Dec 142017
 
For Windows 3; Analyze WIN .EXE files and show API linkage.
File NEWEXE.ZIP from The Programmer’s Corner in
Category Windows 3.X Files
For Windows 3; Analyze WIN .EXE files and show API linkage.
File Name File Size Zip Size Zip Type
NEWEXE.DOC 5947 2551 deflated
NEWEXE.EXE 55073 28405 deflated

Download File NEWEXE.ZIP Here

Contents of the NEWEXE.DOC file


NEWEXE
by:Thuan-Tit Ewe
August 29, 1991

NEWEXE, while not intended to totally replace EXEHDR, will however
provide more detailed information about the Windows NE executable file
than ever before. You get names of all external functions dynamically
linked as well as all exported ones.

With NEWEXE you can find all documented and undocumented entries into
Windows.



Options galore:
---------------
/t[types]
Valid types are:
'h' Header
'r' Resource
'e' Entry table
's' Segment table
'l' Relocation tables
'b' Resident table
'n' Non-resident table
'a' All (default)
o To selectively display sections of the file. The default action
of NEWEXE if this option is not specified is all.

/rv Resource verbose
o Display the name directory of resources.

/i Suppress display of internal relocations
/c Outputs C tables
o See Q&A below for explanation.

/heap:(0-ffffh)
/stack:(0-ffffh)
o Changes the default heap and stack size. See Microsoft's EXEHDR
documentation.

/verbose
o Verbose option. Will display a little bit more information.

/help
o Displays options.

/l Displays license information.
o Self explanatory.



Resources:
----------
Type:800f, offset: 10240, size:512, flags:1c30, id:8001 Name directory
Type:8004, offset: 10752, size:512, flags:1c30, id:8001 Menu template

Above are 2 sample lines that you would see in a typical output. They are
pretty self explanatory except 'Name directory' where a resource names are
kept.



Relocations:
------------
Relocations are display in groups that pertain to particular segments. They
are normally in the format of:

Relocation_item Relocation_type Fixup_address Target

Below are some examples of relocation output as well as explanation
NRSPTR NRRINT 6733 Fixed: 1:0x5349
Relocation to a fixed segment

NRSPTR NRRORD 23eb Module:KERNEL.8 LOCALLOCK
Import from KERNEL.8

NRSPTR NRRINT 06ab Moveable: Ordinal 84:(DRAWICON)Segm:13, offset:0x014d, globdata, exported, moveable.
Internal relocation to target that's in this executable. In this case
the target is also exported as DRAWICON

NRSPTR NRRINT 0554 Moveable: Ordinal 596:Segm:13, offset:0x07ba, moveable.
Internal relocation to segment 13:07ba



Entry table:
------------
Entry table is a weird construct when you first look at it, but in the
case of NE, it is the centerpiece for the whole executable.

It comes normally in two formats which I'll discuss later.
The left column contain the ordinal numbers. It is implicitly numbered
so the number generated in this column is internally kept by NEWEXE.
According to what documentation I have, the Dat bit is used to determine
if it uses the Global Data. Next come the segment index and the offset
in decimal and hex.

[ 27] Exprt:1, Dat:1, Words:0, Sgm:13, Offset:1692[069c]

[448] Zero type. (448...450)
At times you will see zero type means that ordinals from 448 to 450 is
currently not used.

A point of interest is that all exported entry points come first followed
by internal ones needed for relocation.



Caveats:
--------
NEWEXE currently does not yet handle LE (Linear Executable) used as device
drivers in Windows Enhanced mode.

NEWEXE does not configure the original EXE header.

Options must be entered in whole. For example, if you want to change heap
you have to enter

newexe /stack:0x400 output.exe



Questions and answers:
----------------------
Q: I'm interested in all exported names, how can I find that out quickly?
A: Use option '/tn'
which stand for 'display type: non-resident table'
If you have a file that exports in names instead of ordinals
Use '/tb' to display resident name table.

Q: How do I find all imported function quickly?
A: Use option '/tl /i'
To display just the fixups and suppress internal fixups.

Q: Why don't I see resource names when I know my application uses them ?
A: Windows 3.0 resource names are kept in resource directory that is
not documented anywhere. To see them use '/rv' to verbose on resource.

Q: I'd like to make use of the information being dumped in my program,
how do I do that?
A: Use '/c' to dump resident and non-resident name tables in an array
initiazation form for C language that you can compile and link. In
fact, NEWEXE was built using this mechanism.

Q: Why does it take so long to dump system DLLs like USER.EXE ?
A: NEWEXE will take some time to scan for the exported name so
that it can print a reasonable output for relocations into those
exported names. This will only pose a minor irritation if you dump
a big DLL, otherwise don't worry about it.
Use '/i' to suppress printing of internal relocations if you don't
care about them.



License information:
--------------------
You are free to use, copy and distribute NEWEXE v0.01 for noncommercial
use IF:
NO FEE IS CHARGED FOR USE, COPYING OR DISTRIBUTION.
IT IS NOT MODIFIED IN ANY WAY.
IT IS ACCOMPANIED BY ITS PROPER DOCUMENTATION.

This program is provided AS IS without any warranty, expressed or implied,
including but not limited to fitness for a particular purpose.

If you have any questions or comments about NEWEXE, drop me a note in
CompuServe or send them to:

CompuServe:70324,3557 Thuan-Tit Ewe
P.O. Box 1016
Capitola, CA 95010

NEWEXE and this documentation is
Copyright (C) 1991 by Thuan-Tit Ewe.


 December 14, 2017  Add comments

Leave a Reply