Comparison of executable file formats

Last updated

This is a comparison of binary executable file formats which, once loaded by a suitable executable loader, can be directly executed by the CPU rather than being interpreted by software. In addition to the binary application code, the executables may contain headers and tables with relocation and fixup information as well as various kinds of meta data. Among those formats listed, the ones in most common use are PE (on Microsoft Windows), ELF (on Linux and most other versions of Unix), Mach-O (on macOS and iOS) and MZ (on DOS).

Format nameOperating system Filename extension Explicit processor declarationsArbitrary sections Metadata [lower-alpha 1] Digital signature String table Symbol table 64-bit Fat binaries Can contain icon
ELF Unix-like, OpenVMS, BeOS from R4 onwards, Haiku, SerenityOS noneYes by fileYesYesExtension [1] YesYes [2] YesExtension [3] Extension [4]
PE Windows, ReactOS, HX DOS Extender, BeOS (R3 only) .EXE Yes by fileYesYesYes [5] YesYesNoOnly MZ (DOS) [6] Yes
PE32+ Windows (64-bit editions only) .EXE Yes by fileYesYesYesYesYesYes"Compiled Hybrid Portable Executable"Yes
Mach-O [7] NeXTSTEP, macOS, iOS, watchOS, tvOS noneYes by sectionSome (limited to max. 256 sections)YesYesYesYesYesYesNo
OS/360 OS/360 and successors, and VS/9, mainframe operating systemsnoneNoNoNoNoNoYesYesNoNo
GOFF IBM MVS and z/OS mainframe operating systemsnoneNoNoYesNoYesYesYesNoNo
a.out Unix-like noneNoNoNoNoYes [8] Yes [8] ExtensionNoNo
COFF Unix-like noneYes by fileYesNoNoYesYesExtensionNoNo
ECOFF Ultrix, Tru64 UNIX, IRIX noneYes by fileYesNoNoYesYesYesNoNo
XCOFF IBM AIX, BeOS, "classic" Mac OS noneYes by fileYesNoNoYesYes [9] YesNoNo
SOM HP-UX, MPE/ix  ?Un­knownUn­knownNoNoUn­knownYesNoUn­knownNo
Amiga Hunk AmigaOS noneNoYesYesNoNoYesNoYesNo
PEF [10] "classic" Mac OS, BeOS (PPC only)noneYes by fileNoNoNoYesYesNoNoNo
CMD CP/M-86, MP/M-86, Concurrent CP/M-86, Personal CP/M-86, S5-DOS, Concurrent DOS, Concurrent DOS 286, FlexOS, S5-DOS/ST, S5-DOS/MT, Concurrent DOS 386, Multiuser DOS, System Manager, REAL/32, DOS Plus .CMDNo (x86 only)YesNoNoExtensionExtensionNoNoNo
FlexOS 186 FlexOS 186, FlexOS 286, S5-DOS/ST, S5-DOS/MT, 4680 OS, FlexOS 386, 4690 OS .186 No (186/188 and higher only)YesNoNoExtensionExtensionNoNoNo
FlexOS 286 FlexOS 286, S5-DOS/ST, S5-DOS/MT, 4680 OS, FlexOS 386, 4690 OS .286 No (286 and higher only)YesNoNoExtensionExtensionNoNoNo
CP/M-68K CP/M-68K, Concurrent DOS 68K, FlexOS 68K .68K No (68000 and higher only)YesNoNoUn­knownUn­knownNoNoNo
COM (CP/M) CP/M, MP/M, Concurrent CP/M, Personal CP/M .COM No (8080/Z80 only)Extension (BDOS 3 and higher only)NoNoNoNoNoExtensionNo
COM (DOS) DOS, OS/2, Windows (except for 64-bit editions), Concurrent CP/M-86 (BDOS 3.1 only), Concurrent DOS, Concurrent DOS 286, FlexOS, Concurrent DOS 386, Multiuser DOS, System Manager, REAL/32, DOS Plus .COM No (x86 only)NoExtension (Novell/Caldera VERSION etc.)NoNoNoExtensionExtensionNo
MZ (DOS) DOS, OS/2, Windows (except for 64-bit editions), Concurrent DOS 286, FlexOS, Concurrent DOS 386, Multiuser DOS, System Manager, REAL/32, DOS Plus .EXE No (x86 only)YesExtension (Novell/Caldera VERSION etc.)NoExtensionExtensionExtensionNoNo
MZ (GEM) GEM, ViewMAX .APP/.ACCNo (x86 only)YesNoNoUn­knownUn­knownNoNoUn­known
NE MS-DOS 4.0 (multitasking), OS/2, Windows, HX DOS Extender .EXE Un­knownUn­knownUn­knownNoUn­knownUn­knownNoOnly MZ (DOS) [11] Yes
LE, (W3, W4) OS/2 (2.0 and higher only), some DOS extenders .EXE Yes by file (286 and higher only)YesYesNoYesYesNoNoYes
LX OS/2 (2.0 and higher only), some 32-bit DOS extenders .EXE Yes by fileYesYesNoYesYes [12] NoNoYes
PIM/XIP PalmDOS (MINIMAX applications only) .PIM/.XIP No (x86 only)YesNoNoNoNoNoNoNo
DL MS-DOS System Manager applications (HP LX series only) .EXM No (186/188 and higher only)YesNoNoNoNoNoNoNo
MP Phar Lap DOS extenders .EXP Un­known (286 and higher only)YesNoNoUn­knownUn­knownNoNoNo
P2 Phar Lap 16-bit DOS extenders .EXP Un­known (286 and higher only)YesNoNoUn­knownUn­knownNoNoNo
P3 Phar Lap 32-bit DOS extenders .EXP Un­known (386 and higher only)YesNoNoUn­knownUn­knownNoNoNo
GEOS PC/GEOS, Geoworks Ensemble, NewDeal Office, Breadbox Ensemble .GEO Un­known (x86 only)Un­knownUn­knownNoUn­knownUn­knownNoNoUn­known

Notes

  1. ↑
    Metadata is casually used to describe the controlling data used in software architectures that are more abstract or configurable. Most executable file formats include what may be termed "metadata" that specifies certain, usually configurable, behavioral runtime characteristics. However, it is difficult if not impossible to precisely distinguish program "metadata" from general aspects of stored-program computing architecture; if the machine reads it and acts upon it, it is a computational instruction, and the prefix "meta" has little significance.
    In Java, the class file format contains metadata used by the Java compiler and the Java virtual machine to dynamically link classes and to support reflection. The Java Platform, Standard Edition since J2SE 5.0 has included a metadata facility to allow additional annotations that are used by development tools.
    In MS-DOS, the COM file format does not normally include metadata, while the EXE file and Windows PE formats do. These metadata can include the company that published the program, the date the program was created, the version number and more.
    In the .NET Framework executable format, extra metadata is included to allow reflection at runtime.

Related Research Articles

<span class="mw-page-title-main">Executable and Linkable Format</span> Standard file format for executables, object code, shared libraries, and core dumps.

In computing, the Executable and Linkable Format, is a common standard file format for executable files, object code, shared libraries, and core dumps. First published in the specification for the application binary interface (ABI) of the Unix operating system version named System V Release 4 (SVR4), and later in the Tool Interface Standard, it was quickly accepted among different vendors of Unix systems. In 1999, it was chosen as the standard binary file format for Unix and Unix-like systems on x86 processors by the 86open project.

<span class="mw-page-title-main">Netwide Assembler</span> Assembler for the Intel x86 architecture

The Netwide Assembler (NASM) is an assembler and disassembler for the Intel x86 architecture. It can be used to write 16-bit, 32-bit (IA-32) and 64-bit (x86-64) programs. It is considered one of the most popular assemblers for Linux and x86 chips.

The Portable Executable (PE) format is a file format for executables, object code, DLLs and others used in 32-bit and 64-bit versions of Windows operating systems, and in UEFI environments. The PE format is a data structure that encapsulates the information necessary for the Windows OS loader to manage the wrapped executable code. This includes dynamic library references for linking, API export and import tables, resource management data and thread-local storage (TLS) data. On NT operating systems, the PE format is used for EXE, DLL, SYS, MUI and other file types. The Unified Extensible Firmware Interface (UEFI) specification states that PE is the standard executable format in EFI environments.

In computing, cross-platform software is computer software that is designed to work in several computing platforms. Some cross-platform software requires a separate build for each platform, but some can be directly run on any platform without special preparation, being written in an interpreted language or compiled to portable bytecode for which the interpreters or run-time packages are common or standard components of all supported platforms.

A computing platform, digital platform, or software platform is an environment in which software is executed. It may be the hardware or the operating system (OS), a web browser and associated application programming interfaces, or other underlying software, as long as the program code is executed using the services provided by the platform. Computing platforms have different abstraction levels, including a computer architecture, an OS, or runtime libraries. A computing platform is the stage on which computer programs can run.

Bytecode is a form of instruction set designed for efficient execution by a software interpreter. Unlike human-readable source code, bytecodes are compact numeric codes, constants, and references that encode the result of compiler parsing and performing semantic analysis of things like type, scope, and nesting depths of program objects.

<span class="mw-page-title-main">FASM</span> Open source assembler for x86 processors

FASM is an assembler for x86 processors. It supports Intel-style assembly language on the IA-32 and x86-64 computer architectures. It claims high speed, size optimizations, operating system (OS) portability, and macro abilities. It is a low-level assembler and intentionally uses very few command-line options. It is free and open-source software.

<span class="mw-page-title-main">Executable</span> A file that causes a computer to follow indicated instructions

In computing, executable code, an executable file, or an executable program, sometimes simply referred to as an executable or binary, causes a computer "to perform indicated tasks according to encoded instructions", as opposed to a data file that must be interpreted (parsed) by a program to be meaningful.

An object-oriented operating system is an operating system that is designed, structured, and operated using object-oriented programming principles.

An object file is a file that contains machine code or bytecode, as well as other data and metadata, generated by a compiler or assembler from source code during the compilation or assembly process. The machine code that is generated is known as object code.

For Microsoft Windows, OS/2, and DOS, .exe is the filename extension that denotes a file as being executable – a computer program – containing an entry point.

A fat binary is a computer executable program or library which has been expanded with code native to multiple instruction sets which can consequently be run on multiple processor types. This results in a file larger than a normal one-architecture binary file, thus the name.

<span class="mw-page-title-main">Interactive Disassembler</span> Software reverse engineering tool

The Interactive Disassembler (IDA) is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It can also be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plug-in, which generates a high level, C source code-like representation of the analysed program, is available at extra cost.

<span class="mw-page-title-main">UPX</span>

UPX is a free and open source executable packer supporting a number of file formats from different operating systems.

The Extensible Metadata Platform (XMP) is an ISO standard, originally created by Adobe Systems Inc., for the creation, processing and interchange of standardized and custom metadata for digital documents and data sets.

The New Executable is a 16-bit executable file format, a successor to the DOS MZ executable format. It was used in Windows 1.0–3.x, Windows 9x, multitasking MS-DOS 4.0, OS/2 1.x, and the OS/2 subset of Windows NT up to version 5.0. An NE is also called a segmented executable. It utilizes the 286 protected mode.

In computing, a dynamic linker is the part of an operating system that loads and links the shared libraries needed by an executable when it is executed, by copying the content of libraries from persistent storage to RAM, filling jump tables and relocating pointers. The specific operating system and executable format determine how the dynamic linker functions and how it is implemented.

The following is a timeline of virtualization development. In computing, virtualization is the use of a computer to simulate another computer. Through virtualization, a host simulates a guest by exposing virtual hardware devices, which may be done through software or by allowing access to a physical device connected to the machine.

Windows Runtime (WinRT) is a platform-agnostic component and application architecture first introduced in Windows 8 and Windows Server 2012 in 2012. It is implemented in C++ and officially supports development in C++, Rust/WinRT, Python/WinRT, JavaScript-TypeScript, and the managed code languages C# and Visual Basic .NET (VB.NET).

References

  1. ↑ "elfsign – Freecode". Freshmeat.net. Retrieved 9 July 2012.
  2. ↑ "(3elf) - Elf library routines". Uw714doc.sco.com. 25 April 2004. Retrieved 9 July 2012.
  3. ↑ "FatELF: Universal Binaries for Linux". Icculus.org. Retrieved 9 July 2012.
  4. ↑ "ElfIcon: Icons for ELF files". Compholio.com. Retrieved 9 July 2012.
  5. ↑ "Windows Authenticode Portable Executable Signature Format". Microsoft. 29 August 2008. Retrieved 9 July 2012.
  6. ↑ History of Portable Executable
  7. ↑ "Mac OS X ABI Mach-O File Format Reference". Apple Inc. 4 February 2009. Retrieved 9 July 2012.
  8. 1 2 "a.out(5) - FreeBSD Man Pages". Freebsd.org. 10 June 2010. Retrieved 9 July 2012.
  9. ↑ "Files Reference – XCOFF Object File Format". IBM.
  10. ↑ "MPW Command Reference - DumpPEF". Apple Inc. Archived from the original on 12 May 2008.
  11. ↑ DOS stub of New Executable
  12. ↑ "LX - Linear eXecutable Module Format Description". 3 June 1992. Retrieved 7 July 2019.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.