a different OS, with or without emulation. This happens when the system calls between the systems either overlap, or are implemented in a compatibility layer, and at the same time, the application doesn't use any other specific functions. OS/2 supports running Windows binaries through WinOS/2 since 2.0, and with some limitations through Windows Libraries for OS/2 since 1.2. Windows 1.x and possibly later versions can run binaries for Multitasking DOS 4.0, provided they do not use any DOSCALLS functions or INT 21h API specific to this version of DOS.