Contents of the NEWEXE.DOC file
August 29, 1991
NEWEXE, while not intended to totally replace EXEHDR, will however
provide more detailed information about the Windows NE executable file
than ever before. You get names of all external functions dynamically
linked as well as all exported ones.
With NEWEXE you can find all documented and undocumented entries into
Valid types are:
'e' Entry table
's' Segment table
'l' Relocation tables
'b' Resident table
'n' Non-resident table
'a' All (default)
o To selectively display sections of the file. The default action
of NEWEXE if this option is not specified is all.
/rv Resource verbose
o Display the name directory of resources.
/i Suppress display of internal relocations
/c Outputs C tables
o See Q&A below for explanation.
o Changes the default heap and stack size. See Microsoft's EXEHDR
o Verbose option. Will display a little bit more information.
o Displays options.
/l Displays license information.
o Self explanatory.
Type:800f, offset: 10240, size:512, flags:1c30, id:8001 Name directory
Type:8004, offset: 10752, size:512, flags:1c30, id:8001 Menu template
Above are 2 sample lines that you would see in a typical output. They are
pretty self explanatory except 'Name directory' where a resource names are
Relocations are display in groups that pertain to particular segments. They
are normally in the format of:
Relocation_item Relocation_type Fixup_address Target
Below are some examples of relocation output as well as explanation
NRSPTR NRRINT 6733 Fixed: 1:0x5349
Relocation to a fixed segment
NRSPTR NRRORD 23eb Module:KERNEL.8 LOCALLOCK
Import from KERNEL.8
NRSPTR NRRINT 06ab Moveable: Ordinal 84:(DRAWICON)Segm:13, offset:0x014d, globdata, exported, moveable.
Internal relocation to target that's in this executable. In this case
the target is also exported as DRAWICON
NRSPTR NRRINT 0554 Moveable: Ordinal 596:Segm:13, offset:0x07ba, moveable.
Internal relocation to segment 13:07ba
Entry table is a weird construct when you first look at it, but in the
case of NE, it is the centerpiece for the whole executable.
It comes normally in two formats which I'll discuss later.
The left column contain the ordinal numbers. It is implicitly numbered
so the number generated in this column is internally kept by NEWEXE.
According to what documentation I have, the Dat bit is used to determine
if it uses the Global Data. Next come the segment index and the offset
in decimal and hex.
[ 27] Exprt:1, Dat:1, Words:0, Sgm:13, Offset:1692[069c]
 Zero type. (448...450)
At times you will see zero type means that ordinals from 448 to 450 is
currently not used.
A point of interest is that all exported entry points come first followed
by internal ones needed for relocation.
NEWEXE currently does not yet handle LE (Linear Executable) used as device
drivers in Windows Enhanced mode.
NEWEXE does not configure the original EXE header.
Options must be entered in whole. For example, if you want to change heap
you have to enter
newexe /stack:0x400 output.exe
Questions and answers:
Q: I'm interested in all exported names, how can I find that out quickly?
A: Use option '/tn'
which stand for 'display type: non-resident table'
If you have a file that exports in names instead of ordinals
Use '/tb' to display resident name table.
Q: How do I find all imported function quickly?
A: Use option '/tl /i'
To display just the fixups and suppress internal fixups.
Q: Why don't I see resource names when I know my application uses them ?
A: Windows 3.0 resource names are kept in resource directory that is
not documented anywhere. To see them use '/rv' to verbose on resource.
Q: I'd like to make use of the information being dumped in my program,
how do I do that?
A: Use '/c' to dump resident and non-resident name tables in an array
initiazation form for C language that you can compile and link. In
fact, NEWEXE was built using this mechanism.
Q: Why does it take so long to dump system DLLs like USER.EXE ?
A: NEWEXE will take some time to scan for the exported name so
that it can print a reasonable output for relocations into those
exported names. This will only pose a minor irritation if you dump
a big DLL, otherwise don't worry about it.
Use '/i' to suppress printing of internal relocations if you don't
care about them.
You are free to use, copy and distribute NEWEXE v0.01 for noncommercial
NO FEE IS CHARGED FOR USE, COPYING OR DISTRIBUTION.
IT IS NOT MODIFIED IN ANY WAY.
IT IS ACCOMPANIED BY ITS PROPER DOCUMENTATION.
This program is provided AS IS without any warranty, expressed or implied,
including but not limited to fitness for a particular purpose.
If you have any questions or comments about NEWEXE, drop me a note in
CompuServe or send them to:
CompuServe:70324,3557 Thuan-Tit Ewe
P.O. Box 1016
Capitola, CA 95010
NEWEXE and this documentation is
Copyright (C) 1991 by Thuan-Tit Ewe.