CODEWITHSUNDEEP
windowsexecutable-format
pts
pts

Reputation: 87321

How to detect architecture of an LE (linear executable) file?

What instruction set architecture does an LE (linear executable) file have? The linked article says: mixed 16/32 bit.

  1. Does it mean that the same LE file can contain 16-bit and 32-bit code?
  2. How do I detect whether it contains 16-bit (8086) code?
  3. How do I detect whether it contains 32-bit (i386) code?

Please note that I'm aware of the CPU type field (see here) which can distinguish between 80286 and i386 (80386). However, I interpret this as a CPU type requirement, so this doesn't specify the architecture, e.g. the hex 40 is valid in both: it means inc ax in 16-bit code and it means inc eax in 32-bit code, and both can be executed by a 80386 CPU. I'm interested in what hex 40 means in the code of an LE file.

Upvotes: 0

Views: 81

Answers (1)

pts
pts

Reputation: 87321

I was able to find https://www.program-transformation.org/Transform/PcExeFormat , based on which the answer is the following.

If object flag bit 13 in the object table entry is set, then it's 32-bit, otherwise it's 16-bit.

In the executable entry table, LE flag bit 1 of LX bundle type byte distinguishes between 16-bit and 32-bit.

Since there can be multiple entries in these tables, a single LE or LX file may contain both 16-bit and 32-bit code.

Upvotes: 1

Related Questions