Linear Executable

Last updated

The Linear Executable (LE) format is a file format for executables, object code, and DLLs designed for 32-bit protected mode operating systems. Originally used by the OS/2 operating system and adopted by various DOS extenders, it also served as the file format for Virtual Device Drivers (VxD) in early versions of Windows, including Windows 3.x and the Windows 9x series. [1] The malleability of LE files attracted interest in using them for steganography. [2]

Contents

History

The LE format was first introduced in the early 1990s during a period of transition from 16-bit to 32-bit computing. It was developed as an extension of the older New Executable (NE) format, which was used for 16-bit applications. Limitations in memory management and addressing led to the development of LE as a 32-bit replacement. LE expanded on NE's functionality by allowing the system to operate in protected mode.

An extended version of the format, called LX, was developed specifically for OS/2 Warp and supported further extensions over the LE format.

Structure

Files in the LE format begin with an MZ header (the standard DOS executable header) for backward compatibility with DOS systems. Within the MZ header, at offset 0x3C, there is a 32-bit value referred to as the e_lfanewfield, which contains a pointer to the extended header (the LE header). The LE header starts with the ASCII characters LE (or LX in OS/2 Warp). In Linear Executables, file offsets and structures are typically defined relative to the start of the LE header or as absolute offsets within the file. [3]

Usage

Related Research Articles

<span class="mw-page-title-main">OS/2</span> Operating system from IBM

OS/2 is a proprietary computer operating system for x86 and PowerPC based personal computers. It was initially created and developed jointly by IBM and Microsoft, under the leadership of IBM software designer Ed Iacobucci, intended as a replacement for DOS. The first version was released in 1987; a feud between the two companies beginning in 1990 resulted in Microsoft leaving development exclusively to IBM, who continued development on their own. OS/2 Warp 4 in 1996 was the last major upgrade, after which IBM slowly halted the product as it failed to compete against Microsoft's Windows; updated versions of OS/2 were released by IBM until 2001.

File Allocation Table (FAT) is a file system developed for personal computers and was the default filesystem for the MS-DOS and Windows 9x operating systems. Originally developed in 1977 for use on floppy disks, it was adapted for use on hard disks and other devices. The increase in disk drive capacity over time drove modifications to the design that resulted in versions: FAT12, FAT16, FAT32, and exFAT. FAT was replaced with NTFS as the default file system on Microsoft operating systems starting with Windows XP. Nevertheless, FAT continues to be commonly used on relatively small capacity solid-state storage technologies such as SD card, MultiMediaCard (MMC) and eMMC because of its compatibility and ease of implementation.

The Portable Executable (PE) format is a file format for executables, object code, dynamic-link-libraries (DLLs), and binary files used on 32-bit and 64-bit Windows operating systems, as well as in UEFI environments. It is the standard format for executables on Windows NT-based systems, including files such as .exe, .dll, .sys, and .mui. At its core, the PE format is a structured data container that gives the Windows operating system loader eveything it needs to properly manage the executable code it contains. This includes references for dynamically linked libraries, tables for importing and exporting APIs, resource management data and thread-local storage (TLS) information.

In computing, protected mode, also called protected virtual address mode, is an operational mode of x86-compatible central processing units (CPUs). It allows system software to use features such as segmentation, virtual memory, paging and safe multi-tasking designed to increase an operating system's control over application software.

VxD is the device driver model used in Microsoft Windows/386 2.x, the 386 enhanced mode of Windows 3.x, Windows 9x, and to some extent also by the Novell DOS 7, OpenDOS 7.01, and DR-DOS 7.02 multitasker (TASKMGR). VxDs have access to the memory of the kernel and all running processes, as well as raw access to the hardware. Starting with Windows 98, Windows Driver Model was the recommended driver model to write drivers for, with the VxD driver model still being supported for backward compatibility, until Windows Me.

<span class="mw-page-title-main">4DOS</span> Command line interpreter

4DOS is a command-line interpreter by JP Software, designed to replace the default command interpreter COMMAND.COM in Microsoft DOS and Windows. It was written by Rex C. Conn and Tom Rawson and first released in 1989. Compared to the default, it has a large number of enhancements.

<span class="mw-page-title-main">Windows 9x</span> Series of Microsoft operating systems

Windows 9x is a generic term referring to a line of discontinued Microsoft Windows operating systems from 1995 to 2000, which were based on the Windows 95 kernel and its underlying foundation of MS-DOS, both of which were updated in subsequent versions. The first version in the 9x series was Windows 95, which was succeeded by Windows 98 and then Windows Me, which was the third and last version of Windows on the 9x line, until the series was superseded by Windows XP.

For Microsoft Windows, OS/2, and DOS, .exe is the filename extension that denotes a file as being executable – a computer program – containing an entry point.

<span class="mw-page-title-main">Virtual address space</span> Set of ranges of virtual addresses

In computing, a virtual address space (VAS) or address space is the set of ranges of virtual addresses that an operating system makes available to a process. The range of virtual addresses usually starts at a low address and can extend to the highest address allowed by the computer's instruction set architecture and supported by the operating system's pointer size implementation, which can be 4 bytes for 32-bit or 8 bytes for 64-bit OS versions. This provides several benefits, one of which is security through process isolation assuming each process is given a separate address space.

Virtual DOS machines (VDM) refer to a technology that allows running 16-bit/32-bit DOS and 16-bit Windows programs when there is already another operating system running and controlling the hardware.

The New Executable is a 16-bit executable file format, a successor to the DOS MZ executable format. It was used in Windows 1.0–3.x, Windows 9x, multitasking MS-DOS 4.0, OS/2 1.x, and the OS/2 subset of Windows NT up to version 5.0. An NE is also called a segmented executable. It utilizes the 286 protected mode.

A program information file (PIF) defines how a given DOS program should be run in a multi-tasking environment, especially in order to avoid giving it unnecessary resources which could remain available to other programs. TopView was the originator of PIFs; they were then inherited and extended by DESQview and Microsoft Windows, where they are most often seen. PIFs are seldom used today in software due to the absence of DOS applications.

The DOS MZ executable format is the executable file format used for .EXE files in DOS.

.sys is a filename extension used in MS-DOS applications and Microsoft Windows operating systems. They are system files that contain device drivers or hardware configurations for the system.

The booting process of Microsoft Windows varies between different releases.

The Object Module Format (OMF) is an object file format used primarily for software intended to run on Intel 80x86 microprocessors. It was originally developed by Intel around 1975–1977 for ISIS-II, targeting the 8-bit 8080/8085 processors. This variant later became known as OMF-80. As OMF-86 it was adapted to the 16-bit 8086 processor in 1978.

<span class="mw-page-title-main">MS-DOS</span> Discontinued Microsoft operating system

MS-DOS is an operating system for x86-based personal computers mostly developed by Microsoft. Collectively, MS-DOS, its rebranding as IBM PC DOS, and a few operating systems attempting to be compatible with MS-DOS, are sometimes referred to as "DOS". MS-DOS was the main operating system for IBM PC compatibles during the 1980s, from which point it was gradually superseded by operating systems offering a graphical user interface (GUI), in various generations of the graphical Microsoft Windows operating system.

<span class="mw-page-title-main">DOS</span> Family of IBM PC-compatible operating systems

DOS is a family of disk-based operating systems for IBM PC compatible computers. The DOS family primarily consists of IBM PC DOS and a rebranded version, Microsoft's MS-DOS, both of which were introduced in 1981. Later compatible systems from other manufacturers include DR-DOS (1988), ROM-DOS (1989), PTS-DOS (1993), and FreeDOS (1994). MS-DOS dominated the IBM PC compatible market between 1981 and 1995.

A master boot record (MBR) is a type of boot sector in the first block of partitioned computer mass storage devices like fixed disks or removable drives intended for use with IBM PC-compatible systems and beyond. The concept of MBRs was publicly introduced in 1983 with PC DOS 2.0.

<span class="mw-page-title-main">Architecture of Windows 9x</span>

The Windows 9x series of operating systems refers to a series of Microsoft Windows operating systems produced from 1995 to 2000. They are based on the Windows 95 kernel which is a monolithic kernel. The basic code is similar in function to MS-DOS. They are 16-/32-bit hybrids and require support from MS-DOS to operate.

References

  1. Sklyarov, Dmitry (2004). Hidden Keys to Software Break-Ins and Unauthorized. A-LIST. p. 125. ISBN   9781931769303.
  2. Zaidan et al. 2009.
  3. "IBM OS/2 Warp 4 Toolkit Documents 2". IBM .

Sources