Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!wuarchive!uunet!microsoft!richgi
From: richgi@microsoft.UUCP (Richard GILLMANN)
Newsgroups: comp.windows.ms.programmer
Subject: Re: How to see the diff between a windows and dos exe file
Keywords: exe file, windows, dos
Message-ID: <71996@microsoft.UUCP>
Date: 22 Apr 91 20:24:11 GMT
References: <1275@idcapd.idca.tds.philips.nl>
Reply-To: richgi@microsoft.UUCP (Richard GILLMANN)
Organization: Microsoft Corp., Redmond WA
Lines: 18

In article <1275@idcapd.idca.tds.philips.nl> theo@idca.tds.PHILIPS.nl (T. van Hunnik) writes:
> In the MS-DOS Encyclopedia in appendix K we found a detection method
> for new executable files ("MZ" on the first two bytes; on offset 3CH the
> offset to the new executable header, which starts with "NE").
> 
> However a few days ago we found out that MS-Word for DOS has this same
> strings and is a new executable file, but no windows applications!

Segmented-executables are used for many things: Windows Apps, OS/2 apps
(both PM and character mode), ILINK'ed apps and bound apps come to mind.

You could improve your test by checking that bits 8&9 in the module
flag word are on -- this would mean either a Windows or a PM app.
If they're not on, it's a character mode (or vio graphics) app.
The Windows SDK has more details on this stuff.

Richard Gillmann
Microsoft System Languages