EXE Files

What is a .EXE file?

.EXE is a program filename extension, but not of a specific file format. As a rule, on current Windows platforms, it stands for Microsoft Portable Executable format (application, console program, service, installer, self-extracting archive etc.). The mentioned Portable Executable was designed when Windows NT was created (1993). It comes from COFF formats and includes a machine code, import/export tables, resources, relocation information, digital signatures, and .NET metadata (for managed applications).

As for older files with EXE extension, they may be MS-DOS MZ executables that are supported under DOS environment, as well as the ones for Windows 98 and previous versions. They use MZ signature in their binary format, referring thus to a developer (Microsoft engineer) named Mark Zbikowski. Most 16-bit Windows applications (as well as OS/2 ones) use NE format that contains an MZ header in addition to New Executable header used by Windows 1.0,2.,3. and by OS/2 1.0.

Some files of type EXE are self-extracting archives and/or installers and are executable themselves but can have embedded payload (such as archive compressed into ZIP, 7z, CAB and even installer NSIS, Inno setup or MSI) that can be usually extracted by archive software. To recognize file types, use the presence of MZ signature, and of e_lfanew pointer in the beginning that for PE files points to PE\0\0, for NE - on NE, and LE and LX for some OS/2 linear formats respectively.

How to open a .EXE file

Technical details

.EXE files are rarely in text form; almost all Windows variants use binary .exe starting with MZ 4D 5A at byte 0. In the MZ DOS executable file format header is e_lfanew (0x3c). This file pointer to the next format header normally points to the PE signature 50 45 00 00 in a PE executable image, followed by the COFF header, PE optional header and directories, and finally to sections. Typical sections are .text - code, .rdata for read-only data, .data - writable data and .rsrc for icons, dialogues and version. The image can optionally carry also overlay after last section (overlay - used by various installers and self-extracting packages).

The PE architecture defines executable target as, for instance, x86, x64, ARM etc., and subsystem defines whether GUI executable is meant, console, native etc. In optional headers there’s information like image base, entrypoint RVA, section alignment, file alignment, DLL flags like ASLR flag and DEP flag. Locations of imported data, exports table, TLS, relocation, Debug directories, Resources and Certificates tables in file are provided. Authenticode certificate (outside loaded image digest) uses certificate directory in optional table.

MS-DOS MZ executable files include a relocation table, header size information and initial code segments information, information of memory allocation as well. Modern 64bit Window doesn’t load NE (New Executable) files and LE/LX Linear Executable files, using the same DOS MZ executable header as base of format with additional modules table. Files .net.exe have PE format with additional clr header and metadata streams, usually containing code usually written in Common intermediate language (CIL), often along with metadata of this assembly and may also target anycpu platform or some specific platform type like x86, x64 or ARM. File may be few kilobytes in size or even hundreds of megabytes long. Common MIME type is application/vnd.microsoft.portable-executable.

How to convert .EXE files

There exists no simple method for losslessly reverting an .EXE executable into the equivalent of the source code, APK, DMG, or native applications for macOS or Linux; all of which will result in a best-effort attempt, or package re-construction at most.

Self-extraction can be easily handled using 7z x setup.exe -o./extracted, though there can be other types of payloads, such as CAB, ZIP, and 7Z inside the EXE executable file itself (as well as NSIS and/or Inno Setup setups), some of which 7-Zip software may successfully extract without running them.

.NET applications (which come with extensions .exe or .dll) may be decompiled into C# approximations using decompilers such as ILSpy and the ones made for dnSpy family. Disassembly, on the other hand, can only happen for the native PE executables with tools such as Ghidra, IDA Free and objdump, producing disassembly or pseudocode rather than a project file.

The Resource Hacker software is used to view various Windows resources from a file, namely extracting icons, dialog layouts, version info, manifest, bitmaps and various strings; in addition to having the capability of changing resources of a target file. GNU objcopy can dump a .text section to raw binary (though, one cannot convert a Windows EXE into ELF or Mach-O).

Common problems and fixes

"This app can’t run on your PC" is displayed when there is mismatch between processor architecture, a 16 bit MZ or NE executable launched on 64-bit versions of windows, when the target system is a lower or newer version than executable is built against and AppLocker, WDAC blocking it. Use Detect It Easy tool to analyze it and install x86, x64, ARM64 or legacy environment it was compiled under.

"The version of this file is not compatible with the version of Windows you’re running" typically applies for 16-bit DOS, Windows NE applications as well as for 64 bit binaries launched on 32-bit systems. Launch your 16-bit program inside DOSBox-X application or a virtual machine, while getting correct 32/64-bit binary on the site that offers it.

"Bad EXE format", error 193 and "%1 is not a valid Win32 application" typically indicate that the executable might be corrupt, a renamed non-EXE file, built for a different architecture or is missing the PE (Portable Executable) header, which indicates invalidness of it. Re-download it, compare with the hash given by publisher, ensure that its MZ prefix on the offset 0 is present.

"The application was unable to start correctly (0xc000007b)" is thrown when 32-bit DLLs is being used by a 64 bit program vice versa or Visual C++, DirectX runtimes are missing for the particular application. Install corresponding redistributables by downloading and reinstalling runtime provided by publisher as well as a corresponding application's build from the list of available versions.

SmartScreen displays that "Windows protected your PC" when an app was launched from some unsigned or less reputable location. Make sure that app has been published by legitimate developer and has got Authenticode certificate as well as a proper SHA256 hash and URL on which it had been offered from. Use options provided when prompted "run" or "more info". If it shows "NSIS Error"/"The setup files are corrupted" - download them once again on HTTPS URL.

Security considerations

EXE is an executable container that runs native Windows code, managed .NET code, setup program, and runtime-decompressed payloads from resources and overlays. Always treat a unexpected attachment or downloaded file as high risk. Make sure the file name, certificate (publisher), Authenticode sign, and URL where the file comes from were checked before running it. Having a valid authenticode digital signature only assures the authenticity of the product as well as the integrity at signing the program but not its safety, as a digital certificate may become compromised.

Malware often masquerades in packers, self-unpackers, fake executables icon, files with two extensions (invoice.pdf.exe format, for example). Opening such files in 7-Zip and hex editors (Hxd, for example), static binary analysis tools like Ghidra, free IDA Free (IDA) edition, or .Net parser like ILSpy is safer than just executing. Parsers could have flaws. A sandbox approach or disposable test machine, a virtual machine, like Windows Sandbox are good approaches here, especially if a user has admin rights on his desktop environment.

History and versions

MZ executable file format was created in 1981 as an improved version of plain COM file for Microsoft DOS operating system. It allowed using relocations and more elaborate memory maps, thus having two-letter MZ identifier that is related to Microsoft programmer Mark Zbikowski. Windows OS 1.0 and OS/2 1.x by Microsoft and IBM in the 1980s chose NE format to be used with GUI 16-bit executable files and DLLs. In the 90s with the advent of OS/2 2.0 and 32-bit linear memory address space IBM and Microsoft introduced LE/LX executables. These file types later were also available in some DOS extenders or legacy OS/2 products. Microsoft Windows NT 3.1 introduced the PE format in 1993, adapting COFF concepts for Windows executables and DLLs. Later PE32+ extended PE for 64-bit Windows on x64 and ARM64.

The 2002 .NET Framework reuse of PE files containing metadata of IL and CLR assemblies means that managed applications continue to use .dll/.exe extension of Windows binaries. Microsoft provides documentation for PE/COFF format; it is however not available as standard published by international organizations like ISO.

Related formats

While DLL and many EXE files use the same PE format container, windows treat them as libraries, loaded via LoadLibrary API, and not as applications to run as separate tasks. The COM is a DOS executable file type, which does not use MZ Header format; it does not have a relocation table and uses 64-KB segmentation. It requires significantly fewer loading overheads, compared with the PE one. The .msi is Windows Installer's database format, which implies neither execution nor application. In many cases, a setup.exe is no more then bootstrapper to some MSI. Similarly, msix and appx files come as a set of deployment manifests and signed packages that is much less portable across different devices compared to raw installer .exe file. .bat/.cmd/.ps1/.vbs are interpreted script text files running on cmd.exe or scripting engine. While the ELF format is used as a primary executable file type in Linux/Unix OSs and Mach O in macOS/iOS environment. The scr screensavers under Microsoft windows are usually PE files with an altered extension.