The word EXE is short for executable, an EXE file consists of an executable program which can be run on Microsoft Windows operating system. Whereas the executable file has no extension on UNIX operating system. The .exe is a standard file extension used by software languages to deliver the output of the program for Microsoft Windows. Setup.exe, Install.exe and cmd.exe are some common and well familiar names of EXE files.
EXE file format
MS-DOS compilers was introduced with the memory models having the 64K memory limitation. The general concept is to set different segment registers in the x86 CPU (CS, DS, ES, SS) to point to the different or same segments, therefore allowing various degrees of access to memory. Some specific memory models were:
tiny: All memory accesses are 16-bit (segment registers unchanged). Produces a .COM file instead of an .EXE file.
small: All memory accesses are 16-bit (segment registers unchanged).
compact: Data addresses include both segment and offset, reloading the DS or ES registers on access and allowing up to 1M of data. Code accesses don’t change the CS register, allowing 64K of code.
medium: Code addresses include the segment address, reloading CS on access and allowing up to 1M of code. Data accesses don’t change the DS and ES registers, allowing 64K of data.
large: Both code and data addresses are (segment, offset) pairs, always reloading the segment addresses. The whole 1M byte memory space is available for both code and data.
huge: Same as the large model, with additional arithmetic being generated by the compiler to allow access to arrays larger than 64K.
The developers have to decide that which model should be selected while creating an exe file.
Portable EXE file format
The portable executable file format (PE) contains a number of informational headers, the following is the list of headers:
DOS header: MS-DOS header ensures either backwards compatibility, or graceful decline of new file types.
PE Header: At offset 60 (0x3C) from the beginning of the DOS header is a pointer to the PE File header
COFF Header: The COFF header has some information that is useful to an executable, and some information that is more useful to an object file.
PE Optional Header: The PE Optional Header occurs directly after the COFF header, and some sources even show the two headers as being part of the same structure.
Section Table: Immediately after the PE Optional Header we find a section table. The section table consists of an array of IMAGE_SECTION_HEADER structures.
Mappable Sections: Can save space in memory by mapping the code of a library into more than one process.