GitXplorerGitXplorer
q

win16ne

public
28 stars
3 forks
1 issues

Commits

List of commits on branch master.
Unverified
0f65c0c58e870f7d84716bd0cb26934e99bb751a

Handle explicit end of entry table

qqnighy committed 2 years ago
Unverified
332d0af84dfb2b0dcbc2c91df41223664ce4181f

Support more cases

qqnighy committed 2 years ago
Unverified
773144d24ae7723c4eefbdf00d29daa7d3233024

Use bytemuck for NE header

qqnighy committed 2 years ago
Unverified
fef82b9526349d44de921d4138e51d0b72850679

Add NE header test

qqnighy committed 2 years ago
Unverified
4f28d5a7383e518cacdb235cc95d986a5776ca30

Use bytemuck to interpret headers

qqnighy committed 2 years ago
Unverified
f6d0c8dbbcad43199ec8301ed06b881d16d79426

Add MZ test

qqnighy committed 2 years ago

README

The README file for this repository.

Parser & Disassembler for 16bit Windows target

This is a parser and a disassembler for 16bit Windows target, known as New Executable (NE).

What is NE?

The "New Executable" format is an old format, which old 16bit Windows OSes (1.0 to 3.1x) have used and 32bit OSes have supported through emulation (WoW32).

This is different from PE (Portable Executable) or the plain MZ (DOS) format.

How to check if a file is in the NE format?

  • NE file has the "MZ" magic at the beginning of the file
    • However, the converse doesn't hold. DOS executables and PE executables have "MZ" too.
  • NE file has the "NE" magic at the beginning of the "new header", the place of which is indicated by a little endian 32-bit integer at 0x3C from the beginning of the file.
    • DOE executables lacks this "new header" and PE executables have "PE" there.

How to obtain NE executables?

Prerequisites

  • Recent Rust compiler

Usage

$ cargo run path/to/something.exe
$ cargo run path/to/something.dll