File format of a DOS32 executable (.EXE file produced from DLINK) Offset Size Description ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 0 n A stub loader or DOS32.EXE of n bytes {no stub in DLL} n+0 4 Signature "Adam" { ="DLL " for DLL files } n+4 2 Minimum DOS32 version required (packed BCD) n+6 2 DLINK version in packed BCD format ----if n+4 < 350h. DOS32 version less than 3.50--- n+8 4 Number of bytes remaining after the stub file. The entire .EXE file size (after linking) will be equal to this value plus the stub file size. n+0Ch 4 Start of 32bit executable image relative to the 'Adam' signature. n+10h 4 Length of executable image ( see below ). n+14h 4 Initial memory required for application. This value must be larger than the size of the 32bit executable image. n+18h 4 Initial EIP { public varible address for DLL file } n+1Ch 4 Initial ESP { ignored in DLL header } n+20h 4 Number of entries in fixup table. Each entry in the table contains a 32bit offset relative to the start of the executable image of a 16bit WORD that must be set to the programs DATA selector at load time. The table immediately follows the executable image. n+24h 4 Flags ( function active when bit is set ) bit 0 = executable image is compressed bit 1 = display DOS32 logo when executed bits 2..31 reserved. ----if n+0Ch = 28h. Original DOS32----- n+28h n Image starts ----if n+0Ch = 2Ch. TMT Pascal extension----- n+28h 4 Size of 32bit offset relocations section. Each entry in the table contains a 32bit offset relative to the start of the executable image of a 32bit DWORD that must be added with the 32bit offset of the begining of executable image. The table immediately follows the executable image. n+2Ch n Image starts ----if n+4 = 350h. DOS32 version 3.50--- n+8 4 Length of executable image + fixups ( see below ). n+0Ch 4 Number of bytes remaining after the stub file. The entire .EXE file size (after linking) will be equal to this value plus the stub file size. n+10h 4 Start of 32bit executable image relative to the 'Adam' signature. n+14h 4 Initial EIP { public varible address for DLL file } n+18h 4 Initial memory required for application. This value must be larger than the size of the 32bit executable image. n+1Ch 4 Initial ESP { ignored in DLL header } n+20h 4 Offset of DOS32 ver 3.50 fixup table. The table immediately follows the executable image. Also can be treated as a size of executable image. n+24h 1 DOS32 copyright string screen attribute byte n+25h 1 Something (?) n+26h 2 Flags ( function active when bit is set ) bit 0 = executable image is compressed bit 1 = display DOS32 logo when executed bits 2..31 reserved. n+28h 4 Unknown (0)