execfmt.dat

.fmt:aout
.title:UNIX a.out file format
.title_comment:(for <u>a</u>ssembly <u>out</u>put)
.magic:various: <tt><sub>x</sub>0107</tt>, <tt><sub>x</sub>0108</tt>, <tt><sub>x</sub>010B</tt>, <tt><sub>x</sub>0105</tt>, <tt><sub>x</sub>00CC</tt>, <tt><sub>x</sub>0101</tt>, <tt><sub>x</sub>0109</tt>, <tt><sub>x</sub>010C</tt>, <tt><sub>x</sub>010D</tt>, <tt><sub>x</sub>010E</tt>, <tt><sub>x</sub>0111</tt>, <tt><sub>x</sub>0118</tt>, <tt><sub>x</sub>0119</tt>, <tt><sub>x</sub>011F</tt>
.arch:DEC PDP-11, DEC VAX, Motorola 68000, Intel 386 and others (Interdata 7/32, IBM 370, MIPS, SPARC)
.sys:PDP-11 UNIX version 1 (old format)
.sys_date_earliest:1969
.sys_date_latest:1971-11-03
.sys:PDP-11 UNIX version 2
.sys_date:1972-06-12
.sys:UNIX/32V
.sys_before:System V
.sys_date:1979-06
.sys:SunOS 1.0
.sys_date:1983-11
.sys:DJGPP DOS extender
.sys_before:version 1.11
.sys_date:1989
.sys:Linux
.sys_before:version 1.2
.sys_date:1991-09-17
#.sys_end:1995-03
.sys:NetBSD
.sys_date:1993-04-19
.sys_before:version 1.5
#.sys_end:2000-12
.sys:FreeBSD up to 2.2
.sys_date:1993-11-01
.sys_until:version 2.2
#.sys_end:1998-10
.sys:<a href="http://pdos.sourceforge.net/">PDOS32</a> 0.10
.sys_date:1997-05-18

#.fmt/2:aoutv1
#.title:UNIX v1 PDP-11 a.out file format
#.title_comment:(for <u>a</u>ssembly <u>out</u>put)
#.magic:<tt><sub>x</sub>0105</tt>
#.arch:usually DEC PDP-11
#.sys:PDP-11 UNIX version 1
#.sys_date_earliest:1969
#.sys_date_latest:1971-11-03
#
#.fmt/2:aout16
#.title:UNIX v2 PDP-11 a.out file format
#.title_comment:(for <u>a</u>ssembly <u>out</u>put)
#.magic:various: <tt><sub>x</sub>0107</tt>, <tt><sub>x</sub>0108</tt>, <tt><sub>x</sub>010B</tt>, <tt><sub>x</sub>0101</tt>, <tt><sub>x</sub>0105</tt>, <tt><sub>x</sub>0109</tt>, <tt><sub>x</sub>0118</tt>, <tt><sub>x</sub>0119</tt>, <tt><sub>x</sub>011F</tt>
#.arch:various, typically DEC VAX, Motorola 68000
#.sys:PDP-11 UNIX version 2
#.sys_date:1972-06-12
#
#.fmt/2:aout32
#.title:UNIX 32-bit a.out file format
#.magic:various: <tt><sub>x</sub>0107</tt>, <tt><sub>x</sub>0108</tt>, <tt><sub>x</sub>010B</tt>, <tt><sub>x</sub>00CC</tt>, <tt><sub>x</sub>0101</tt>, <tt><sub>x</sub>0105</tt>, <tt><sub>x</sub>0109</tt>, <tt><sub>x</sub>010C</tt>, <tt><sub>x</sub>010E</tt>, <tt><sub>x</sub>0111</tt>, <tt><sub>x</sub>011F</tt>
#.arch:various, typically DEC VAX, Motorola 68000
#.sys:UNIX/32V
#.sys_before:System V
#.sys_date:1979-06
#.sys:SunOS 1.0
#.sys_date:1983-11
#.sys:DJGPP DOS extender
#.sys_before:version 1.11
#.sys_date:1989
#.sys:Linux
#.sys_before:version 1.2
#.sys_date:1991-09-17
##.sys_end:1995-03
#.sys:NetBSD
#.sys_date:1993-04-19
#.sys_before:version 1.5
##.sys_end:2000-12
#.sys:FreeBSD up to 2.2
#.sys_date:1993-11-01
#.sys_until:version 2.2
##.sys_end:1998-10
#.sys:<a href="http://pdos.sourceforge.net/">PDOS32</a> 0.10
#.sys_date:1997-05-18
#.inf:32-bit extension of <a href="#aout16">16-bit a.out</a>

.fmt:aout_minix
.title:MINIX a.out file format
.magic:<tt><sub>x</sub>01<sub>x</sub>03</tt>
.arch:various, typically Intel 8086/80286, Intel 80386, Motorola 68000, SPARC
.sys:MINIX 1.0
.sys_date:1987
.sys_before:version 3.2
.sys:ELKS (Linux-8086)
.sys_date:1999-05-20
.inf:extension of <a href="#aout16">16-bit a.out</a>

.fmt:coff
.title:COFF format
.title_comment:(Common Object File Format)
.title_target:UNIX
.magic:various, encodes architecture
.arch:various
.sys:UNIX System V Release 1.0
.sys_date:1983-01
.sys:Concurrent DOS 68K
.sys_date:1985
.sys:FlexOS 386
.sys_date:1987-06
.sys:DJGPP DOS extender version 1.11
.sys_date:Around 1992
.inf:replaced <a href="#aout32">a.out</a>

.fmt:xout
.title:XENIX x.out file format
.magic:<tt><sub>x</sub>0206</tt>
.arch:various, including PDP-11, Z8000, Intel 8086/80186/80286 and Intel 80386, Motorola 68000, Zilog Z80, VAX, NS32000
.sys:XENIX Release 3
.sys_date:1984

.fmt:macho
.title:Mach-O format
.title_comment:(for Mach object)
.title_target:UNIX
.magic:<tt><sub>x</sub>FEEDFACE</tt> for 32-bit, <tt><sub>x</sub>FEEDFACF</tt> for 64-bit, <tt><sub>x</sub>CA<sub>x</sub>FE<sub>x</sub>BA<sub>x</sub>BE</tt> for fat binary
.arch:various
.sys:Mach
.sys_date:not before 1985
.sys:NeXTSTEP 0.8
.sys_date:1988-10-12
.sys:OSF/1<sup>?</sup>
.sys_date:1992-01
.sys:Mac OS X/macOS, iOS
.sys_date:2001-03-24
.inf:replaced <a href="#aout32">a.out</a> on UNIX, <a href="#pef">PEF</a> on Mac OS X

.fmt:elf
.title:ELF format
.title_comment:(Executable and Linkable Format)
.title_target:UNIX
.ext:<tt>.exe</tt> for OS/2 Warp PowerPC Edition
.magic:<tt>"\x<sup>7F</sup>ELF"</tt>
.arch:various
.sys:System V Release 4.0 (replacing <a href="#coff">COFF</a>)
.sys_date:1988-10-18
.sys:BeOS Developer Release 4 for AT&T Hobbit
.sys:Linux 1.2 (replacing <a href="#aout32">a.out</a>)
.sys_date:1995-03
.sys:OS/2 Warp PowerPC Edition (replacing <a href="#le">LE</a>)
.sys_date:1995-12
.sys:PowerUP for Amiga (replacing <a href="#hunk">Hunk</a>)
.sys_date:1997-05-12<sup>?</sup>
.sys:AmigaOS 4.0 (replacing and complementing <a href="#hunk">Hunk</a>)
.sys_date:2004-04
.sys:FreeBSD 3.0 (replacing <a href="aout32">a.out</a>)
.sys_date:1998-10
.sys:BeOS Release 4 on Intel 80386 (replacing <a href="#pe">PE</a>)
.sys_date:1998-11-04
.sys:NetBSD 1.5 (replacing <a href="aout32">a.out</a>)
.sys_date:2000-12
.sys:MINIX 3.2.0 (replacing <a href="aout_minix">a.out for MINIX</a>)
.sys_date:2012-02-29
.inf:replaced <a href="#coff">COFF</a>

.fmt:cpm
.title:flat binary
# more useful to repeat that it is for CP/M
.title_comment:CP/M
.ext:<tt>.com</tt>, but <tt>.r</tt> for Human68k
.arch:usually Intel 8080, Zilog Z80 (CP/M-80), Intel 8086 (MS-DOS) or Motorola 68000 (Human68k), but MOS 6502 (OUP/M, DOS/65), PDP-11 (DX-DOS) are also possible
.sys:CP/M-80 and compatibles
.sys_date:1974
.sys:MS-DOS 1.0 and compatibles
.sys_date:1981-08-12
.sys:<a href="https://archive.org/details/OUPMA6502OperatingSystem/mode/2up">OUP/M</a>
.sys_date:1983
.sys:Human68k
.sys_date:1987-03-28
.sys:<a href="https://web.archive.org/web/20200224162400/http://www.vcfed.org/forum/archive/index.php/t-10780.html">DOS/65</a>
.sys_date:1989
.sys:DX-DOS
.sys_date:1995

.fmt:cmd_flex
.title:FLEX executable
.title_comment:(.CMD)
.ext:<tt>.cmd</tt>
.magic:<tt><sub>x</sub>02</tt>
.arch:Motorola 6800, Motorola 6809
.sys:FLEX
.sys_date:1976

.fmt:prl
.title:Page relocatable
.title_target:CP/M
.ext:<tt>.prl</tt> (Page Relocatable) for programs (replaced by <tt>.cmd</tt> in MP/M-86)
.ext:<tt>.spr</tt> (System PRL) for system modules (replaced by <tt>.obj</tt> in CP/M-86 Plus, <tt>.mpm</tt> in MP/M-86, <tt>.con</tt> in Concurrent CP/M-86)
.ext:<tt>.rsp</tt> for resident system processes
.ext:<tt>.brs</tt> for banked RSP (MP/M 2)
.ext:<tt>.ovl</tt> for overlays (replaced by <tt>.ovr</tt> in CP/M-86)
.ext:<tt>.rsx</tt> for resident system extensions
.ext:<tt>.rsm</tt> for resident system modules (RSXs backported to CP/M 2)
.ext:<tt>.fid</tt> for Amstrad CP/M field installable device drivers
.magic:<tt><sub>x</sub>00</tt>
.arch:Intel 8080 and Zilog Z80
.sys:MP/M-80
.sys_date:1979
.sys:CP/M-80 Plus
.sys_date:1983
.inf:coincidentally similar to <a href="#aout">a.out</a>

.fmt:cpm3
.title:CP/M-80 Plus executable
.title_comment:(.COM)
.title_target:CP/M
.ext:<tt>.com</tt>
.magic:<tt><sub>x</sub>C9</tt>
.arch:Intel 8080 and Zilog Z80
.sys:CP/M-80 Plus
.sys_date:1983

.fmt:cmd
.title:CP/M-86 executable
.title_comment:(.CMD)
.title_target:PC
.ext:<tt>.cmd</tt> for applications
.ext:<tt>.sys</tt> for drivers
.ext:<tt>.mpm</tt> (MP/M-86) or <tt>.con</tt> (Concurrent CP/M-86, Concurrent DOS, Multiuser DOS) for system modules
.ext:<tt>.rsp</tt> for resident system processes
.ext:<tt>.ovr</tt> for overlays
.ext:<tt>.rsx</tt> for resident system extensions
.ext:<tt>.186</tt> for FlexOS 186 applications
.ext:<tt>.286</tt> for FlexOS 286 applications
.ext:<tt>.srl</tt> for FlexOS 286 shared run-time libraries
.arch:Intel 8086/80286
.sys:MP/M-86 2.0
.sys_date:1981-09-25
.sys:CP/M-86 1.0
.sys_date:1981-11
.inf:replaced <a href="#flat">.com files</a>, coincidentally similar to <a href="#aout">a.out</a>

.fmt:68k
.title:CP/M-68K executable
.title_comment:(.68K)
.title_target:Atari etc.
.ext:<tt>.68k</tt> CP/M-68K and Concurrent DOS 68K executables (Concurrent DOS also uses COFF)
.ext:<tt>.rel</tt> CP/M-68K relocatable executables
.ext:<tt>.prg</tt> for GEMDOS text applications, TOS graphical applications
.ext:<tt>.app</tt> for GEMDOS and Atari TOS graphical applications
.ext:<tt>.acc</tt> for GEMDOS and Atari TOS graphical accessories
.ext:<tt>.tos</tt> for Atari TOS text applications
.ext:<tt>.ttp</tt> for Atari TOS text applications that take parameters
.ext:<tt>.gtp</tt> for Atari TOS (since version 2.0) graphical applications that take parameters
.ext:<tt>.slb</tt> for shared libraries for <a href="https://en.wikipedia.org/wiki/MagiC">MagiC</a> (Atari TOS extension)
.ext:<tt>.z</tt> for Human68k
.magic:<tt><sub>x</sub>60<sub>x</sub>1A</tt> for contiguous executables (all of them)
.magic:<tt><sub>x</sub>60<sub>x</sub>1B</tt> for non-contiguous executables (CP/M-68K only)
.magic:<tt><sub>x</sub>60<sub>x</sub>1C</tt> for contiguous executables with crunched relocations (Concurrent DOS 68K only)
.arch:Motorola 68000
.sys:CP/M-68K
.sys_date:1982
.sys:GEMDOS, GEM, Concurrent DOS 68K
.sys_date:1985
.sys:Atari TOS
.sys_date:1985-11-20
.sys:Human68k
.sys_date:1987-03-28
.inf:<a href="#aout">a.out</a>

.fmt:z8k
.title:CP/M-8000 executable
.title_comment:(.Z8K)
.ext:<tt>.z8k</tt>
.magic:<tt><sub>x</sub>EE<sub>x</sub>00</tt>, <tt><sub>x</sub>EE<sub>x</sub>01</tt>, <tt><sub>x</sub>EE<sub>x</sub>02</tt>, <tt><sub>x</sub>EE<sub>x</sub>03</tt>, <tt><sub>x</sub>EE<sub>x</sub>06</tt>, <tt><sub>x</sub>EE<sub>x</sub>07</tt>, <tt><sub>x</sub>EE<sub>x</sub>0A</tt>, <tt><sub>x</sub>EE<sub>x</sub>0B</tt>
.arch:Zilog Z8000
.sys:CP/M-8000
.sys_date:1982
.inf:<a href="#aout">a.out</a>

.fmt:hu
.title:Human68k executable
.title_comment:(HU)
.title_target:X68000
.ext:<tt>.x</tt>
.magic:<tt>"HU"</tt>
.arch:Motorola 68000
.sys:Human68K, SX-Window
.sys_date:1987-03-28
.inf:<a href="#aout">a.out</a>, <a href="#68k">CP/M-68K</a>, <a href="#mz">MS-DOS</a>

.fmt:mz
.title:MZ executable
.title_comment:(named after Mark Zbikowski)
.title_target:PC
.ext:<tt>.exe</tt>, sometimes <tt>.com</tt> for console applications (<tt>.com</tt> extension supported since MS-DOS 2.0)
.ext:<tt>.ovl</tt> for overlays
.ext:<tt>.app</tt> for GEM graphics applications
.ext:<tt>.acc</tt> for GEM graphics accessories
.ext:<tt>.exm</tt> for HP 100LX/200LX System Manager modules
.magic:<tt>"MZ"</tt> (reportedly also <tt>"ZM"</tt> in early versions)
.magic:<tt>"DL"</tt> for HP 100LX/200LX System Manager modules
.arch:Intel 8086
.sys: MS-DOS 1.0 and compatibles
.sys_date:1981-08-12
.inf:coincidentally similar to <a href="#aout">a.out</a>

.fmt:ne
.title:New executable
.title_comment:(NE)
.title_target:PC

.ext:<tt>.exe</tt>, <tt>.dll</tt> for OS/2 libraries (Multitasking MS-DOS and usually 16-bit Windows uses <tt>.exe</tt> for libraries as well)
.magic:<tt>"NE"</tt> (<tt>"DX"</tt> for DOS/16M DOS extender)
.arch:Intel 8086/80286
.sys:Windows 1.0
.sys_date:1985-11-20
.sys:Multitasking MS-DOS 4.0
.sys_date:1986
.sys:OS/2 1.0
.sys_date:1987-12
.sys:Rational Systems DOS/16M DOS extender
.sys:Phar Lap 286|DOS-Extender
.inf:replaced the <a href="#mz">MZ</a> format

.fmt:le
.title:Linear executable
.title_comment:(LE, LX)
.title_target:PC
.ext:<tt>.exe</tt>, <tt>.dll</tt> for libraries, <tt>.386</tt> for Windows/386 virtual device drivers, <tt>.vxd</tt> for Windows 95 virtual device drivers and later
.magic:<tt>"LE"</tt> or <tt>"LX"</tt> for OS/2
.arch:various, mostly Intel 80386
.sys:Windows/386 drivers (LE)
.sys_date:probably 1987-09
.sys:Windows 3.0 and Windows 95 drivers (LE)
.sys_date:1990-05-22
.sys:Rational Systems DOS/4G DOS extender (LE)
.sys_date:1991-07
.sys:OS/2 2.0 beta (LE)
.sys:OS/2 2.0 Limited Availability (LX)
.sys_date:1991-10
.sys:EMX DOS extender (LX)
.inf:inspired by and replaced the <a href="#ne">NE format</a>, extended to 32-bit

.fmt:pe
.title:Portable executable
.title_comment:(PE)
.title_target:PC
.ext:<tt>.exe</tt>, <tt>.dll</tt> for libraries, etc.
.magic:<tt>"PE"</tt> (<tt>"PL"</tt> for Phar Lap)
.arch:various, including Intel 80386
.sys:Windows NT 3.1
.sys_date:1993-09-27
.sys:Windows 95 (4.0)
.sys_date:1995-08-24
.sys:BeOS Release 3 for Intel 80386
.sys_date:1998-03
.sys:Phar Lap TNT DOS-Extender
.sys:HX-DOS extender
.inf:extension of <a href="#coff">COFF</a>, replaced and likely inspired by the <a href="#ne">NE format</a>

.fmt:mp
.title:MP/MQ executable
.title_comment:
.title_target:Phar Lap DOS extenders
.ext:<tt>.exp</tt>, <tt>.exe</tt> with MZ stub, <tt>.rex</tt> with relocations
.magic:<tt>"MP"</tt>, <tt>"MQ"</tt> with relocations
.arch:Intel 80386
.sys:Phar Lap 386|DOS-Extender
.sys_date:1986-08
.sys:FM Towns OS (via Phar Lap 386|DOS-Extender)
.inf:<a href="#mz">MZ</a>

.fmt:bw
.title:BW executable
.title_target:Rational Systems DOS/16M DOS extender
.ext:<tt>.exp</tt>, <tt>.exe</tt> with MZ stub
.magic:<tt>"BW"</tt>
.arch:Intel 80286
.sys:Rational Systems DOS/16M DOS extender
.sys_date:1987-07
.inf:<a href="#mz">MZ</a>

.fmt:xp
.title:XP executable
.title_target:A. I. Architects/Ergo OS/286 DOS extender
.ext:<tt>.exp</tt>, <tt>.exe</tt> with MZ stub
.magic:<tt>"XP"</tt> for Intel 80286, unknown for Intel 80386
.arch:Intel 80286, Intel 80386
.sys:Ergo OS/286, probably Ergo OS/386 as well
# unsure
.sys_date:1988
.inf:<a href="#mz">XP</a>

.fmt:p3
.title:P2/P3 executable
.title_target:Phar Lap DOS extenders
.ext:<tt>.exp</tt>, <tt>.exe</tt> with MZ stub
.magic:<tt>"P2"</tt> for Intel 80286, <tt>P3</tt> for Intel 80386
.arch:Intel 80286, Intel 80386
.sys:Phar Lap 386|DOS-Extender
.sys:FM Towns OS (via Phar Lap 386|DOS-Extender)
# unsure: 286|DOS-Extender came out in 1991-05 which is probably the first version with P2
.sys_date:1991
.inf:<a href="#mz">MP</a>

.fmt:rsrc
.title:Macintosh resource
.title_target:Apple
.arch:binary, Motorola 68000
.sys:System 1 for Macintosh 128K (Mac OS)
.sys_date:1984-01-24

# avoid replacing the macintosh entry in TOC with the following one
.ignore_toc_entries:yes

.fmt/2:apple
.title:AppleSingle/AppleDouble container format
.ext:<tt>.adf</tt> for AppleDouble stored on MS-DOS, but usually a prefix with <tt>%</tt> (UNIX), <tt>R.</tt> (ProDOS), <tt>._</tt> (Mac OS X/macOS)
.magic:<tt><sub>x</sub>00<sub>x</sub>05<sub>x</sub>16<sub>x</sub>00</tt> for AppleSingle, <tt><sub>x</sub>00<sub>x</sub>05<sub>x</sub>16<sub>x</sub>07</tt> for AppleDouble
.arch:binary, Motorola 68000
.sys:A/UX
.sys_date:1988-02

.fmt/2:macbin
.title:MacBinary format
.ext:<tt>.bin</tt> or <tt>.macbin</tt> or <tt>.mbin</tt>
.arch:binary, Motorola 68000
.sys:Mac OS
#.sys_date: # TODO

.fmt:gsos_omf
.title:Object Module Format
.title_comment:for Apple computers
.arch:MOS 6502, WDC 65C816
.sys:ORCA/M 4.0 (version 0)
.sys:ORCA/M 4.1 (version 1, 8/16-bit)
.sys_date:around 1986
.sys:ProDOS 16, GS/OS
.sys_date:1986

.fmt:pef
.title:Preferred Executable Format
.title_comment:(PEF)
.title_target:Macintosh
.magic:<tt>"Joy!"</tt>
.arch:Motorola 68000, PowerPC
.sys:System 7.1.2 for Power Macintosh 6100
.sys_date:1994-03-14
.sys:BeOS Developer Release 6 on PowerPC (replacing <a href="#elf">ELF</a>)
.sys_date:1996-01
.inf:partially replaced <a href="#mac">Macintosh CODE resources</a>, based on <a href="#coff">XCOFF</a>

.fmt:hunk
.title:Hunk executable
.title_target:Amiga
.magic:<tt><sub>x</sub>00<sub>x</sub>00<sub>x</sub>03<sub>x</sub>F3</tt>
.arch:Motorola 68000, PowerPC for WarpUp (1997)
.sys:TRIPOS<sup>?</sup>
.sys_date:1978
.sys:AmigaOS 1.0
.sys_date:1985-07-23
.sys:WarpOS
.sys_date:1997
.sys:AmigaOS 4.0 (alongside <a href="#elf">ELF</a>)
.sys_date:2004-04
.inf:similar concepts to <a href="#aout">a.out</a>

.fmt:adam
.title:Adam Seychell's DOS32 executable
#.title_target:adam
.ext:<tt>.exe</tt>
.magic:<tt>"Adam"</tt>, <tt>"DLL "</tt>
.arch:Intel 80386
.sys:Adam Seychell's DOS32 extender
# based on the copyright, not sure
.sys_date:1994
.sys:WDOSX
.sys:DX64

# TODO: "D3X1", "Flat"/"LV"

DESCRIPTIONS

######## a.out

TITLE aout:UNIX a.out file format

SECTION :a.out header

SECTION 1/:Magic numbers

> The first word in an a.out file contains a 16-bit magic number, which specifies how the file should be processed, linked and loaded. The types and values have evolved through the various branches of UNIX-like systems.

> The first versions of UNIX were produced by AT&T for the 16-bit PDP-11. Later these were ported to various 32-bit architectures, most notably the VAX, Motorola 68000 and Intel 80386. The AT&T versions progressed from version 1 to 7, after which UNIX was commercialized and sold as System III and then System V.

> The other important branch are the BSD distributions. In this table we see mentions of versions 2.11BSD, which supported all Version 7 formats, then 3BSD, 4.1cBSD, after which the sources were reused by FreeBSD and NetBSD, OpenBSD. Linux is currently the most widely used UNIX-like system.

Magic	Systems	Introduced	Dropped	Description
0x00CC	32	NetBSD 0.9<br>FreeBSD 2.0<br>Linux 0.99.13		(QMAGIC) compact demand load format
0x0101	16, 32	System III		UNIX/RT "lpd"
0x0105	16	Version 1	Version 2	Version 1 format
0x0105	16, 32	Version 7	4.1cBSD	overlay
0x0107	16, 32	Version 2		(OMAGIC) normal
0x0108	16, 32	Version 4		(NMAGIC) read-only text
0x0109	16, 32	Version 6	4.1cBSD	separated instruction and data
0x010B	16, 32	3BSD		(ZMAGIC) demand paged
0x010C	32	NetBSD		demand paged pure
0x010C	32	?		(SPRITE_ZMAGIC)
0x010C	32	NS16032		(XMAGIC) demand load (like ZMAGIC), locations 0-1023 unmapped
0x010D	32	?		(UNIX_ZMAGIC)
0x010E	32	NetBSD		readable demand paged pure
0x0111	32	Linux 0.96c		(CMAGIC) Linux core dump
0x0118	16	2.11	3BSD	overlay, non-separate
0x0119	16	2.11	3BSD	overlay, separate
0x011F	16, 32	System V		system overlay, separated instruction and data

> The following sections will discuss the layout of the headers of the various versions.

SECTION 1/:UNIX v1 PDP-11 a.out header

> Version 1 had a different header format from later versions.

@00	i16le	0x0105
@02	i16le	Size of the combined program text (code) and initialized data segment
@04	i16le	Size of the symbol table
@06	i16le	Relocation bits
@08	i16le	Size of uninitialized data (bss), not stored in binary
@0A	i16le	unused

SECTION 1/:UNIX 16-bit PDP-11 a.out header

> This format was introduced in Version 2 and targetted the PDP-11 architecture.

> The 16-bit header format evolved through various branches. Version 6 and 7 is the last common version, then it evolved separately at BSD (from 2.11BSD on) and AT&T. Version 7 was followed by System III then System V. Internally, Version 7 evolved to Version 8, 9, 10, separately from the commercial branch. These were allegedly based on the 4.1cBSD codebase and later, but the 16-bit a.out format is more similar to the commercial versions.

@00	i16le	Magic number
		=0x0101	UNIX/RT "lpd"{TUHS} (System III)
		=0x0105	overlay{TUHS} (around Version 7, dropped support in 4.1cBSD{TUHS})
		=0x0107	(OMAGIC) normal
		=0x0108	(NMAGIC) read-only text
		=0x0109	Separated instruction and data (dropped support in 4.1cBSD{TUHS})
		=0x010B	(ZMAGIC) demand paged separated instruction and data (since 3BSD{TUHS})
		=0x0118	2.11BSD overlay, non-separate (dropped support in 3BSD{TUHS})
		=0x0119	2.11BSD overlay, separate (dropped support in 3BSD{TUHS})
		=0x011F	system overlay, separated I&D (since System V)
@02	i16le	Size of program text (code)
@04	i16le	Size of initialized data
@06	i16le	Size of uninitialized data (bss), not stored in binary
@08	i16le	Size of symbol table
@0A	i16le	Entry location{TUHS}, always 0 before version 4{UNIX2}
@0C	i16le	reserved (stack required in version 2 and 3{UNIX2})<br>(System III) environment stamp{TUHS}
@0E	i16le	Non-zero if relocations have been suppressed<br>Xinu uses the least significant byte to mark Version 6 compatibility, and the most significant byte for its own flag{TUHS}

> Xenix also uses the System 7 format.{XENIX}

> Overlays in 2.9BSD have an extended header with the following fields:

@10	i16le	Maximum size of overlays
@12	i16le[7]	Size of each overlay

> They are extended in 2.11BSD to 15 overlays:

@10	i16le	Maximum size of overlays
@12	i16le[15]	Size of each overlay

> Since System V, the final fields are slightly altered:{TUHS}

@0C	i8	reserved
@0D	i8	High bits of size of program text
@0E	i8	Non-zero if relocations have been suppressed
@0F	i8	Environment stamp
@10	i32le	filler (only Version 8 and later)

SECTION 1/:UNIX 32-bit a.out header

> The first version was created for UNIX/32V for the VAX (little endian). It was later extended to other 32-bit targets as well. By System V, all 32-bit versions switched to COFF except for the IBM 370 (the Interdata 7/32 port was apparently not maintained). However, competitors to AT&T such as SunOS and the BSD variants still kept using the format.

> While most formats had a similar layout, the first word was often subdivided into various fields for machine type and flags. Most variants use the native byte order to store the values, which further complicates determination of the file type.

SECTION 2/:UNIX/32V for VAX

> The entries were extended from the 16-bit version to full 32 bits. Also the last two fields were replaced with the size of the relocation section for text and initialized data, respectively.

@00	i32	Magic number
		=0x00CC	(QMAGIC) compact demand load format (Linux, FreeBSD{https://github.com/freebsd/freebsd-legacy/commit/2469c867a164210ce96143517059f21db7f1fd17|<sup title='since 1994-05-25'>*</sup>}, NetBSD{http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/sys/exec.h?rev=1.2&content-type=text/x-cvsweb-markup|<sup title='since 1993-04-15'>*</sup>}, OpenBSD){TUHS}
		=0x0101	UNIX/RT "lpd" (System III)
		=0x0105	overlay (dropped support in 4.1cBSD)
		=0x0107	(OMAGIC) normal (used by PDOS32 before switching to PE)
		=0x0108	(NMAGIC) read-only text
		=0x0109	separated instruction and data (dropped support in 4.1cBSD)
		=0x010B	(ZMAGIC) demand paged separated instruction and data (since 3BSD{TUHS}, used by early DJGPP)
		=0x010C	demand paged pure for NetBSD{MAGIC}
		=0x010C	(XMAGIC) demand load (like ZMAGIC), locations 0-1023 unmapped (NS16032)
		=0x010C	(SPRITE_ZMAGIC) ?
		=0x010D	(UNIX_ZMAGIC) UNIX binary compatible
		=0x010E	readable demand paged pure for NetBSD{MAGIC}
		=0x0111	(CMAGIC) core dump (Linux){LINUX1}
		=0x011F	system overlay, separated I&D (since System V and 3BSD)
@04	i32	Size of program text (code)
@08	i32	Size of initialized data
@0C	i32	Size of uninitialized data (bss), not stored in binary
@10	i32	Size of symbol table
@14	i32	Entry location
@18	i32	Size of relocations for program text
@1C	i32	Size of relocations for initialized data

SECTION 2/:System III format

> Since System III, subfields of the extended magic number field got reused for additional information. The ways this was extended was sometimes incompatible between systems. System III VAX introduced an environment stamp, similarly to System III PDP-11 (albeit at a different position). 4.3BSD-Reno also switched over to this format for non-VAX targets, possibly to stay compatible with SunOS, and early NetBSD kept this format.

@00	i32
		%0:15	Magic number
		%16:31	Environment stamp (System III VAX)<br>Machine type (4.3BSD-Reno)

SECTION 2/:Ultrix

> Ultrix had a different use for the new field:

@00	i32
		%0:15	Magic number
		%16:31	Mode (Ultrix)
			=0x0000	BSD executable
			=0x0001	System V compatible executable
			=0x0002	POSIX compatible executable

SECTION 2/:SunOS

> SunOS versions had a different format for the first word:

@00	i32
		%0:15	Magic number
		%16:23	Machine type
		%24:30	Tool version
		%31	Dynamic

> Sun 4 also offered a few additional fields:

@20	i32	Size of string segment
@24	i32	Size of sdata segment
@28	i32	Size of sdata relocations
@2C	i32	0 (spare segment)
@30	i32	0 (spare segment)
@34	i32	0 (spare segment)
@38	i32	0 (spare segment)
@3C	i32	0 (spare segment)

SECTION 2/:Linux

> Linux used the following format:

@00	i32
		%0:15	Magic number
		%16:23	Machine type
		%24:31	Flags (Linux)

SECTION 2/:The BSDs

> 4.4BSD-Lite2{44BSDLite2} used different versions for different targets: it used the UNIX/32V VAX version for VAX and Intel 386, the SunOS version (without additional fields) for SPARC, the System III format with machine type for HP300 and MIPS, and COFF for other systems.

> Since FreeBSD 2.0 and NetBSD 0.9, the following layout is used for the magic number field. FreeBSD prior to 2.0 for all ports and NetBSD prior to 0.9 on VAX and 386 used the UNIX/32V VAX format.

@00	i32
		%0:15	Magic number
		%16:25	Machine type
			=0x0000	unknown, old Sun-2
			=0x0001	SunOS, 68010+
			=0x0002	SunOS, 68020
			=0x0003	SunOS, SPARC (likely 4.0.3)
			=0x0064	Intel 80386 for PC (4.4BSD, Linux, FreeBSD, NetBSD, OpenBSD)
			=0x0065	AMD 29000 (4.4BSD)
			=0x0068	old IBM RT (OpenBSD)
			=0x0086	Intel 80386 BSD (FreeBSD, NetBSD, OpenBSD)
			=0x0087	Motorola 68K BSD with 8K pages (NetBSD, OpenBSD)
			=0x0088	Motorola 68K BSD with 4K pages (NetBSD, OpenBSD)
			=0x0089	National Semiconductor NS32532 (NetBSD, OpenBSD)
			=0x008A	Intel SPARC BSD (FreeBSD{https://github.com/freebsd/freebsd-legacy/commit/9391975ae6f63570cc6e176352c93a0d4ddadf52|<sup title='since at least 1994-09-24'>*</sup>}, NetBSD, OpenBSD)
			=0x008B	PMAX (MIPS R2000 based DECstation) (NetBSD, OpenBSD)
			=0x008C	VAX with 1K pages (NetBSD, OpenBSD)
			=0x008D	MIPS big endian (NetBSD, OpenBSD)
			=0x008D	Alpha code (NetBSD){MAGIC}
			=0x008E	MIPS (NetBSD){MAGIC}
			=0x008F	ARM6 (FreeBSD{https://github.com/freebsd/freebsd-legacy/commit/7806cc81b8b8e21bbf283fba04d3b4c941741bef|<sup title='since 2004-05-05, note ARM specific definitions were present since 2001-01-04'>*</sup>}, NetBSD, OpenBSD)
			=0x0090	Motorola 68K with 2K pages (NetBSD)
			=0x0091	SH3 (NetBSD, OpenBSD)
			=0x0094	PowerPC 64-bit big endian (NetBSD)
			=0x0095	PowerPC big endian (NetBSD, OpenBSD)
			=0x0096	VAX (NetBSD, OpenBSD)
			=0x0097	MIPS I R2000/R3000 (4.4BSD, NetBSD, Linux 1.3.48)
			=0x0097	SPARC 64-bit (OpenBSD)
			=0x0098	MIPS II (4.4BSD, NetBSD, OpenBSD)<br>({TUHS} claims R4000 but actually that was MIPS III, this should be R6000)
			=0x0099	Motorola 88K BSD (NetBSD, OpenBSD)
			=0x009A	HP PA-RISC (NetBSD, OpenBSD)
			=0x009B	SH5 with LP64 model (NetBSD)
			=0x009C	SPARC with LP64 model (NetBSD)
			=0x009D	AMD64/x86-64 (NetBSD, OpenBSD)
			=0x009E	SH5 with ILP32 model (NetBSD)
			=0x009E	MIPS 64-bit big endian (OpenBSD)
			=0x009F	Intel Itanium (NetBSD)
			=0x009F	AArch64/ARM64 (OpenBSD)
			=0x00A0	PowerPC 64-bit big endian (OpenBSD)
			=0x00A1	RISC-V 64-bit little endian (OpenBSD)
			=0x00B7	AArch64/ARM64 (NetBSD)
			=0x00B8	OpenRISC 1000 (NetBSD)
			=0x00B9	RISC-V (NetBSD)
			=0x00C8	HP200 68010 (4.3BSD, FreeBSD, NetBSD)
			=0x012C	HP300 68020+68881 (4.3BSD, FreeBSD, NetBSD)
			=0x0208	HP s500{MAGIC}
			=0x020A	HP s200 2.x{MAGIC}
			=0x020B	HP/UX HP800 (4.3BSD, FreeBSD, NetBSD), PA-RISC1.0{MAGIC}
			=0x020C	HP/UX HP200 or HP300 (4.3BSD, NetBSD), PA-RISC1.0 (OpenBSD), HP s200{MAGIC}
			=0x0210	HP700 HP-UX PA-RISC1.1 (OpenBSD){MAGIC}
			=0x0214	HP700 HP-UX PA-RISC2.0 (OpenBSD){MAGIC}
		%26:31	Flags (FreeBSD){TUHS}
		%30	Position independent code (FreeBSD, NetBSD)
		%31	Dynamic (SunOS, unknown version?, FreeBSD, NetBSD, OpenBSD)

> In NetBSD and OpenBSD, the fields are in the native byte order, except for the magic number which is in the big endian ("network") format (most significant byte first, like the Motorola 68000). As an exception, on little endian machines, little endian order is allowed if the machine type field and flags are 0.

> In FreeBSD since {https://github.com/freebsd/freebsd-legacy/commit/8abf9484aa165999b93d86ff28183b14db4f75ab|2004-06-22}, entries are always stored in the little endian format (least significant byte first, like the VAX and Intel 80386). However since {https://github.com/freebsd/freebsd-legacy/commit/2469c867a164210ce96143517059f21db7f1fd17|1994-05-25} it recognizes big endian entries for the magic number (the other entries are still read in the little endian order).
#  since at least {https://github.com/freebsd/freebsd-legacy/commit/9391975ae6f63570cc6e176352c93a0d4ddadf52|1994-09-24}

SECTION 1/:UNIX 32-bit Interdata 7/32 a.out header

> This version was introduced in Version 7 for the Interdata 7/32 (big endian). It is identical to the PDP-11 version, except that the word sizes are 32-bit and the byte order is big endian.

@00	i32be	Magic number
@04	i32be	Size of program text (code)
@08	i32be	Size of initialized data
@0C	i32be	Size of uninitialized data (bss), not stored in binary
@10	i32be	Size of symbol table
@14	i32be	Entry location
@18	i32be	reserved
@1C	i32be	Non-zero if relocations have been suppressed

SECTION 1/:UNIX 32-bit IBM 370 a.out header

> This version was introduced in System V for the IBM 370 (big endian). It is a variant of the VAX format.

@00	i32be	Magic number
@04	i32be	Stamp
@08	i32be	Size of program text (code)
@0C	i32be	Size of initialized data
@10	i32be	Size of uninitialized data (bss), not stored in binary
@14	i32be	Size of symbol table
@18	i32be	Entry location
@1C	i32be	Size of relocations for program text
@20	i32be	Size of relocations for initialized data
@24	i32be	Starting address of binary image
@28	i32be	Size of program text without padding to page boundary
@2C	i32be	Size of initialized data without padding to page boundary

SECTION 1/:UNIX 32-bit NS16032 a.out header

> There was a different version for National Semiconductor NS32K executables (little endian).

@00	i32le	Magic number
@04	i32le	Size of program text (code)
@08	i32le	Size of initialized data
@0C	i32le	Size of uninitialized data (bss), not stored in binary
@10	i32le	Size of symbol table
@14	i32le	Entry location
@18	i32le	Entry mod
@1C	i32le	Size of relocations for program text
@20	i32le	Size of relocations for initialized data
@24	i32le	Size of mod table, part of program text
@28	i32le	Size of link table, part of program text
@2C	i32le	Size of string table

SECTION 1/:Xenix b.out header

> The Xenix b.out header is very similar to the 32-bit VAX a.out header, with the field order slightly changed:

@00	i32	Magic number
@04	i32	Size of program text (code)
@08	i32	Size of initialized data
@0C	i32	Size of uninitialized data (bss), not stored in binary
@10	i32	Size of symbol table
@14	i32	Size of relocations for program text
@18	i32	Size of relocations for initialized data
@1C	i32	Entry location

SECTION 1/:HP-UX a.out header

> HP-UX used a different format for a.out.{44BSDLite2}

@00	i32be	Magic number
@04	i16be	Version ID
@06	i16be	Reserved
@08	i32be	Miscellaneous information
@0C	i32be	Size of program text (code)
@10	i32be	Size of initialized data
@14	i32be	Size of uninitialized data (bss), not stored in binary
@18	i32be[5]	Reserved
@2C	i32be	Entry location
@30	i32be[4]	Reserved

SECTION :Runtime memory layout

> This section requires further work.

REFERENCE {WT} "Warren Toomey: Apout -- Simulate PDP-11 Unix a.out binaries" https://github.com/DoctorWkt/Apout
REFERENCE {UNIX2} "UNIX Programmer's Manual, Second Edition - K. Thompson, D. M. Ritchie, June 12, 1972"
#p215
REFERENCE {TUHS} "The Unix Tree" https://www.tuhs.org/cgi-bin/utree.pl
REFERENCE {386BSD} "exec.h - 386BSD sources" https://github.com/386bsd/386bsd/blob/2.0/usr/src/kernel/include/sys/exec.h
REFERENCE {XENIX} "XENIX System V man page" https://web.archive.org/web/20230410013743/http://www.polarhome.com/service/man/?qf=a.out&tf=2&of=Xenix&sf=F
REFERENCE {LINUX1} "a.out.h - Early Linux sources" https://elixir.bootlin.com/linux/1.0/source/include/linux/a.out.h
REFERENCE {LINUX} "a.out.h - Linux 6.7 RC1 sources" https://elixir.bootlin.com/linux/v6.7-rc1/source/include/uapi/linux/a.out.h
REFERENCE {FREEBSD} "imgact_aout.h - FreeBSD sources" https://github.com/FreeBSDDesktop/freebsd-base/blob/master/sys/sys/imgact_aout.h
REFERENCE {FREEBSD_SOURCES} https://github.com/freebsd/freebsd-legacy/tree/master
REFERENCE {NETBSD} "exec_aout.h - NetBSD sources" http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/sys/exec_aout.h?rev=1.41&content-type=text/x-cvsweb-markup&only_with_tag=netbsd-9-3-RELEASE
REFERENCE {NETBSD} "aout_mids.h - NetBSD sources" http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/sys/aout_mids.h?rev=1.7&content-type=text/x-cvsweb-markup&only_with_tag=netbsd-9-3-RELEASE
REFERENCE {OPENBSD} "exec.h - OpenBSD sources" https://github.com/openbsd/src/blob/master/sys/sys/exec.h
REFERENCE {MAGIC} "UNIX file magic numbers"
REFERENCE {44BSDLite2} https://github.com/sergev/4.4BSD-Lite2

######## MINIX a.out

TITLE aout_minix:MINIX a.out format

SECTION header:Header

@00	i8[2]	0x01, 0x03
@02	i8	Flags (0x10 for combined text/data executables, 0x20 for split text/data executables)
		%0	Unmapped zero page
		%1	Page aligned
		%2	New style symbol table
		%4	Executable
		%5	Separate instruction/data space
		%6	Pure text (not used)
		%7	Text overlay (not used)
@03	i8	CPU<br>Bit 0 encodes byte order in 16-bit word: 0 for little endian, 1 for big endian<br>Bit 1 encodes 16-bit word order in 32-bit longword: 0 for little endian, 1 for big endian
		=0x00	Unknown
		=0x04	Intel 8086
		=0x0B	Motorola 68000
		=0x0C	National Semiconductor 16032 (32016)
		=0x10	Intel 80368
		=0x17	Sun SPARC
@04	i8	Length of header, should be 0x20 or 0x30
@05	i8	Reserved
@06	i16	Version stamp (unused)
@08	i32	Size of text segment
@0C	i32	Size of data segment
@10	i32	Size of bss segment
@14	i32	Entry point
@18	i32	Total memory allocated, including heap
@1C	i32	Size of symbol table

> The following fields are optional and only appear for a header of length 0x30.

@20	i32	Size of text relocations
@24	i32	Size of data relocations
@28	i32	Base of text relocations
@2C	i32	Base of data relocations

REFERENCE {DEV86} "dev86 sources" https://github.com/lkundrak/dev86

######## COFF

TITLE coff:COFF format
SECTION :Overall layout

Optional MZ stub (DJGPP only)
{filehdr}
{opthdr} (executables only)
{secthdr}
Section data
{relocs}
{linenos}
{symtab}
{strtab}

SECTION filehdr:File header

@00	i16	f_magic, Magic number
		0x014C	0x4C 0x01	(SVR4) Intel 80386 programs{SCOFH}{DJGPP}{MAGIC} (used by DJGPP, reserved for Intel since SVR3)
		0x0150	0x01 0x50	(SVR2) Motorola 68000{CDOS}{MAGIC} (used by Concurrent DOS 68K)<br>Motorola MC68000{TUHS}
		0x0088	0x00 0x88	(SVR2) Motorola 68000{TUHS}
		0x0089	0x00 0x89	(SVR2) Motorola 68000 pure text{TUHS}
		0x0093	0x00 0x93	(Sun 4.1.4) "C30" magic{TUHS}
		0x0101	0x01 0x01	(Magic number for a.out PDP-11 "UNIX-rt ldp"{TUHS})
		0x0105	0x05 0x01	(Magic number for a.out PDP-11 overlay{TUHS})
		0x0107	0x07 0x01	(Magic number for a.out PDP-11, pre-System V VAX executable{TUHS})
		0x0108	0x08 0x01	(Magic number for a.out PDP-11, pre-System V VAX executable, pure{TUHS})
		0x0109	0x09 0x01	(Magic number for a.out PDP-11 separate I&D{TUHS})
		0x011F	0x1F 0x01	(Magic number for a.out PDP-11 kernel overlay{TUHS})
		0x0140	0x01 0x40	ECOFF MIPSEB, MIPS III{MAGIC}
		0x0140	0x40 0x01	ECOFF MIPSEB-LE, MIPS III{MAGIC}
		0x0142	0x01 0x42	ECOFF MIPSEL-BE, MIPS III{MAGIC}
		0x0142	0x42 0x01	ECOFF MIPSEL, MIPS III{MAGIC}
		0x0142	0x42 0x01	(SVR1) Intel x86 "Basic-16"{TUHS}{MAGIC}
		0x0143	0x43 0x01	(SVR1) Intel x86 "Basic-16" pure text{TUHS}{MAGIC}
		0x0144	0x44 0x01	(SVR3) Intel x86 "IAPX16" (used with cross compilers){TUHS}
		0x0145	0x45 0x01	(SVR3) Intel x86 "IAPX16" pure text (used with cross compilers){TUHS}
		0x0146	0x46 0x01	(SVR3) Intel x86 "IAPX20" (used with cross compilers){TUHS}
		0x0147	0x47 0x01	(SVR3) Intel x86 "IAPX20" pure text (used with cross compilers){TUHS}
		0x0148	0x48 0x01	(SVR1) Intel x86{TUHS}{MAGIC}
		0x0148	0x48 0x01	(Mach92) National Semiconductor NS160000
		0x0149	0x49 0x01	(SVR1) Intel x86 pure text{TUHS}{MAGIC}
		0x014A	0x4A 0x01	(SVR3) Intel 80286 small model program{TUHS}{SCOFH}{MAGIC}
		0x014D		(SVR4) Intel i860
		0x014D	0x4D 0x01	(Mach92) National Semiconductor NS160000 pure text
		0x014E	0x4E 0x01	(SVR3) Reserved for Intel{TUHS}
		0x014F	0x4F 0x01	(SVR3) Reserved for Intel{TUHS}
		0x0151	0x01 0x51	(SVR2) Motorola MC68000 pure text{TUHS}{MAGIC}
		0x0152	0x52 0x01	(SVR3) Intel 80286 large model program{TUHS}{SCOFH}{MAGIC}
		0x0152	0x01 0x52	(SVR3) Motorola MC68000 demand paged text segment{TUHS}{MAGIC}
		0x0154	0x54 0x01	(SVR3) Reserved for National Semiconductor{TUHS}
		0x0154	0x54 0x01	(Mach92) National Semiconductor NS32000
		0x0154	0x54 0x01	Linux 2.6.33.2 unused but mentioned for 386 PTX{TUHS}
		0x0155	0x55 0x01	(SVR3) Reserved for National Semiconductor{TUHS}
		0x0155	0x55 0x01	(Mach92) National Semiconductor NS32000 pure text
		0x0158	0x01 0x58	(SVR2) IBM 370{TUHS}
		0x0159	0x01 0x59	(SVR3) Amdahl 470/580{TUHS}
		0x015A	0x01 0x5A	(SVR3) Reserved for IBM 370
		0x015B	0x01 0x5B	(SVR3) Reserved for IBM 370
		0x015C	0x01 0x5C	(SVR3) Amdahl 470/580 pure text segments{TUHS}
		0x015D	0x01 0x5D	(SVR2) IBM 370 pure text{TUHS}
		0x0160		(SVR2 only) XL{TUHS}
		0x0160	0x01 0x60	ECOFF MIPSEB{MAGIC}
		0x0160	0x60 0x01	ECOFF MIPSEB-LE{MAGIC}
		0x0160		(OpenBSD 4.6) i960{TUHS}
		0x0161		(OpenBSD 4.6) i960 pure{TUHS}
		0x0162	0x01 0x62	ECOFF MIPSEL-BE{MAGIC}
		0x0162	0x62 0x01	ECOFF MIPSEL{MAGIC}
		0x0163	0x01 0x63	ECOFF MIPSEB MIPS II{MAGIC}
		0x0163	0x63 0x01	ECOFF MIPSEB-LE MIPS II{MAGIC}
		0x0164	0x01 0x64	(SVR3) Reserved for Zilog{TUHS} (presumably the Z8000/Z80000)
		0x0165	0x01 0x65	(SVR3) Reserved for Zilog{TUHS} (presumably the Z8000/Z80000)
		0x0166	0x01 0x66	ECOFF MIPSEL-BE MIPS II{MAGIC}
		0x0166	0x66 0x01	ECOFF MIPSEL MIPS II{MAGIC}
		0x0168	0x01 0x68	(SVR1) AT&T 3B20{SCOFH}{TUHS}{MAGIC}
		0x0168	0x68 0x01	(NetBSD 5.0.2) SH3 little endian{TUHS}
		0x0169	0x01 0x69	(SVR1) AT&T 3B20 pure text{SCOFH}{TUHS}{MAGIC}
		0x016C	0x01 0x6C	UniSoft 68K Binary Compatibility Standard{MAGIC}
		0x016D	0x01 0x6D	UniSoft 88K Binary Compatibility Standard{MAGIC}
		0x0170	0x01 0x70	(SVR1) AT&T 3B2, 3B15{SCOFH}{TUHS}, WE 32000{TUHS}{MAGIC}, MAC-80/MAC-32
		0x0171	0x01 0x71	(SVR1) AT&T 3B2, 3B15, WE 32000 pure text{TUHS}, MAC-80/MAC-32
		0x0172	0x01 0x72	(SVR2) Reserved for AT&T 3B2, 3B15, WE 32000 pure text{TUHS}, MAC-80/MAC-32
		0x0175	0x75 0x01	(OpenBSD 4.6) 386 Danbury AIX C{TUHS}
		0x0178	0x78 0x01	(SVR1) VAX{TUHS}{SCOFH}{MAGIC}
		0x017A	0x01 0x7A	(OpenBSD 4.6) Am29K big endian{TUHS}{MAGIC}
		0x017B	0x7B 0x01	(OpenBSD 4.6) Am29K little endian{TUHS}
		0x017D	0x7D 0x01	(SVR1) VAX pure text{TUHS}{SCOFH}{MAGIC}, CLIPPER (VAX){MAGIC}
		0x017F		CLIPPER{MAGIC}
		0x0180	0x01 0x80	ECOFF MIPSEB u-code{MAGIC}
		0x0182	0x01 0x82	ECOFF MIPSEL-BE u-code{MAGIC}
		0x0183	0x01 0x83	ECOFF Alpha for Digital UNIX{MAGIC}{ECOFF}
		0x0185	0x01 0x85	ECOFF NetBSD Alpha{MAGIC}
		0x0188	0x01 0x88	ECOFF Alpha compressed COFF{MAGIC}{ECOFF}
		0x018F	0x01 0x8F	ECOFF Alpha u-code object{MAGIC}, obsolete{ECOFF}
		0x0194	0x01 0x94	Apollo Motorola 88K COFF{MAGIC}
		0x0197	0x01 0x97	Apollo Motorola 68K COFF{MAGIC}
		0x01DF	0x01 0xDF	XCOFF 32-bit PowerPC{XCOFF}
		0x01F7	0x01 0xF7	XCOFF 64-bit PowerPC{XCOFF}
		0x1572	0x15 0x72	Am29K "prebar"{MAGIC}
		0x521C	0x1C 0x52	DSP21k{MAGIC}<br>SHARC{MAGIC}
@02	i16	f_nscns, Number of Sections
@04	i32	f_timdat, Time stamp, (CDOS COFF utility{CDOS}: 0)
@08	i32	f_symptr, Offset to symbol table (CDOS COFF utility{CDOS}: 0)
@0C	i32	f_nsyms, Number of symbols in symbol table (CDOS COFF utility{CDOS}: 0)
@10	i16	f_opthdr, Size of optional header
		28	Standard UNIX a.out header (AOUTHDR){SCO}{DJGPP} (used by DJGPP{DJGPP})
		32	GNU extensions (GNU_AOUT){DJGPP}
		36	CDOS coff utility{CDOS}
@12	i16	f_flags, Flags (CDOS utility: 0x020F)
		%0	F_RELFLG, No relocations{SCO}{SCOFH}{DJGPP}{CDOS}, also in XCOFF{XCOFF} and ECOFF{ECOFF}
		%1	F_EXEC, No unresolved symbols, executable{SCO}{SCOFH}{DJGPP}{CDOS}, also in XCOFF{XCOFF} and ECOFF{ECOFF}
		%2	F_LNNO, No line number information{SCO}{SCOFH}{DJGPP}{CDOS}, also in XCOFF{XCOFF} and ECOFF{ECOFF}
		%3	F_LSYMS, No local symbols{SCO}{SCOFH}{DJGPP}{CDOS}, also in XCOFF{XCOFF} and ECOFF{ECOFF}
		%4	F_MINMAL, "minimal object file"{SCOFH}{TUHS}, produced by <tt>fextract</tt>{TUHS}<br>F_FDPR_PROF (XCOFF), profiled using <tt>fdpr</tt>{XCOFF}<br>F_NO_SHARED (ECOFF), unused{ECOFF}
		%5	F_UPDATE, "update file", produced by <tt>ogen</tt>{SCOFH}{TUHS}<br>F_FDPR_OPTI (XCOFF), reordered using <tt>fdpr</tt>{XCOFF}<br>F_NO_CALL_SHARED (ECOFF), cannot be used to create dynamic executable file{ECOFF}
		%6	F_SWABD, file is "pre-swabbed"{SCOFH}, in name{TUHS}<br>F_DSA (XCOFF), very large program support{XCOFF}<br>F_LOMAP (ECOFF), static executable may be loaded below VM_MIN_ADDRESS (0x10000), invalid for dynamic executables{ECOFF}
		%7	F_AR16WR, Little endian, 16-bit (like PDP-11/70){SCO}{SCOFH}{TUHS}<br>F_DEP_1 (XCOFF), data-execute permissions{XCOFF}
		%8	F_AR32WR, Little endian, 32-bit (like VAX){SCO}{SCOFH}{TUHS}{DJGPP}<br>F_VARPG (XCOFF), the medium page size specified in the auxiliary header is 0{XCOFF}
		%9	F_AR32W, Big endian, 32-bit, "non-DEC host" (like 3B){SCOFH}{TUHS}{CDOS}<br>reserved (XCOFF){XCOFF}
		%10	F_PATCH, optional header contains "patch" list{SCOFH}{TUHS}<br>F_NODF, minimal object files contain no decision functions for replaced functions{TUHS}<br>F_LPTEXT (XCOFF), reserved{XCOFF}
		%11	F_LPDATA (XCOFF), requires large page data{XCOFF}
		%12	F_BM32RST, contains "restore work-around"{SCOFH}{TUHS}<br>F_LPTEXT (XCOFF), reserved{XCOFF}
		%13-15	F_BM32ID, Bellmac-32/WE32000 family ID fields (V9 and later){SCOFH}{TUHS}
		%13	F_BM32B, contains WE32100 instructions (V9 and later){SCOFH}{TUHS}
		%14	F_BM32MAU, requires "math arithmetic unit" (V10 and later){SCOFH}{TUHS}
		%12	F_80186, contains Intel 80186 instructions (V10 and later){SCOFH}{TUHS}
		%13	F_80286, contains Intel 80286 instructions (V10 and later){SCOFH}{TUHS}
		%12	F_DYNLOAD (XCOFF), dynamically executable{XCOFF}
		%12-13	(ECOFF)
			=0x2000	F_SHARABLE, shared library{ECOFF}
			=0x3000	F_CALL_SHARED, dynamic executable file{ECOFF}
		%13	F_SHROBJ (XCOFF), shared library{XCOFF}
		%14	F_LOADONLY (XCOFF), for shared objects, ignore when part of a library{XCOFF}<br>F_NO_REORG (ECOFF), do not reorder sections{ECOFF}
		%15	F_DEP_1 (XCOFF), data-execute permissions{XCOFF}<br>F_NO_REMOVE (ECOFF), do not remove NOPs{ECOFF}

SECTION 1/:ECOFF file header

> The ECOFF header is nearly identical to the standard COFF header, with one field enlarged.{ECOFF}

@00	i16	f_magic, Magic number
@02	i16	f_nscns, Number of Sections
@04	i32	f_timdat, Time stamp
@08	i64	f_symptr, Offset to symbol table
@10	i32	f_nsyms, Number of symbols in symbol table
@14	i16	f_opthdr, Size of optional header
@16	i16	f_flags, Flags

SECTION 1/:XCOFF64 file header

> The XCOFF32 header is identical to the standard COFF header. However, the XCOFF64 header has an 8-byte <tt>f_symptr</tt> entry, requiring <tt>f_nsyms</tt> to be moved after the final field.{XCOFF}

@00	i16	f_magic, Magic number
@02	i16	f_nscns, Number of Sections
@04	i32	f_timdat, Time stamp
@08	i64	f_symptr, Offset to symbol table
@10	i16	f_opthdr, Size of optional header
@12	i16	f_flags, Flags
@14	i32	f_nsyms, Number of symbols in symbol table

SECTION opthdr:Optional header

> The first variant presented here is the standard Unix a.out header (AOUTHDR).
> The values used by DJGPP and Concurrent DOS 68K will be remarked on.

@00	i16	<tt>magic</tt> - Magic (CDOS COFF utility{CDOS}: 0)
		0x0107	OMAGIC<br>Contiguous text and data segments<br>Text segment is not write-protected or sharable{SCO}
		0x0108	NMAGIC<br>Data segment starts at segment boundary following text segment<br>Text segment is write-protected{SCO}
		0x010B	ZMAGIC (used by DJGPP{DJGPP})<br>Text and data segments are page aligned{SCO}
		0x0123	SHMAGIC{GNU}<br>Shared library{SCO}
@02	i16	<tt>vstamp</tt> - Version stamp{SCO}{DJGPP} (DJGPP ignores this field{DJGPP}, CDOS COFF utility{CDOS}: 0)
@04	i32	<tt>tsize</tt> - Text size in bytes (DJGPP ignores this field{DJGPP})
@08	i32	<tt>dsize</tt> - Data size in bytes (DJGPP ignores this field{DJGPP})
@0C	i32	<tt>bsize</tt> - Bss size in byte (DJGPP ignores this field{DJGPP})
@10	i32	<tt>entry</tt> - Entry point (CDOS COFF utility{CDOS}: 0)
@14	i32	<tt>text_start</tt> - Address of text start (DJGPP ignores this field{DJGPP}, CDOS COFF utility{CDOS}: 0)
@18	i32	<tt>data_start</tt> - Address of data start (DJGPP ignores this field{DJGPP})

SECTION 1/:3B20 optional header

@00	i16	<tt>magic</tt> - Magic
@02	i16	<tt>vstamp</tt> - Version stamp
@04	i32	<tt>tsize</tt> - Text size in bytes
@08	i32	<tt>dsize</tt> - Data size in bytes
@0C	i32	<tt>bsize</tt> - Bss size in byte
@10	c[8]	Padding
@18	i32	<tt>entry</tt> - Entry point
@1C	i32	<tt>text_start</tt> - Address of text start
@20	i32	<tt>data_start</tt> - Address of data start

SECTION 1/:NS32000 fields

@00	i16	<tt>magic</tt> - Magic
@02	i16	<tt>vstamp</tt> - Version stamp
@04	i32	<tt>tsize</tt> - Text size in bytes
@08	i32	<tt>dsize</tt> - Data size in bytes
@0C	i32	<tt>bsize</tt> - Bss size in byte
@10	i32	<tt>msize</tt> - Module size in bytes
@14	i32	<tt>mod_start</tt> - Address of module
@18	i32	<tt>entry</tt> - Entry point
@1C	i32	<tt>text_start</tt> - Address of text start
@20	i32	<tt>data_start</tt> - Address of data start
@24	i16	<tt>entry_mod</tt> - Entry module
@26	i16	<tt>flags</tt>
		%0:2	section alignment
			=0x00	fullword alignment
			=0x01	512 B
			=0x02	1 KiB
			=0x03	2 KiB
			=0x04	4 KiB
			=0x05	8 KiB
		%3	data
		%4	text
		%5	module
		%8	System V relocations
		%9	SVR4.2 BSD relocations

SECTION 1/:Concurrent DOS additional fields

> The following additional fields are defined, after regular AOUTHDR fields in {opthdr}:{CDOS}

@1C	i32	<tt>relptr</tt> - Relocation information (CDOS coff utility: directly after text, data and bss images)
@20	i32	<tt>ssize</tt> - Stack size

SECTION 1/:GNU_AOUT header fields

> DJGPP seems to support the following format aside from the original System V format<sup>[{https://www.pcorner.com/list/UPLOAD/DPMIGCC5.ZIP/GNUAOUT.H/|GNUAOUT.H}]</sup>

SECTION 1/:Additional optional header fields for MIPS

> The following fields are used additionally for MIPS.{MIPS}

@1C	i32	<tt>bss_start</tt> - Address of bss start
@20	i32	<tt>gprmask</tt> - general purpose register mask
@24	i32[4]	<tt>cprmask</tt> - coprocessor purpose register masks
@34	i32	<tt>gp_value</tt> - the gp value for this object

SECTION 1/:ECOFF optional header

@00	i16	<tt>magic</tt> - Magic
@02	i16	<tt>vstamp</tt> - Version stamp, must be 0x030D{ECOFF}
@04	i16	<tt>bldrev</tt> - Revision number of the build tools
		=0x0000	1.2
		=0x0002	1.3
		=0x0004	2.0
		=0x0006	3.0
		=0x0008	3.2
		=0x000A	4.0
		=0x000C	5.0
@06	i16	<tt>padcell</tt> - Unused
@08	i64	<tt>tsize</tt> - Text size in bytes
@10	i64	<tt>dsize</tt> - Data size in bytes
@18	i64	<tt>bsize</tt> - Bss size in byte
@20	i64	<tt>entry</tt> - Entry point
@28	i64	<tt>text_start</tt> - Address of text start
@30	i64	<tt>data_start</tt> - Address of data start
@38	i64	<tt>bss_start</tt> - Address of bss start
@40	i32	<tt>gprmask</tt> - Unused
@44	i32	<tt>fprmask</tt> - Unused
@48	i64	<tt>gp_value</tt> - Initial value of the GP (global pointer) register

SECTION 1/:XCOFF32 additional fields

> XCOFF redefines the value of the <tt>magic</tt> field.{XCOFF}

@00	i16	<tt>mflag</tt> - Flags, only used if <tt>vstamp</tt> is greater than 1, or 1 in XCOFF32 with <tt>flags</tt> having _AOUT_ALGNTDATA set
		=0x003F	Bits for ASLR properties in XCOFF32 executable
		=0x03FF	Bits for ASLR properties in XCOFF64 executable
		=0x3C00	Reserved
		=0x4000	AOUT_MFLAG_ASLR_TEXTRLD, the text section has relocations
		=0x8000	AOUT_MFLAG_ASLR_MARKED, uses address space layout randomization fields

> The following additional fields are defined:{XCOFF}

@1C	i32	<tt>toc</tt> - Address of TOC (table of contents) anchor
@20	i32	<tt>snentry</tt> - Entry point section number
@22	i16	<tt>sntext</tt> - Section number for text segment
@24	i16	<tt>sndata</tt> - Section number for data segment
@26	i16	<tt>sntoc</tt> - Section number for TOC segment
@28	i16	<tt>snloader</tt> - Section number for loader data
@2A	i16	<tt>snbss</tt> - Section number for bss segment
@2C	i16	<tt>algntext</tt> - Maximum alignment for text segment
@2E	i16	<tt>algndata</tt> - Maximum alignment for data segment
@30	i16	<tt>modtype</tt> - Module type
@32	i8	<tt>cpuflag</tt> - CPU flag (reserved)
@33	i8	<tt>cputype</tt> - CPU type (reserved)
@34	i32	<tt>maxstack</tt> - Maximum stack
@38	i32	<tt>maxdata</tt> - Maximum data
@3C	i32	<tt>debugger</tt> - Reserved
@40	i8	<tt>textpsize</tt> - Text page size
@41	i8	<tt>datapsize</tt> - Data page size
@42	i8	<tt>stackpsize</tt> - Stack page size
@43	i8	<tt>flags</tt> - Flags
		%0-3	_AOUT_ALGNTDATA, alignment of thread-local data
			=0x0-0x8	Base 2 logarithm of alignment
			=0xC	4KiB page alignment
			=0xD	64KiB page alignment
		%6	_AOUT_RAS, key and recovery safe kernel extension
		%7	_AOUT_TLS_LE, uses local-exec model, cannot be loaded dynamically
@44	i16	<tt>sntdata</tt> - Section number for tdata segment
@46	i16	<tt>sntbss</tt> - Section number for tbss segment

SECTION 1/:XCOFF64 format

> The 64-bit version enlarges some fields and moves them around, maintaining their natural alignment:{XCOFF}

@00	i16	<tt>mflag</tt> - Flags
@02	i16	<tt>vstamp</tt> - Version stamp
@04	i32	<tt>debugger</tt> - Reserved
@08	i64	<tt>text_start</tt> - Address of text start
@10	i64	<tt>data_start</tt> - Address of data start
@18	i64	<tt>toc</tt> - Address of TOC (table of contents) anchor
@20	i32	<tt>snentry</tt> - Entry point section number
@22	i16	<tt>sntext</tt> - Section number for text segment
@24	i16	<tt>sndata</tt> - Section number for data segment
@26	i16	<tt>sntoc</tt> - Section number for TOC segment
@28	i16	<tt>snloader</tt> - Section number for loader data
@2A	i16	<tt>snbss</tt> - Section number for bss segment
@2C	i16	<tt>algntext</tt> - Maximum alignment for text segment
@2E	i16	<tt>algndata</tt> - Maximum alignment for data segment
@30	i16	<tt>modtype</tt> - Module type
@32	i8	<tt>cpuflag</tt> - CPU flag (reserved)
@33	i8	<tt>cputype</tt> - CPU type (reserved)
@34	i8	<tt>textpsize</tt> - Text page size
@35	i8	<tt>datapsize</tt> - Data page size
@36	i8	<tt>stackpsize</tt> - Stack page size
@37	i8	<tt>flags</tt> - Flags
@38	i64	<tt>tsize</tt> - Text size in bytes
@40	i64	<tt>dsize</tt> - Data size in bytes
@48	i64	<tt>bsize</tt> - Bss size in byte
@50	i64	<tt>entry</tt> - Entry point
@58	i64	<tt>maxstack</tt> - Maximum stack
@60	i64	<tt>maxdata</tt> - Maximum data
@68	i16	<tt>sntdata</tt> - Section number for tdata segment
@6A	i16	<tt>sntbss</tt> - Section number for tbss segment
@6C	i16	<tt>x64flags</tt> - XCOFF64 flags
@6E	i16	<tt>shmpsize64</tt> - Shared memory page size

SECTION secthdr:Section header

@00	c[8]	<tt>s_name</tt> - Section name, padded with nulls
@08	i32	<tt>s_paddr</tt> - Physical address for section data
@0C	i32	<tt>s_vaddr</tt> - Virtual address (identical to physical address for DJGPP{DJGPP} and CDOS{CDOS})
@10	i32	<tt>s_size</tt> - Size of data in image in bytes
@14	i32	<tt>s_scnptr</tt> - Offset to section data from COFF file start
@18	i32	<tt>s_relptr</tt> - Offset to relocation data (CDOS coff utility{CDOS}: 0)
@1C	i32	<tt>s_lnnoptr</tt> - Offset to line number entries (CDOS coff utility{CDOS}: 0)
@20	i16	<tt>s_nreloc</tt> - Number of relocations (CDOS coff utility{CDOS}: 0)
@22	i16	<tt>s_nlnno</tt> - Number of line numbers (CDOS coff utility{CDOS}: 0)
@24	i32	<tt>s_flags</tt> - Flags
		0x00000000	<tt>STYP_REG</tt> - Regular section (allocated, relocated, loaded){SCO}, also ECOFF{ECOFF}, reserved in XCOFF{XCOFF}
		0x00000001	<tt>STYP_DSECT</tt> - Dummy section (not allocated, relocated, not loaded){SCO}
		0x00000002	<tt>STYP_NOLOAD</tt> - Noload section (allocated, relocated, not loaded){SCO}
		0x00000004	<tt>STYP_GROUP</tt> - Grouped section{SCO}
		0x00000008	<tt>STYP_PAD</tt> - Padding section (not allocated, not relocated, loaded){SCO} also XCOFF{XCOFF}
		0x00000010	<tt>STYP_COPY</tt> - Copy section, for a decision function used in updating fields<br>(not allocated, not relocated, loaded, relocation and line numbers are processed normally){SCO}<br><tt>STYP_DWARF</tt> (XCOFF) - DWARF debugging section{XCOFF}
		0x00000020	<tt>STYP_TEXT</tt> - Executable text code, also XCOFF{XCOFF} and ECOFF{ECOFF}
		0x00000040	<tt>STYP_DATA</tt> - Initialized data, also XCOFF{XCOFF} and ECOFF{ECOFF}
		0x00000080	<tt>STYP_BSS</tt> - Uninitialized data, also XCOFF{XCOFF} and ECOFF{ECOFF}
		0x00000100	<tt>STYP_EXCEPT</tt> (XCOFF) - Exception section{XCOFF}<br><tt>STYP_RDATA</tt> (ECOFF) - Read-only data{ECOFF}
		0x00000200	<tt>STYP_INFO</tt> - Comment section (not allocated, not relocated, not loaded){SCO}, also XCOFF{XCOFF}<br><tt>STYP_SDATA</tt> (ECOFF) - Small initialized data{ECOFF}
		0x00000400	<tt>STYP_OVER</tt> - Overlay section (not allocated, relocated, not loaded){SCO}<br><tt>STYP_TDATA</tt> (XCOFF) - thread-local initialized data section{XCOFF}<br><tt>STYP_SBSS</tt> (ECOFF) - Small uninitialized data{ECOFF}
		0x00000800	<tt>STYP_LIB</tt> - .lib section, treated like a comment section{SCO}<br><tt>STYP_TBSS</tt> (XCOFF) - thread-local uninitialized data section{XCOFF}<br><tt>STYP_UCODE</tt> (ECOFF) - Obsolete{ECOFF}
		0x00001000	<tt>STYP_LOADER</tt> (XCOFF) - Loader section{XCOFF}<br><tt>STYP_GOT</tt> (ECOFF) - Global offset table{ECOFF}
		0x00002000	<tt>STYP_DEBUG</tt> (XCOFF) - Debug section{XCOFF}<br><tt>STYP_DYNAMIC</tt> (ECOFF) - Dynamic linking information{ECOFF}
		0x00004000	<tt>STYP_TYPCHK</tt> (XCOFF) - Type-check section{XCOFF}<br><tt>STYP_DYNSYM</tt> (ECOFF) - Dynamic linking symbol table{ECOFF}
		0x00008000	<tt>STYP_OVRFLO</tt> (XCOFF32 only) - Overflow section{XCOFF}<br><tt>STYP_REL_DYN</tt> (ECOFF) - Dynamic relocation information{ECOFF}
		0x00010000	<tt>STYP_DYNSTR</tt> (ECOFF) - Dynamic linking symbol table{ECOFF}
		0x00020000	<tt>STYP_HASH</tt> (ECOFF) - Dynamic symbol hash table{ECOFF}
		0x00040000	<tt>STYP_DSOLIST</tt> (ECOFF) - Shared library dependency list{ECOFF}
		0x00080000	<tt>STYP_MSYM</tt> (ECOFF) - Additional dynamic linking symbol table{ECOFF}
		0x0FF00000	<tt>STYP_EXTMASK</tt> (ECOFF) - Mask for multiple bit flag values{ECOFF}
		0x00100000	<tt>STYP_CONFLICT</tt> (ECOFF) - Additional dynamic linking information{ECOFF}
		0x01000000	<tt>STYP_FINI</tt> (ECOFF) - Termination text only{ECOFF}
		0x02000000	<tt>STYP_COMMENT</tt> (ECOFF) - Comment section{ECOFF}
		0x02200000	<tt>STYP_RCONST</tt> (ECOFF) - Read-only constants{ECOFF}
		0x02400000	<tt>STYP_XDATA</tt> (ECOFF) - Exception scope table{ECOFF}
		0x02500000	<tt>STYP_TLSDATA</tt> (ECOFF) - Initialized TLS data{ECOFF}
		0x02600000	<tt>STYP_TLSBSS</tt> (ECOFF) - Uninitialized TLS data{ECOFF}
		0x02700000	<tt>STYP_TLSINIT</tt> (ECOFF) - Initialization for TLS data{ECOFF}
		0x02800000	<tt>STYP_PDATA</tt> (ECOFF) - Exception procedure table{ECOFF}
		0x04000000	<tt>STYP_LITA</tt> (ECOFF) - Address literals only{ECOFF}
		0x08000000	<tt>STYP_LIT8</tt> (ECOFF) - 8-byte literals only{ECOFF}
		0x10000000	<tt>STYP_LIT4</tt> (ECOFF) - 4-byte literals only{ECOFF}
		0x20000000	<tt>S_NRELOC_OVFL</tt> (ECOFF) - The <tt>s_nreloc</tt> field has overflowed and contains 0xFFFF{ECOFF}<br>In this case, the first relocation entry contains the actual relocation count
		0x80000000	<tt>STYP_INIT</tt> (ECOFF) - Initialization text only{ECOFF}

SECTION 1/:ECOFF section header

@00	c[8]	<tt>s_name</tt> - Section name, padded with nulls
@08	i64	<tt>s_paddr</tt> - Physical address for section data
@10	i64	<tt>s_vaddr</tt> - Virtual address
@18	i64	<tt>s_size</tt> - Size of data in image in bytes
@20	i64	<tt>s_scnptr</tt> - Offset to section data from COFF file start
@28	i64	<tt>s_relptr</tt> - Offset to relocation data
@30	i64	<tt>s_lnnoptr</tt> - Offset to line number entries
@38	i16	<tt>s_nreloc</tt> - Number of relocations
@3A	i16	<tt>s_nlnno</tt> - Number of line numbers
@3C	i32	<tt>s_flags</tt> - Flags

SECTION 1/:XCOFF64 section header

@00	c[8]	<tt>s_name</tt> - Section name, padded with nulls
@08	i64	<tt>s_paddr</tt> - Physical address for section data
@10	i64	<tt>s_vaddr</tt> - Virtual address
@18	i64	<tt>s_size</tt> - Size of data in image in bytes
@20	i64	<tt>s_scnptr</tt> - Offset to section data from COFF file start
@28	i64	<tt>s_relptr</tt> - Offset to relocation data
@30	i64	<tt>s_lnnoptr</tt> - Offset to line number entries
@38	i32	<tt>s_nreloc</tt> - Number of relocations
@3C	i32	<tt>s_nlnno</tt> - Number of line numbers
@40	i32	<tt>s_flags</tt> - Flags

SECTION relocs:Relocation information

> The typical relocation information is a sequence of relocation records as shown below.

@00	i32	<tt>r_vaddr</tt> - Virtual address of reference
@04	i32	<tt>r_symndx</tt> - Symbol table index
@08	i16	<tt>r_type</tt> - Relocation type
		0x00	<tt>R_ABS</tt> - Absolute reference, no relocation necessary{SCO}
		0x01	<tt>R_DIR16</tt> - (8086/80286 only) Direct 16-bit reference to symbol's virtual address{SCO}
		0x02	<tt>R_REL16</tt> - (8086/80286 only) PC-relative 16-bit reference to symbol's virtual address{SCO}
		0x03	<tt>R_IND16</tt> - (8086 only) Indirect 16-bit reference via transfer vector
		0x04	<tt>R_DIR24</tt> - (WE32K only) Direct 24-bit reference to symbol's virtual address
		0x05	<tt>R_REL24</tt> - (WE32K only) PC-relative 24-bit reference to symbol's virtual address
		0x06	<tt>R_DIR32</tt> - (80286/80386/WE32K) Direct 32-bit reference to symbol's virtual address{SCO}<br><tt>RELOC_ADDR32</tt> for DJGPP{DJGPP}
		0x07	<tt>R_OFF8</tt> - (8086 only) Lower 8 bits of symbol's virtual address
		0x08	<tt>R_OFF16</tt> - (8086 only) Higher 8 bits of symbol's 16-bit virtual address
		0x09	<tt>R_SEG12</tt> - (8086/80286 only) Direct 16-bit reference to symbol's segment-selector bits of a 32-bit virtual address{SCO}
		0x0A	<tt>R_DIR32S</tt> - (WE32K only) Byte swapped direct 32-bit reference to symbol's virtual address
		0x0B	<tt>R_AUX</tt> - (8086 only) Auxiliary relocation (details unknown)
		0x0C	<tt>R_OPT16</tt> - (WE32K only) Optimized indirect 16-bit reference via transfer vector
		0x0D	<tt>R_IND24</tt> - (WE32K only) Indirect 24-bit reference via transfer vector
		0x0E	<tt>R_IND32</tt> - (WE32K only) Indirect 32-bit reference via transfer vector
		0x0F	<tt>R_RELBYTE</tt> - (VAX/68K only) Direct 8-bit reference ("symbol relative") to symbol's virtual address
		0x10	<tt>R_RELWORD</tt> - (VAX/68K only) Direct 16-bit reference ("symbol relative") to symbol's virtual address
		0x11	<tt>R_RELLONG</tt> - (VAX/68K only) Direct 32-bit reference ("symbol relative") to symbol's virtual address
		0x12	<tt>R_PCRBYTE</tt> - (VAX/68K only) PC-relative 8-bit reference to symbol's virtual address
		0x13	<tt>R_PCRWORD</tt> - (VAX/68K only) PC-relative 16-bit reference to symbol's virtual address
		0x14	<tt>R_PCRLONG</tt> - (80386/VAX/68K) PC-relative 32-bit reference to symbol's virtual address{SCO}<br><tt>RELOC_REL32</tt> for DJGPP{DJGPP}

SECTION 1/:Concurrent DOS 68K relocation information

> Concurrent DOS 68K uses a different relocation structure. Its position is stored in the optional header instead of the file header. The contents of the relocations are identical to crunched relocations in the CP/M-68K file format.

SECTION linenos:Line numbers

@00	i32	Symbol table index (if line number is 0) or virtual address
@04	i16	1-based line number<br>0 for symbol table index

SECTION symtab:Symbol table

@00	c[8]	<tt>name</tt> - Symbol name, zero-padded (first 4 bytes should not be all zero)
@00	i32	<tt>zeroes</tt> - If zero, the symbol is inlined
@04	i32	<tt>offset</tt> - Offset to name in symbol table (only if first 4 bytes are zero)
@08	i32	<tt>value</tt> - Value of symbol
@0C	i16	<tt>scnum</tt> - Section number, 1-based
		=0x0000	<tt>N_UNDEF</tt> - External/undefined symbol
		=0xFFFF	<tt>N_ABS</tt> - Absolute symbol
		=0xFFFE	<tt>N_DEBUG</tt> - Debugging symbol
@0E	i16	<tt>type</tt> - Symbol type: base type
		0x0000	<tt>T_NULL</tt> - No symbol
		0x0001	<tt>T_ARG</tt> - Function argument{SCO}<br><tt>T_VOID</tt> - void{DJGPP}
		0x0002	<tt>T_CHAR</tt> - char, int8
		0x0003	<tt>T_SHORT</tt> - short int, int16
		0x0004	<tt>T_INT</tt> - int
		0x0005	<tt>T_LONG</tt> - long int, int32
		0x0006	<tt>T_FLOAT</tt> - float
		0x0007	<tt>T_DOUBLE</tt> - double
		0x0008	<tt>T_STUCT</tt> - struct ...
		0x0009	<tt>T_UNION</tt> - union ...
		0x000A	<tt>T_ENUM</tt> - enum ...
		0x000B	<tt>T_MOE</tt> - Member in enumeration
		0x000C	<tt>T_UCHAR</tt> - unsigned char, uint8
		0x000D	<tt>T_USHORT</tt> - unsigned short int, uint16
		0x000E	<tt>T_UINT</tt> - unsigned int
		0x000F	<tt>T_ULONG</tt> - unsigned long int, uint32
		0x0010	<tt>T_LNGDBL</tt> - long double{DJGPP}
		0x0000	<tt>DT_NON</tt> - Not a derived type
		0x0010	<tt>DT_PTR</tt> - Pointer
		0x0020	<tt>DT_FUN</tt> - Function
		0x0030	<tt>DT_ARY</tt> - Array
@10	i8	<tt>sclass</tt> - Storage class
		0x00	<tt>C_NULL</tt> - No entry
		0x01	<tt>C_AUTO</tt> - Automatic
		0x02	<tt>C_EXT</tt> - External/public
		0x03	<tt>C_STAT</tt> - Static/private
		0x04	<tt>C_REG</tt> - Register
		0x05	<tt>C_EXTDEF</tt> - External definition
		0x06	<tt>C_LABEL</tt> - Label
		0x07	<tt>C_ULABEL</tt> - Undefined label
		0x08	<tt>C_MOS</tt> - Member of structure
		0x09	<tt>C_ARG</tt> - Function argument
		0x0A	<tt>C_STRTAG</tt> - Structure tag
		0x0B	<tt>C_MOU</tt> - Member of union
		0x0C	<tt>C_UNTAG</tt> - Union tag
		0x0D	<tt>C_TPDEF</tt> - Type definition
		0x0E	<tt>C_USTATIC</tt> - Undefined static
		0x0F	<tt>C_ENTAG</tt> - Enumeration tag
		0x10	<tt>C_MOE</tt> - Member of enumeration
		0x11	<tt>C_REGPARM</tt> - Register parameter
		0x12	<tt>C_FIELD</tt> - Bitfield
		0x13	<tt>C_AUTOARG</tt> - Auto argument{DJGPP}
		0x14	<tt>C_LASTENT</tt> - Dummy argument{DJGPP}
		0x64	<tt>C_BLOCK</tt> - Beginning/end of block (.bb, .eb)
		0x65	<tt>C_FCN</tt> - Beginning/end of function (.bf, .ef)
		0x66	<tt>C_EOS</tt> - End of structure
		0x67	<tt>C_FILE</tt> - File name
		0x68	<tt>C_LINE</tt> - Line number as symbol{DJGPP}, Used only by utility programs{SCO}
		0x69	<tt>C_ALIAS</tt> - Duplicated tag
		0x6A	<tt>C_HIDDEN</tt> - Shadow symbol{SCO}, ext symbol in dmert public lib{DJGPP}
		0x6B	<tt>C_WEAKEXT</tt> - Weak linkage C_EXT{SCO}
		0xFF	<tt>C_EFCN</tt> - Physical end of function
@11	i8	<tt>numaux</tt> - Number of auxiliary entries, each entry occupying a symbol record

SECTION strtab:String table

> A sequence of null-terminated strings. The first 4 bytes specify the size of the string table in bytes, including the first 4 bytes. References to string must be between 4 and this value.

SECTION :Further work

> The XCOFF and ECOFF formats require further work.

REFERENCE {SCO} "Common Object File Format (COFF) - SCO OpenServer 5 Documentation" http://osr507doc.sco.com/en/topics/COFF.html
REFERENCE {SCOFH} "filehdr(FP) - SCO OpenServer 5 Documentation" http://osr507doc.sco.com/en/man/html.FP/filehdr.FP.html
REFERENCE {TUHS} "The Unix Tree" https://www.tuhs.org/cgi-bin/utree.pl
REFERENCE {DJGPP} "DJGPP COFF Spec" http://www.delorie.com/djgpp/doc/coff/
REFERENCE {CDOS} "COFF.C source from Concurrent DOS 68K disks" http://www.cpm.z80.de/download/cdos3.zip
REFERENCE {GNU} "Binutils sources" https://github.com/aixoss/binutils
REFERENCE {MAGIC} "UNIX file magic numbers"
REFERENCE {XCOFF} "XCOFF Object File Format" https://www.ibm.com/docs/en/aix/7.3?topic=formats-xcoff-object-file-format
REFERENCE {ECOFF} "Tru64 UNIX (eCOFF)" https://web.archive.org/web/20160305114748/http://h41361.www4.hp.com/docs/base_doc/DOCUMENTATION/V50A_ACRO_SUP/OBJSPEC.PDF
REFERENCE {MIPS} https://web.archive.org/web/20140723105157/http://www-scf.usc.edu/~csci402/ncode/coff_8h-source.html

######## x.out

TITLE xout:XENIX x.out format

SECTION header:Header

@00	i16	x_magic, 0x0206
@02	i16	x_ext, size of {extheader}
@04	i32	x_text, size of text segment<br>for segmented images, sum of all the corresponding segment sizes (xs_psize or xs_vsize)
@08	i32	x_data, size of initialized data segment<br>for segmented images, sum of all the corresponding segment sizes (xs_psize or xs_vsize)
@0C	i32	x_bss, size of uninitialized data segment<br>for segmented images, sum of all the corresponding segment sizes (xs_psize or xs_vsize)
@10	i32	x_syms, size of symbol table<br>for segmented images, sum of all the corresponding segment sizes (xs_psize or xs_vsize)
@14	i32	x_reloc, size of relocation table<br>for segmented images, sum of all the corresponding segment sizes (xs_psize or xs_vsize)
@18	i32	x_entry, entry point
@1C	i8	x_cpu, CPU type and word order
		%0:4
			=0x01	PDP-11
			=0x02	PDP-11/23 (?)
			=0x03	Zilog Z8000
			=0x04	Intel 8086
			=0x05	Motorola 68000
			=0x06	Zilog Z80
			=0x07	VAX 780/750
			=0x08	National Semiconductor 32000 (NS16032)
			=0x09	Intel 80286
			=0x29	Intel 80286 (?)
			=0x0A	Intel 80386
			=0x0B	Intel 80186
		%5	set if least significant word comes first in 32-bit word (little-endian)
		%6	set if most significant byte comes first in 16-bit word (big-endian)
@1D	i8	x_relsym, relocation & symbol format, only valid for non-segmented binaries
		%0:3	symbol table format
		%4:7	relocation table format
@1E	i16	x_renv, run-time environment
		%0	XE_EXEC, executable
		%1	XE_SEP, separate I & D
		%2	XE_PURE, pure text
		%3	XE_FS, fixed stack
		%4	XE_OVER, text overlay
		%5	XE_LDATA, large model data
		%6	XE_LTEXT, large model text
		%7	XE_FPH, floating point hardware required
		%8	XE_HDATA, XE_VMOD, virtual module or huge model data (not used)
		%9	XE_ITER, iterated text/data present
		%10	XE_ABS, absolute memory image with physical addresses, standalone
		%11	XE_SEG, segment table present
		%12	XE_LOCK, use advisory locking (0)
		%13	XE_5_3, 5.3 functionality required (0)
		%14:15	XE_VERS, Version
			=0x40	XE_V2, Version 2.x
			=0x80	XE_V3, Version 3.x
			=0xC0	XE_OSV, XE_V5, Version 5.x

> On a 386, bits 0, 8, 10 of x_renv must take one the following values:

0x0001	executable, no shared libraries
0x0100	shared library
0x0101	executable, uses shared libraries
0x0401	standalone program, kernel
0x0500	virtual kernel module

SECTION extheader:Header extension

@20	i32	xe_trsize, size of text relocations<br>for segmented images, sum of all corresponding segment sizes<br>not used
@24	i32	xe_drsize, size of initialized data relocations<br>for segmented images, sum of all corresponding segment sizes<br>not used
@28	i32	xe_tbase, text relocation base<br>unused for segmented images<br>not used
@2C	i32	xe_dbase, text relocation base<br>unused for segmented images<br>not used
@30	i32	xe_stksize, fixed stack size, only if XE_FS is set

> The following fields are mandatory in segmented executables:

@34	i32	xe_segpos, offset to {segtab}
@38	i32	xe_segsize, size of {segtab}
@3C	i32	xe_mdtpos, offset to machine dependent table
@40	i32	xe_mdtsize, size of machine dependent table
@44	i8	xe_mdttype, type of machine dependent table
		=0x00	XE_MDTNONE
		=0x01	XE_MDT286, Intel 80286 LDT
@45	i8	xe_pagesize, size of file page, in 512 bytes
@46	i8	xe_ostype, type of operating system
		=0x00	XE_OSNONE
		=0x01	XE_OSXENIX, Xenix
		=0x02	XE_OSRMX, Intel iRMX
		=0x03	XE_OSCCPM, Concurrent CP/M
@47	i8	xe_osvers, version of operating system
		=0x00	XE_OSXV2, Xenix 2.x
		=0x01	XE_OSXV3, Xenix 3.x
		=0x02	XE_OSXV5, Xenix 5.x
@48	i16	xe_eseg, segment for entry (machine dependent)
@4A	i16	xe_sres, reserved

SECTION segtab:Segment table

@00	i16	xs_type, type of segment
		=0x00	XS_TNULL, unused
		=0x01	XS_TTEXT, text segment
		=0x02	XS_TDATA, data segment
		=0x03	XS_TSYMS, symbol table segment
		=0x04	XS_TREL, relocation segment
		=0x05	XS_TSESTR, string table for segment table
		=0x06	XS_TGRPS, group definition segment
		=0x40	XS_TIDATA, iterated data
		=0x41	XS_TTSS, TSS segment
		=0x42	XS_TLFIX, "lodfix"
		=0x43	XS_TDNAME, descriptor names
		=0x44	XS_TDTEXT/XS_TIDBG, debug text segment
		=0x45	XS_TDFIX, debug relocation
		=0x46	XS_TOVTAB, overlay table
		=0x47	XS_T71
		=0x48	XS_TSYSTR, string table for symbols
@02	i16	xs_attr, attributes
		%0	XS_AITER, contains iteration records (XS_TTEXT/XS_TDATA)
		%1	XS_AHUGE, contains huge elements (XS_TTEXT/XS_TDATA)
		%2	XS_ABSS, contains implicit bss (XS_TTEXT/XS_TDATA)
		%3	XS_APURE, read-only shareable (XS_TTEXT/XS_TDATA)
		%4	XS_AEDOWN, expand down segment such as stack (XS_TTEXT/XS_TDATA)
		%5	XS_APRIV, segment may not be combined, private (XS_TTEXT/XS_TDATA)
		%6	XS_A32BIT, 32-bit segment
		%0:14	for XS_TSYMS segment, symbol table format
			=0x0000	Bell 5.2
			=0x0001	x.out segmented
			=0x0002	island debugger support
		%0:14	for XS_TREL segment, enumerated relocation table format
			=0x0001	x.out segmented
			=0x0002	8086 x.out segmented
		%15	XS_AMEM, segment represents memory image
@04	i16	xs_seg, segment number
@06	i8	xs_align, alignment, as base 2 logarithm
@07	i8	xs_cres, unused
@08	i32	xs_filpos, offset to segment image in file, in pages for 386 (see xe_pagesize)
@0C	i32	xs_psize, size of segment in file
@10	i32	xs_vsize, size of segment in memory
@14	i32	xs_rbase, base address for relocations, modulo page size for 386 (see xe_pagesize)
@18	i16	xs_noff, offset to segment name in string table
@1A	i16	xs_sres, reserved
@1C	i32	xs_lres, reserved

SECTION :Further work

> This format requires further research.

REFERENCE {} "XENIX 286 C Library Guide, Appendix B (1984-11)"
# p141
REFERENCE {} "ACS-586 XENIX C Compiler Release Notes (1984-05-29)"
REFERENCE {} "XENIX System V Development System C Language Guide, Section 7.17 (1987-06-28)"
# p651
REFERENCE {} "XENIX System V Development System C Language Guide, Section 7.17 (1988-10)"
# p189
REFERENCE {} "XENIX System V Operating System User's Guide"
# p415

######## Mach-O

TITLE macho:Mach-O binary file

SECTION :Further work

> This format requires documentation.

######## ELF

TITLE elf:ELF binary file

SECTION :Notes on the format

> The ELF format is well documented in an accessible format online. This section also focuses on some of the more obscure features, such as the extensions provided by IBM's port of <a href="https://en.wikipedia.org/wiki/Workplace_OS">OS/2 to the PowerPC architecture</a>.{OS2}

SECTION :Overall layout

{eheader}
{pheader}, optional for objects, required for executables
Segment/section data
{sheader}, required for objects, optional for executables

SECTION eheader:ELF header

@00	c[0x10]	<tt>e_ident</tt>, machine-independent data to interpret the file's content, such as word size and byte order
		@00	c[4]	<tt>EI_MAG = ELFMAG = "\x7F" "ELF"</tt>, signature
		@04	i8	<tt>EI_CLASS</tt>, file class
			=0	<tt>ELFCLASSNONE</tt>, invalid
			=1	<tt>ELFCLASS32</tt>, offsets and addresses are encoded as 32-bit fields
			=2	<tt>ELFCLASS64</tt>, offsets and addresses are encoded as 64-bit fields
		@05	i8	<tt>EI_DATA</tt>, data encoding
			=0	<tt>ELFDATANONE</tt>, invalid
			=1	<tt>ELFDATA2LSB</tt>, 2's complement, least significant byte first (little endian)
			=2	<tt>ELFDATA2MSB</tt>, 2's complement, most significant byte first (big endian)
		@06	i8	<tt>EI_VERSION</tt>, file version
			=0	<tt>EV_NONE</tt>, invalid
			=1	<tt>EV_CURRENT</tt>, current version
		@07	i8	<tt>EI_OSABI</tt>, operating system and ABI
# TODO
		@08	i8	<tt>EI_ABIVERSION</tt>, ABI version
# TODO
		@09	c[9]	<tt>EI_PAD</tt>, padding, filled with zeros
		@0F		<tt>EI_NIDENT</tt>, end of <tt>e_ident</tt>
@10	i16	<tt>e_type</tt>, object type
		=0x0000	<tt>ET_NONE</tt>, no type
		=0x0001	<tt>ET_REL</tt>, relocatable
		=0x0002	<tt>ET_EXEC</tt>, executable
		=0x0003	<tt>ET_DYN</tt>, shared object
		=0x0004	<tt>ET_CORE</tt>, core dump
		=0xFE00	<tt>ET_LOOS</tt>, first operating system specific
		=0xFEFF	<tt>ET_HIOS</tt>, last operating system specific
		=0xFF00	<tt>ET_LOPROC</tt>, first processor specific
		=0xFFFF	<tt>ET_HIPROC</tt>, last processor specific
@12	i16	<tt>e_machine</tt>, architecture type (partial list)
		=0x0000	<tt>EM_NONE</tt>, no machine
		=0x0001	<tt>EM_M32</tt>, "AT&T WE 32100"
		=0x0002	<tt>EM_SPARC</tt>, "SPARC"
		=0x0003	<tt>EM_386</tt>, "Intel 80386"
		=0x0004	<tt>EM_68K</tt>, "Motorola 68000"
		=0x0005	<tt>EM_88K</tt>, "Motorola 88000"
		=0x0008	<tt>EM_MIPS</tt>, "MIPS I"
		=0x0014	<tt>EM_PPC</tt>, 32-bit "PowerPC"
		=0x0015	<tt>EM_PPC64</tt>, "64-bit PowerPC"
		=0x0028	<tt>EM_ARM</tt>, "ARM 32-bit architecture (AARCH32)"
		=0x0029	<tt>EM_ALPHA</tt>, "Digital Alpha"
		=0x002B	<tt>EM_SPARCV9</tt>, "SPARC Version 9"
		=0x0032	<tt>EM_IA_64</tt>, "Intel IA-64 processor architecture", Itanium
		=0x003E	<tt>EM_X86_64</tt>, "AMD x86-64 architecture", AMD64
		=0x0040	<tt>EM_PDP10</tt>, "Digital Equipment Corp. PDP-10"
		=0x0041	<tt>EM_PDP11</tt>, "Digital Equipment Corp. PDP-11"
		=0x004B	<tt>EM_VAX</tt>, "Digital VAX"
		=0x0050	<tt>EM_MMIX</tt>, "Donald Knuth's educational 64-bit processor"
		=0x005C	<tt>EM_OPENRISC</tt>, "OpenRISC 32-bit embedded processor"
		=0x0061	<tt>EM_NS32K</tt>, "National Semiconductor 32000 series"
		=0x00B7	<tt>EM_AARCH64</tt>, "ARM 64-bit architecture (AARCH64)"
		=0x00DC	<tt>EM_Z80</tt>, "Zilog Z80"
		=0x00F3	<tt>EM_RISCV</tt>, "RISC-V"
# TODO: complete all missing codes
		=0x00F4	<tt>EM_LANAI</tt>, "Lanai 32-bit processor"{binutils}
		=0x00F5	<tt>EM_CEVA</tt>, "CEVA Processor Architecture Family"{binutils}
		=0x00F6	<tt>EM_CEVA_X2</tt>, "CEVA X2 Processor Family"{binutils}
		=0x00F7	<tt>EM_BPF</tt>, "Linux BPF"{binutils}
		=0x00F8	<tt>EM_GRAPHCORE_IPU</tt>, "Graphcore Intelligent Processing Unit"{binutils}
		=0x00F9	<tt>EM_IMG1</tt>, "Imagination Technologies"{binutils}
		=0x00FA	<tt>EM_NFP</tt>, "Netronome Flow Processor"{binutils}
		=0x00FB	<tt>EM_VE</tt>, "NEC Vector Engine"{binutils}
		=0x00FC	<tt>EM_CSKY</tt>, "C-SKY processor family"{binutils}
		=0x00FD	<tt>EM_ARC_COMPACT3_64</tt>, "Synopsys ARCv2.3 64-bit"{binutils}
		=0x00FE	<tt>EM_MCS6502</tt>, "MOS Technologies MCS 6502 processor"{binutils}
		=0x00FF	<tt>EM_ARC_COMPACT3</tt>, "Synopsys ARCv2.3 32-bit"{binutils}
		=0x0100	<tt>EM_KVX</tt>, "Kalray VLIW core of the MPPA processor family"{binutils}
		=0x0101	<tt>EM_65816</tt>, "WDC 65816/65C816"{binutils}
		=0x0102	<tt>EM_LOONGARCH</tt>, "LoongArch"{binutils}
		=0x0103	<tt>EM_KF32</tt>, "ChipON KungFu32"{binutils}
		=0x0104	<tt>EM_U16_U8CORE</tt>, "LAPIS nX-U16/U8"{binutils}
		=0x0105	<tt>EM_TACHYUM</tt>, "Tachyum"{binutils}
		=0x0106	<tt>EM_56800EF</tt>, "NXP 56800EF Digital Signal Controller (DSC)"{binutils}
		=0x1966	<tt>EM_MOS</tt>, MOS 6502 family (duplicates EM_MCS6502 and EM_65816){https://llvm-mos.org/wiki/ELF_specification|<sup>LLVM-MOS</sup>}
@14	i32	<tt>e_version</tt>, object file format version
		=0	<tt>EV_NONE</tt>, invalid
		=1	<tt>EV_CURRENT</tt>, current version
@18	i32/i64	<tt>e_entry</tt>, virtual address of entry point
@1C/20	i32/i64	<tt>e_phoff</tt>, offset to {pheader} in bytes from file start
@20/28	i32/i64	<tt>e_shoff</tt>, offset to {sheader} in bytes from file start
@24/30	i32	<tt>e_flags</tt>, processor specific flags
@28/32	i16	<tt>e_ehsize</tt>, size of {eheader} in bytes<br>for <tt>EV_CURRENT</tt>, it should be 0x34 for 32-bit objects, 0x3E for 64-bit objects
@2A/34	i16	<tt>e_phentsize</tt>, size of a single entry in {pheader} in bytes<br>for <tt>EV_CURRENT</tt>, if non-zero, it should be 0x20 for 32-bit objects, 0x38 for 64-bit objects
@2C/36	i16	<tt>e_phnum</tt>, number of entries in {pheader}
@2E/38	i16	<tt>e_shentsize</tt>, size of a single entry in {sheader} in bytes<br>for <tt>EV_CURRENT</tt>, if non-zero, it should be 0x28 for 32-bit objects, 0x40 for 64-bit objects
@30/3A	i16	<tt>e_shnum</tt>, number of entries in {sheader}<br>If greater or equal than 0xFF00, 0 is stored here, and the <tt>sh_size</tt> field in the first entry of the {sheader} contains the value
@32/3C	i16	<tt>e_shstrndx</tt>, section header index for section name string table<br>If greater or equal than 0xFF00, 0 is stored here, and the <tt>sh_link</tt> field in the first entry of the {sheader}

SECTION pheader:Program header

> A single entry has the following form. Note that the offset between entries is <tt>e_phentsize</tt> as found in the {eheader}. Its format is slightly different between 32-bit and 64-bit versions.

@00	i32	<tt>p_type</tt>
		0x00000000	<tt>PT_NULL</tt>, unused
		0x00000001	<tt>PT_LOAD</tt>, loadable segment
		0x00000002	<tt>PT_DYNAMIC</tt>, dynamic linking information
		0x00000003	<tt>PT_INTERP</tt>, null-terminated path name for interpreter to invoke<br>must have at most 1 entry, only defined for executables
		0x00000004	<tt>PT_NOTE</tt>, auxiliary information
		0x00000005	<tt>PT_SHLIB</tt>, reserved
		0x00000006	<tt>PT_PHDR</tt>, program header, must have at most 1 entry<br>only occurs if program header is part of memory image, must precede all other segment entries
		0x00000007	<tt>PT_TLS</tt>, thread-local storage template
		0x60000000	<tt>PT_LOOS</tt>, first operating system specific type
		0x6FFFFFFF	<tt>PT_HIOS</tt>, last operating system specific type
		0x70000000	<tt>PT_LOPROC</tt>, first processor specific type
		0x7FFFFFFF	<tt>PT_HIPROC</tt>, last processor specific type
		0x80000000	<tt>PT_LOUSER</tt>, first application specific type
		0x8FFFFFFF	<tt>PT_HIUSER</tt>, last application specific type
		0x60000001	<tt>PT_OS</tt>, IBM OS/2 extension, identifies the target operating system{OS2}
		0x60000002	<tt>PT_RES</tt>, IBM OS/2 extension, read-only resource data{OS2}
		0x6474E550	<tt>PT_SUNW_EH_FRAME</tt>, <tt>PT_GNU_EH_FRAME</tt>, Solaris extension, frame unwind information{binutils}
		0x6474E551	<tt>PT_GNU_STACK</tt>, GNU extension, stack flags{binutils}
		0x6474E552	<tt>PT_GNU_RELRO</tt>, GNU extension, read-only after relocation{binutils}
		0x6474E553	<tt>PT_GNU_PROPERTY</tt>, GNU extension, GNU property{binutils}
		0x6474E554	<tt>PT_GNU_SFRAME</tt>, GNU extension, stack trace information{binutils}
		0x6474E555	<tt>PT_GNU_MBIND_LO</tt>, GNU extension{binutils}
		0x6474F554	<tt>PT_GNU_MBIND_HI</tt>, GNU extension{binutils}
		0x65A3DBE5	<tt>PT_OPENBSD_MUTABLE</tt>, OpenBSD extension, mutable .bss{binutils}
		0x65A3DBE6	<tt>PT_OPENBSD_RANDOMIZE</tt>, OpenBSD extension, fill with random data{binutils}
		0x65A3DBE7	<tt>PT_OPENBSD_WXNEEDED</tt>, OpenBSD extension, program does W^X violation{binutils}
		0x65A3DBE8	<tt>PT_OPENBSD_NOBTCFI</tt>, OpenBSD extension, no branch target CFI{binutils}
		0x65A41BE6	<tt>PT_OPENBSD_BOOTDATA</tt>, OpenBSD extension, section for boot arguments{binutils}
@-/04	-/i32	<tt>p_flags</tt>
		%0	<tt>PF_X</tt>, executable
		%1	<tt>PF_W</tt>, writable
		%2	<tt>PF_R</tt>, readable
		%20:27	<tt>PF_MASKOS</tt>, operating system specific
		%28:31	<tt>PF_MASKPROC</tt>, processor specific
		%24	<tt>PF_S</tt>, IBM OS/2 extension, shared segment{OS2}
		%25	<tt>PF_K</tt>, IBM OS/2 extension, mapped to kernel address space<br>kernel extension, executes at supervisor privilege, implicitly memory resident<br>only valid for DLLs, must be specified for all <tt>PT_LOAD</tt> segments if used{OS2}
		%26	<tt>PF_M</tt>, IBM OS/2 extension, memory resident<br>must be specified for all <tt>PT_LOAD</tt> segments if used{OS2}
@04/08	i32/i64	<tt>p_offset</tt>, offset to data from start of file
@08/10	i32/i64	<tt>p_vaddr</tt>, virtual address to load at
@0C/18	i32/i64	<tt>p_paddr</tt>, physical address to load at, unused for System V executables and shared objects
@10/20	i32/i64	<tt>p_filesz</tt>, number of bytes in the file image
@14/28	i32/i64	<tt>p_memsz</tt>, number of bytes in the memory image
@18/-	i32/-	<tt>p_flags</tt>, see above
@1C/30	i32/i64	<tt>p_align</tt>, alignment constraint, 0 or 1 means no constraint, otherwise must be a power of 2

SECTION sheader:Section header

> A single entry has the following form. Note that the offset between entries is <tt>e_shentsize</tt> as found in the {eheader}. Its format is slightly different between 32-bit and 64-bit versions.

@00	i32	<tt>sh_name</tt>, index into the section header table (<tt>e_shstrndx</tt>) for the name, or 0
@04	i32	<tt>sh_type</tt>
		0x00000000	<tt>SHT_NULL</tt>, inactive entry, entry 0 must be of this type
		0x00000001	<tt>SHT_PROGBITS</tt>, program data (instructions, initialized data, etc.)
		0x00000002	<tt>SHT_SYMTAB</tt>, symbol table, expected to have at most 1, used for linking
		0x00000003	<tt>SHT_STRTAB</tt>, string table
		0x00000004	<tt>SHT_RELA</tt>, relocation table with explicit addends
		0x00000005	<tt>SHT_HASH</tt>, symbol hash table, expected to have at most 1
		0x00000006	<tt>SHT_DYNAMIC</tt>, information for dynamic linking, expected to have at most 1
		0x00000007	<tt>SHT_NOTE</tt>, information to mark the file
		0x00000008	<tt>SHT_NOBITS</tt>, program data, not present in file (uninitialized data)
		0x00000009	<tt>SHT_REL</tt>, relocation table without explicit addends
		0x0000000A	<tt>SHT_SHLIB</tt>, reserved
		0x0000000B	<tt>SHT_DYNSYM</tt>, symbol table, expected to have at most 1, used for dynamic linking
# TODO
		0x0000000E	<tt>SHT_INIT_ARRAY</tt>
# TODO
		0x0000000F	<tt>SHT_FINI_ARRAY</tt>
# TODO
		0x00000010	<tt>SHT_PREINIT_ARRAY</tt>
		0x00000011	<tt>SHT_GROUP</tt>, defines a group of sections, only allowed in relocatable objects, entry must precede contained sections
# TODO
		0x00000012	<tt>SHT_SYMTAB_SHNDX</tt>
		0x60000000	<tt>SHT_LOOS</tt>, first operating system specific type
		0x6FFFFFFF	<tt>SHT_HIOS</tt>, last operating system specific type
		0x70000000	<tt>SHT_LOPROC</tt>, first processor specific type
		0x7FFFFFFF	<tt>SHT_HIPROC</tt>, last processor specific type
		0x80000000	<tt>SHT_LOUSER</tt>, first application specific type
		0x8FFFFFFF	<tt>SHT_HIUSER</tt>, last application specific type
		0x60000001	<tt>SHT_OS</tt>, IBM OS/2 extension, identifies the target operating system{OS2}
		0x60000002	<tt>SHT_IMPORTS</tt>, IBM OS/2 extension, external symbol references{OS2}
		0x60000003	<tt>SHT_EXPORTS</tt>, IBM OS/2 extension, exported symbols{OS2}
		0x60000004	<tt>SHT_RES</tt>, IBM OS/2 extension, read-only resource data{OS2}
		0x6FFF4700	<tt>SHT_GNU_INCREMENTAL_INPUTS</tt>, GNU extension, incremental build data{binutils}
		0x6FFFFFF5	<tt>SHT_GNU_ATTRIBUTES</tt>, GNU extension, object attributes{binutils}
		0x6FFFFFF6	<tt>SHT_GNU_HASH</tt>, GNU extension, GNU style symbol hash table{binutils}
		0x6FFFFFF7	<tt>SHT_GNU_LIBLIST</tt>, GNU extension, list of prelinked dependencies{binutils}
		0x6FFFFFFD	<tt>SHT_SUNW_verdef</tt>, <tt>SHT_GNU_verdef</tt>, Solaris extension, versions defined by file{binutils}
		0x6FFFFFFE	<tt>SHT_SUNW_verneed</tt>, <tt>SHT_GNU_verneed</tt>, Solaris extension, versions needed by file{binutils}
		0x6FFFFFFF	<tt>SHT_SUNW_versym</tt>, <tt>SHT_GNU_versym</tt>, Solaris extension, symbol versions{binutils}
@08	i32/i64	<tt>sh_flags</tt>, section properties
		%0	<tt>SHF_WRITE</tt>, writable during execution
		%1	<tt>SHF_ALLOC</tt>, resides in memory during execution
		%2	<tt>SHF_EXECINSTR</tt>, contains machine instructions
		%4	<tt>SHF_MERGE</tt>, data may be merged during linking, <tt>sh_entsize</tt> contains an element size, unless <tt>SHF_STRINGS</tt> is set
		%5	<tt>SHF_STRINGS</tt>, contains null-terminated strings, <tt>sh_entsize</tt> gives the character size
		%6	<tt>SHF_INFO_LINK</tt>, <tt>sh_info</tt> contains a section header index
		%7	<tt>SHF_LINK_ORDER</tt>, must preserve order with section index <tt>sh_link</tt> when linking
		%8	<tt>SHF_OS_NONCONFORMING</tt>, requires OS-specific processing
		%9	<tt>SHF_GROUP</tt>, member of a section group
		%10	<tt>SHF_TLS</tt>, holds thread-local storage, each thread will have a separate copy during execution
		%11	<tt>SHF_COMPRESSED</tt>, data is compressed, must not be used for <tt>SHT_NOBITS</tt> or together with <tt>SHF_ALLOC</tt>
		%20:27	<tt>SHF_MASKOS</tt>, mask for operating system semantics
		%24:27	Value for <tt>SHF_MASKOS</tt> before 1999-10-04{binutils}
		%28:31	<tt>SHF_MASKPROC</tt>, mask for processor semantics
		%24	<tt>SHF_BEGIN</tt>, IBM OS/2 extension, signals that this must be placed before other like-named sections{OS2}
		%25	<tt>SHF_END</tt>, IBM OS/2 extension, signals that this must be placed after other like-named sections{OS2}
		%21	<tt>SHF_GNU_RETAIN</tt>, GNU extension, section should not be garbage collected by linker{binutils}
		%24	<tt>SHF_GNU_MBIND</tt>, GNU extension{binutils}
		%31	<tt>SHF_EXCLUDE</tt>, exclude from linking into non-relocatable objects{binutils}
@0C/10	i32/i64	<tt>sh_addr</tt>, address at which section should appear, or 0
@10/18	i32/i64	<tt>sh_offset</tt>, offset to section data from start of file; a section of type <tt>SHT_NOBITS</tt> will contain a conceptual offset
@14/20	i32/i64	<tt>sh_size</tt>, size of section in bytes; unless <tt>sh_type</tt> is <tt>SHT_NOBITS</tt>, this many bytes appear in the file
@18/28	i32	<tt>sh_link</tt>
@1C/2C	i32	<tt>sh_info</tt>
@20/30	i32/i64	<tt>sh_addralign</tt>, alignment constraint, 0 or 1 mean no alignment, otherwise it must be a power of 2
@24/38	i32/i64	<tt>sh_entsize</tt>, for tables, the size of a single entry

> Sections are indexed from 0, but the first section entry should be an <tt>SHT_NULL</tt> type with all fields, except for <tt>sh_size</tt> which contains the number of sections if greater or equal to 0xFF00, and <tt>sh_link</tt> which contains the index of of the section header string table if greater or equal to 0xFF00.

> Some section values are reserved and have special semantics:

0x0000	<tt>SHN_UNDEF</tt>, section index is missing or irrelevant
0xFF00	<tt>SHN_LORESERVE</tt>, first special semantics
0xFF00	<tt>SHN_LOPROC</tt>, first processor specific entry
0xFF1F	<tt>SHN_HIPROC</tt>, last processor specific entry
0xFF20	<tt>SHN_LOOS</tt>, first operating system specific entry
0xFF3F	<tt>SHN_HIOS</tt>, last operating system specific entry
0xFFF1	<tt>SHN_ABS</tt>, absolute reference, no associated section
0xFFF2	<tt>SHN_COMMON</tt>, unallocated variables (FORTRAN COMMON, C external uninitialized)
0xFFFF	<tt>SHN_XINDEX</tt>, signals that actual value greater or equal than 0xFF00
0xFFFF	<tt>SHN_HIRESERVE</tt>, last special semantics

> The field entries <tt>sh_link</tt> and <tt>sh_info</tt> have semantics that depend on the section type:

name	<tt>sh_link</tt>	<tt>sh_info</tt>
<tt>SHT_DYNAMIC</tt>	string table	0
<tt>SHT_HASH</tt>	symbol table	0
<tt>SHT_REL</tt><br><tt>SHT_RELA</tt>	symbol table	section to relocate
<tt>SHT_SYMTAB</tt><br><tt>SHT_DYNSYM</tt>	string table	index after last local symbol (<tt>STB_LOCAL</tt>)
<tt>SHT_GROUP</tt>	symbol table	symbol table index for group signature
<tt>SHT_SYMTAB_SHNDX</tt>	symbol table	0
<tt>SHT_IMPORTS</tt>	string table	0
<tt>SHT_EXPORTS</tt>	symbol table	string table

> Some sections have special semantics.

name	type	attributes
<tt>.bss</tt>	<tt>SHT_NOBITS</tt>	<tt>SHF_ALLOC+SHF_WRITE</tt>
<tt>.data</tt>	<tt>SHT_PROGBITS</tt>	<tt>SHF_ALLOC+SHF_WRITE</tt>
<tt>.debug</tt>	<tt>SHT_PROGBITS</tt>	0
<tt>.dynamic</tt>	<tt>SHT_DYNAMIC</tt>	<tt>SHF_ALLOC</tt>, depending on processor, also <tt>SHF_WRITE</tt>
<tt>.dynstr</tt>	<tt>SHT_STRTAB</tt>	<tt>SHF_ALLOC</tt>
<tt>.dynsym</tt>	<tt>SHT_DYNSYM</tt>	<tt>SHF_ALLOC</tt>
<tt>.got</tt>	<tt>SHT_PROGBITS</tt>	???
<tt>.hash</tt>	<tt>SHT_HASH</tt>	<tt>SHF_ALLOC</tt>
<tt>.interp</tt>	<tt>SHT_PROGBITS</tt>	optionally <tt>SHF_ALLOC</tt>
<tt>.line</tt>	<tt>SHT_PROGBITS</tt>	0
<tt>.plt</tt>	<tt>SHT_PROGBITS</tt>	???
<tt>.rel</tt><i>name</i>	<tt>SHT_REL</tt>	optionally <tt>SHF_ALLOC</tt>
<tt>.rodata</tt>	<tt>SHT_PROGBITS</tt>	<tt>SHF_ALLOC</tt>
<tt>.shstrtab</tt>	<tt>SHT_STRTAB</tt>	0
<tt>.strtab</tt>	<tt>SHT_STRTAB</tt>	optionally <tt>SHF_ALLOC</tt>
<tt>.symtab</tt>	<tt>SHT_SYMTAB</tt>	optionally <tt>SHF_ALLOC</tt>
<tt>.tbss</tt>	<tt>SHT_NOBITS</tt>	<tt>SHF_ALLOC+SHF_WRITE+SHF_TLS</tt>
<tt>.tdata</tt>	<tt>SHT_PROGBITS</tt>	<tt>SHF_ALLOC+SHF_WRITE+SHF_TLS</tt>
<tt>.text</tt>	<tt>SHT_PROGBITS</tt>	<tt>SHF_ALLOC+SHF_EXECINSTR</tt>
<tt>.osinfo</tt>	<tt>SHT_OS</tt>	0
<tt>.imports</tt>	<tt>SHT_IMPORTS</tt>	<tt>SHF_ALLOC</tt>
<tt>.exports</tt>	<tt>SHT_EXPORTS</tt>	<tt>SHF_ALLOC</tt>
<tt>.res</tt>	<tt>SHT_RES</tt>	0

# TODO: fill in missing ones

SECTION 1/:Symbol table

> A symbol table is a section that contains an array of the following entries.

@00	i32	<tt>st_name</tt>
@04/-	i32/-	<tt>st_value</tt>, semantics depend on type
@08/-	i32/-	<tt>st_size</tt>, size of symbol or 0 if unknown
@0C/04	i8	<tt>st_info</tt>
		%0:3	<tt>st_type</tt>
			0x0	<tt>STT_NOTYPE</tt>, unspecified
			0x1	<tt>STT_OBJECT</tt>, symbol is a data object (variable, array)
			0x2	<tt>STT_FUNC</tt>, symbol is a function
			0x3	<tt>STT_SECTION</tt>, symbol is a section, typically <tt>STB_LOCAL</tt>
			0x4	<tt>STT_FILE</tt>, symbol name is the source file name<br>if present, it conventionally precedes all other symbols, has section <tt>SHN_ABS</tt> and type <tt>SHB_LOCAL</tt>
			0x5	<tt>STT_COMMON</tt>, symbol for an uninitialized common block
			0x6	<tt>STT_TLS</tt>, symbol for a thread-local storage entry, contains the offset, not the address of the symbol
			0xA	<tt>STT_LOOS</tt>, first operating system specific symbol type
			0xC	<tt>STT_HIOS</tt>, last operating system specific symbol type
			0xD	<tt>STT_LOPROC</tt>, first processor specific symbol type
			0xF	<tt>STT_HIPROC</tt>, last processor specific symbol type
			0xB	<tt>STT_IMPORT</tt>, IBM OS/2 extension: a function symbol that must be imported, <tt>st_value</tt> contains offset of import table entry{OS2}
		%4:7	<tt>st_bind</tt>
			0x0	<tt>STB_LOCAL</tt>, not visible outside object file
			0x1	<tt>STB_GLOBAL</tt>, visible to all files, undefined symbols will match a global symbol
			0x2	<tt>STB_WEAK</tt>, global symbol of lower precedence when matching
			0xA	<tt>STB_LOOS</tt>, first operating system specific binding type
			0xC	<tt>STB_HIOS</tt>, last operating system specific binding type
			0xD	<tt>STB_LOPROC</tt>, first processor specific binding type
			0xF	<tt>STB_HIPROC</tt>, last processor specific binding type
			0xC	<tt>STB_ENTRY</tt>, IBM OS/2 extension: entry point<br>only for relocatable objects, must have at most 1{OS2}
@0D/05	i8	<tt>st_other</tt>
		%0:1	<tt>st_visibility</tt>
			0x00	<tt>STV_DEFAULT</tt>
			0x01	<tt>STV_INTERNAL</tt>
			0x02	<tt>STV_HIDDEN</tt>
			0x03	<tt>STV_PROTECTED</tt>
@0E/06	i16	<tt>st_shndx</tt>, section relative to which this symbol is defined
		<tt>SHN_ABS</tt>	<tt>st_value</tt> is an absolute value
		<tt>SHN_COMMON</tt>	<tt>st_value</tt> contains an alignment constraint
		<tt>SHN_UNDEF</tt>	the symbol is undefined, must be defined in another object
		<tt>SHN_XINDEX</tt>	actual value is stored in a section of type <tt>SHT_SYMTAB_SHNDX</tt>
@-/08	-/i64	<tt>st_value</tt>, semantics depend on type
@-/10	-/i64	<tt>st_size</tt>, size of symbol or 0 if unknown

> Symbols are indexed from 0, but the first symbol entry should contain all zeroes and <tt>st_shndx</tt> should be <tt>SHN_UNDEF</tt>.

SECTION :OS/2 resource file format

> A resource file begins with a <tt>Res32_File</tt> header.{OS2}

@00	c[0x10]	<tt>rf_ident</tt>
		@00	c[4]	<tt>RF_MAG = '\x02RES'</tt>, signature
		@04	i8	<tt>RF_CLASS</tt>, file class
			=0	<tt>RESCLASSNONE</tt>, invalid
			=1	<tt>RESCLASS32</tt>, offsets and addresses are encoded as 32-bit fields
			=2	<tt>RESCLASS64</tt>, reserved for 64-bit architectures
		@05	i8	<tt>RF_DATA</tt>, data encoding
			=0	<tt>RESDATANONE</tt>, invalid
			=1	<tt>RESDATA2LSB</tt>, 2's complement, least significant byte first (little endian)
			=2	<tt>RESDATA2MSB</tt>, 2's complement, most significant byte first (big endian)
		@06	i8	<tt>RF_VERSION</tt>, file version
			=0	<tt>RV_NONE</tt>, invalid
			=1	<tt>RV_CURRENT</tt>, current version
		@07	c[0xB]	<tt>RF_PAD</tt>, padding, filled with zeros
@10	i32	<tt>rf_rfsize</tt>, size of header
@14	i32	<tt>rf_rcnum</tt>, number of resource collections
@18	i32	<tt>rf_rcoff</tt>, offset of resource collection array, from the start of the resource file<br>expected value: 0x1C

SECTION 1/:Resource collection array entry

> A resource collection array entry is a <tt>Res32_Col</tt> structure.{OS2}

@00	i32	<tt>rc_collection</tt>, offset to the resource collection relative to the resource file, must be word aligned
@04	i32	<tt>rc_size</tt>, total size of the resource collection in bytes

SECTION 1/:Resource collection

> A resource collection starts with the following header <tt>Res32_Hdr</tt>.{OS2}

@00	i16	<tt>rh_version</tt>, version of resource collection, should be 1
@02	i16	<tt>rh_flags</tt>, currently no flags are defined
@04	i32	<tt>rh_name</tt>, index into the resource string table
@08	i32	<tt>rh_rioff</tt>, offset to resource item array
@0C	i32	<tt>rh_rientsize</tt>, size of a resource item array entry, should be 0x14
@10	i32	<tt>rh_rinum</tt>, number of resources
@14	i32	<tt>rh_rhsize</tt>, header's size in bytes, should be 0x20
@18	i32	<tt>rh_strtab</tt>, offset to resource string table, relative to start of resource collection
@1C	i32	<tt>rh_locale</tt>, offset to the locale information, relative to the start of the resource collection<br>if present, it should follow the header

> The resource collection locale information, if present, is a <tt>Res32_Locale</tt> structure.{OS2}

@20	c16[2]	<tt>rl_country</tt>, two UCS-2 characters
@24	c16[2]	<tt>rl_language</tt>, two UCS-2 characters

> An array of <tt>Res32_Item</tt> entries follow.{OS2}

@00	i32	<tt>ri_type</tt>
@04	i32	<tt>ri_ordinal</tt>, each resource has a unique ordinal within its resource type
@08	i32	<tt>ri_name</tt>, offset to the resource string table
@0C	i32	<tt>ri_data</tt>, data offset, relative to the start of the resource collection
@10	i32	<tt>ri_size</tt>, size of resource data

SECTION :OS/2 operating system information (<tt>.osinfo</tt>)

> The system information is stored in a structure named <tt>Elf32_Os</tt>.{OS2}

@00	i32	<tt>os_type</tt>
		0x00000000	<tt>EOS_NONE</tt>
		0x00000001	<tt>EOS_PN</tt>, IBM Microkernel personality neutral
		0x00000002	<tt>EOS_SVR4</tt>, UNIX System V Release 4
		0x00000003	<tt>EOS_AIX</tt>, IBM AIX
		0x00000004	<tt>EOS_OS2</tt>, IBM OS/2, 32-bit environment
@04	i32	<tt>os_size</tt>, size of operating system specific information directly following this entry<br>for OS/2 it should be 0x10

> For OS/2, the following entries should be part of the structure <tt>Elf32_OS2Info</tt>.{OS2}

@08	i8	<tt>os2_sessiontype</tt>
		0x00	<tt>OS2_SES_NONE</tt>, only valid for DLLs
		0x01	<tt>OS2_SES_FS</tt>, full screen session
		0x02	<tt>OS2_SES_PM</tt>, presentation manager session
		0x03	<tt>OS2_SES_VIO</tt>, Windows character mode session
@09	i8	<tt>os2_sessionflags</tt>, session flags, none currently defined
@0A	c[0xE]	<tt>os2_reserved</tt>, reserved

SECTION :OS/2 import table (<tt>.imports</tt>)

> Each import table entry has the following structure.{OS2}

@00	i32	<tt>imp_ordinal</tt>, ordinal number of export, or -1 if referenced by name
@04	i32	<tt>imp_name</tt>, string table index for name, or 0 if referenced by ordinal
@08	i32	<tt>imp_info</tt>
		%0:23	<tt>imp_dll</tt>, interpretation depends on the type
		%24:31	<tt>imp_type</tt>
			0x00	<tt>IMP_IGNORED</tt>, ignored
			0x01	<tt>IMP_STR_IDX</tt>, value is string table index of name of load module
			0x02	<tt>IMP_DT_IDX</tt>, value is a 1-based reference to a <tt>DT_NEEDED</tt> entry in the dynamic segment
@0C	i32	<tt>imp_reserved</tt>, reserved

SECTION :OS/2 export table (<tt>.exports</tt>)

> Each export table entry has the following structure.{OS2}

@00	i32	<tt>exp_ordinal</tt>, ordinal number of export, or -1 if exported by name
@04	i32	<tt>exp_symbol</tt>, symbol table index
@08	i32	<tt>exp_name</tt>, string table index for name, or 0 if exported by ordinal
@0C	i32	<tt>exp_reserved</tt>, reserved

SECTION :BeOS Developer Release 4 resources

> This section requires documentation, see {HB}.

SECTION :Segment contents

> A <tt>PT_INTERP</tt> segment will contain an <tt>.interp</tt> section.

> A <tt>PT_PHDR</tt> segment will point to the program header section.

> A text segment will contain <tt>.text</tt>, <tt>.rodata</tt>, <tt>.hash</tt>, <tt>.dynsym</tt>, <tt>.dynstr</tt>, <tt>.plt</tt>, <tt>.rel.got</tt> sections.

> A data segment will contain <tt>.data</tt>, <tt>.dynamic</tt>, <tt>.got</tt>, <tt>.bss</tt> sections.

> A <tt>PT_DYNAMIC</tt> segment will point to a <tt>.dynamic</tt> section.

> A <tt>PT_OS</tt> segment will contain a <tt>.osinfo</tt> section. It should precede all other segments.{OS2}

> A <tt>PT_RES</tt> segment will contain a <tt>.res</tt> section. It should follow all other segments.{OS2}

SECTION :Dynamic linking

> TODO

SECTION :Further work

> This format requires documentation.

REFERENCE {SCO} "System V Application Binary Interface (Draft, 2013-06-10)" https://www.sco.com/developers/gabi/latest/contents.html
REFERENCE {binutils} "common.h - GNU Binutils sources" https://github.com/bminor/binutils-gdb/blob/master/include/elf/common.h
REFERENCE {OS2} "OS/2 Application Binary Interface for PowerPC (32-bit), 1995-12-08" https://archive.org/details/OS2PowerPCBinaryInterface
REFERENCE {HB} "Tools for Hobbit-based BeOS machines" https://sourceforge.net/projects/hobbitbeos/

######## Flat binary

TITLE cpm:Flat binary file

SECTION flat_pifed:Program Information

> For MS-DOS <tt>.com</tt> files, the <tt>PIFED</tt>{PIFED} utility from Concurrent DOS 386 embeds a special structure to encode program information data. It immediately follows the last data byte in the file. It can be recognized by its special signature. For the layout, refer to the <a href='#pifed'>Program Information section</a> for the MZ format.

REFERENCE {PIFED} "Concurrent DOS 386 PIFED.EXE"

######## CMD (FLEX)

TITLE cmd_flex:FLEX binary file
SECTION :Overall layout

> A binary file is composed of several binary records.

SECTION :Binary record

> Load a series of bytes into a specified address in memory.

@00	i8	0x02
@01	i16be	Load address
@03	i8	Number of following bytes in record{FLEXEMU} (Note: {APG} claims this includes first 4 bytes, disk image does not comply with this)
@04	c[*]	Binary data

SECTION :Transfer address record

> Specifies the entry point of a command.

@00	i8	0x16{FLEXEMU} (Note: {APG} is claims this is an ACK but actually it's a SYN)
@01	i16be	Transfer address

> Only the last transfer address is used

SECTION :Terminating record

> Terminates the list of records.{FLEXEMU}

@00	i8	0x00

REFERENCE {APG} "FLEX Advanced Programmer's Guide" http://www.flexusergroup.com/flexusergroup/pdfs/flexapg.pdf
REFERENCE {FLEXEMU} "Flexemu emulator" https://github.com/aladur/flexemu

######## PRL

TITLE prl:MP/M-80 Page Relocatable Format
SECTION :Overall layout

{header}
Program image
{relocs}

SECTION header:Executable Header

@00	i8	=0
@01	i16le	Size of program image in bytes
@03	i8	=0
@04	i16le	Size of bss, data to clear out
@06	i8	=0
@07	i16le	Load address, only used for <tt>.ovl</tt>, 0 for other files.<br><tt>.prl</tt> and <tt>.rsp</tt> files are assembled to be loaded at 0x0100, <tt>.spr</tt> files at 0x0000.
@09	i8	=0
@0A	i16le	The length of the code group, only used for <tt>.spr</tt> in banked systems<br>The data segment is aligned to the following 0x0100 byte page{PUG}<br>({JE} claims this is the base address of the code group, this could not be verified by executing LINK)
@0C	c[0xF4]	Reserved, must be 0

SECTION relocs:Relocation information

> Except for <tt>.ovl</tt> files, a bitmap follows with one bit for each byte in the program image, for a total of (size + 7) / 8 bytes. Each bit specifies whether the corresponding byte in the image encodes the most significant byte of an address, which the system can use to relocate the image to another 256 byte page boundary.

> The first byte of the image corresponds to the most significant bit of the first byte of the relocations.

REFERENCE {JE} "PRL file format (John Elliot's homepage)" http://www.seasip.info/Cpm/prl.html
REFERENCE {PUG} "Digital Research Programmer's Utilities Guide For the CP/M Family of Operating Systems (1982-09)"

######## CPM3

TITLE cpm3:CP/M-80 Plus Executable
SECTION :Overall layout

{header}
Program image
RSX 1 image
RSX 2 image
...

SECTION header:Executable Header

> When this header is present, the entire file is loaded at address 0x0100. After the pre-initialization code is executed, the header is removed and the image is relocated to address 0x0100 from the previous 0x0200.

@00	i8	0xC9, corresponds to an Intel 8080/Zilog Z80 <tt>RET</tt> instruction that would immediately return to the system
@01	i16le	Size of program image in bytes, without this header or the RSX images
@03	c[10]	Pre-initialization code, executed before relocating the image, must return with <tt>RET</tt>. Intended for SCBs.
@0D	i8	Loader flag: normally if no RSXs are present, the loader does not stay active after loading
		=0xFF	No RSXs are attached, but Loader must remain active
@0E	i8	Reserved
@0F	i8	Number of RSXs
@10	c[0xF0]	Up to 15 RSX records

SECTION 1/rsxrec:RSX record

@00	i16le	Offset of RSX image from file base
@02	i16le	Size of RSX initialized data
@04	i8	Non-banked flag
		=0xFF	RSX must only be loaded for non-banked systems
@05	i8	Reserved
@06	c[8]	Original RSX filename
@0E	c[2]	Reserved

> The actual RSX image comes without the PRL header, but with relocations present.

REFERENCE {JE} "CP/M 3 COM file header (John Elliot's homepage)" http://www.seasip.info/Cpm/rsxrec.html

######## CMD

TITLE cmd:CP/M-80 Executable Format
SECTION :Overall layout

> The CMD file format has evolved through several versions. The original version only contained the header and group data, with relocations and RSXs added later. Later FlexOS added shared run-time library (SRTL) support, and then a fast load section.

{header}
{srtl} (FlexOS only)
{fastload} (FlexOS only)
Group 1 image
Group 2 image
...
{relocs}
{rsxindex} (CP/M Plus and DOSPlus only)

SECTION header:Executable Header

@00	c[9 &times; 8]	Up to 8 descriptors
		@00	i8	Group type (only the low 4 bits are actually used{CPMSG})
			=0x00	End of descriptors (not a descriptor)
			=0x01	Code, may be written to (loaded into CS, also DS and ES if no data/extra groups provided)
			=0x02	Data (loaded into DS, also ES if no extra group provided)
			=0x03	Extra (loaded into ES)
			=0x04	Stack (<b>not</b> loaded into SS)
			=0x05	Auxiliary 1 (not FlexOS)
			=0x06	Auxiliary 2 (not FlexOS)
			=0x07	Auxiliary 3 (not FlexOS)
			=0x08	Auxiliary 4 (not FlexOS)<br>Relocations{FLEXOS} (FlexOS, group is optional)
			=0x09	Pure code, can be shared between processes (loaded into CS)
			=0x0A-0x0E	Reserved
			=0x0F	Escape code for additional types (not FlexOS)
			=0xFE	FASTLOAD group descriptor (must appear at 0x51)
			=0xFF	Shared run-time library group descriptor (must appear at 0x48){FLEXOS}
		@01	i16le	Length of group in 16 byte paragraphs, as stored in file
		@03	i16le	Base address of group in 16 byte paragraphs, 0 if relocatable (normally non-zero only in executable files)
		@05	i16le	Minimum size in memory in 16 byte paragraphs (corresponds to data and bss)
		@07	i16le	Maximum size in memory in 16 byte paragraphs (includes heap)
@48	c[9]	(FlexOS only): {srtl} descriptor (GDSRTL)
		=0xFF	{srtl} present, program includes shared libraries{FLEXOS} (the group sizes seem to be filled{OWN})
@51	c[9]	(FlexOS only): File is in fast load format
		=0xFE	{fastload}{OWN}
@5A	c[6]	Reserved
@60	c[0x10]	(FlexOS only): {srtlid}, present for shared run-time libraries{FLEXOS}
@70	c[0x0A]	Reserved
@7A	i8	Bit field
		%0	F1, when the program opens a file in locked mode, other programs may also open it{CDOSRG}{OWN}
		%1	F2, program may access a file even after closing it{CDOSRG}{OWN}
		%2	F3, ignore checksum errors on closing a file, used when program modifies the FCB before closing it{CDOSRG}{OWN}
		%3	F4, ignore checksum errors on reading or writing a file, used when program modifies the FCB before closing it{CDOSRG}{OWN}
@7B	i16le	Offset to {rsxindex} in 128 byte records{JE}
@7D	i16le	Offset to {relocs} in 128 byte records
@7F	i8	Bit field
		%1	Set when the program cannot be run in banked memory{CDOSRG}{OWN}
		%2	The program uses MP/M-86 record locking functions instead of Concurrent DOS ones{CDOSRG}{OWN}
		%3	Must be suspended when running in background, used for applications with direct video access{CDOSXM}
		%4	This is an RSX (system extension) file, not a CMD (command) file{JE}
		%5:6	8087 usage
			=0	Does not use 8087
			=1	Requires 8087
			=2	Optional 8087 support
		%7	Requires relocation

SECTION 1/srtlid:SRTL identifier

> This record can be found in the header as well as in the Shared runtime library group.{FLEXOS}

@00	c[8]	SRTL (shared run-time library) name; the full filename has extension '.SRL'
@08	i16le	Major version
@0A	i16le	Minor version
@0C	i32le	Flags (reserved)

#<td>@0x10</td>
#<td>#0x02</td>
#<td>u16le</td>
#<td>number of relocations</td>

SECTION srtl:Shared run-time library group

> This group stores the shared run-time libraries required for execution.{FLEXOS}

@00	i16le	Number of included shared run-time libraries
@02	c[*]	Sequence of SRTL (shared run-time libraries) identifiers and relocation count entries

> For non-FASTLOAD files, each entry has the following format:

@00	c[8]	{srtlid}
@10	i16le	Number of relocations for this library

> For FASTLOAD files, the entries are extended:

@00	c[8]	{srtlid}
@10	i16le	Number of relocations for this library (0){POSTLINK}
@12	i16le	Index of first selector referencing this library{POSTLINK}
@14	i16le	unknown{POSTLINK}

SECTION fastload:FASTLOAD group

> The FASTLOAD group is typically 0x650 bytes, it starts with an 8 byte header:{OWN}

@00	i16le	Maximum allowed LDT entries{POSTLINK}, typically 0xC8 or 2 after the first free index after LDT
@02	i16le	First free index after LDT{POSTLINK}
@04	i16le	Index base{POSTLINK}, typically 0x0C
@06	i16le	First used index{POSTLINK}, typically 0x00 or 0x0C

> Then a descriptor table follows, similar to a 286 LDT structure.

@00	i16le	Offset to last byte in 286 segment (limit)
@02	i24le	Base address of first byte in 286 segment
@05	i8	Segment group type of 286 segment{POSTLINK}<br>SRTL fixups also reference the code group, with 0 for the limit
#		=0x00	srtl
#		=0x01	code
#		=0x02	data
#		=0x03	code2
#		=0x04	stack
#		=0x05	aux1
#		=0x06	aux2
#		=0x07	aux3
#		=0x08	aux4
#		=0x09	shared code
#		=0x0A	LDT
@06	i16le	0

SECTION relocs:Relocation data

> The relocation data appears on a 128 byte record boundary, and it is a collection of 4 byte structures.{JE}

@00	i8	0 if end of relocations, otherwise a bitfield
		%0:3	Destination group type (1 for pure code)
		%4:7	Source group type (1 for pure code)
@01	i16le	16 byte paragraph offset from source group
@03	i8	Byte offset from paragraph within source group

> If there are any shared libraries, they can also have relocations. Each group of shared library relocations is separated by a 4 byte sequence of 0 that terminates the previous list. The format for these relocations is almost identical to those of internal relocations.{OWN}

@00	i8	0 if end of relocations, otherwise a bitfield
		%0:3	Must be 0
		%4:7	Source group type (1 for pure code)
@01	i16le	16 byte paragraph offset from source group
@03	i8	Byte offset from paragraph within source group

SECTION rsxindex:RSX index

> The RSX index may contain up to 7 RSX record entries plus a terminator.{JE}

@00	i16le	Offset of RSX in 128 byte records
		=0x0000	Must be loaded from disk
		=0xFFFF	End of list (not an entry)
@02	c[8]	Name of the RSX; for dynamically loaded RSXs, append '.RSX' to the file name
@0A	c[6]	Reserved

SECTION :CP/M-86 runtime layout

> Documentation{CPMSG} describe 3 modes of operation: 8080 model, small model and compact model. However the real difference is between the 8080 model and the other models. The 8080 model is selected when there is no data group. In CP/M-86, only a single code group is permitted.{OWN} Later versions allow other groups as well.

> When starting the program, the first 256 bytes of one of the groups is overwritten by a structure called the zero page. For an 8080 model program, it is the first 256 bytes of the code group, otherwise the data group.

> Then the segment registers are initialized: the CS to the start segment of the code group, the DS to the start of the data group if available, otherwise CS, the ES to the start of the extra group if available, otherwise DS. The IP is loaded with 0x0100 for 8080 model programs and 0x0000 otherwise. Notably, the SS:SP registers are not loaded with the stack segment, the rationale being that the actual length of the stack group cannot be known at compile time, and it might exceed 64 KiB. Instead it points to a small memory range allocated by the system.

Register	8080 model	Small/compact model
CS	code group	code group
DS	CS	data group or CS
ES	extra group or DS	extra group or DS
SS	system stack	system stack
SP	system stack	system stack
IP	0x0100	0x0000

REFERENCE {CPMSG} "CP/M-86 System Guide" http://www.bitsavers.org/pdf/digitalResearch/cpm-86/CPM-86_System_Guide_Jun83.pdf
REFERENCE {CDOSXM} "Concurrent DOS Programmer's Guide" http://bitsavers.org/pdf/digitalResearch/concurrent/Concurrent_DOS_Programmers_Guide_XM_6.0_386_2.0_1987.pdf
REFERENCE {CDOSRG} "Concurrent DOS Reference Guide" http://bitsavers.org/pdf/digitalResearch/concurrent/1126-2064-001_Concurrent_DOS_386_Reference_Guide_Nov87.pdf
REFERENCE {JE} "CP/M-86 executables (.CMD) (John Elliot's homepage)" http://www.seasip.info/Cpm/cmdfile.html
REFERENCE {FLEXOS} "FlexOS 286 Supplement" http://bitsavers.org/pdf/digitalResearch/flexos/flexos_286/FlexOS_Supplement_for_Intel_iAPX_286-based_Computers_198611.pdf
REFERENCE {POSTLINK} "POSTLINK.EXE"
REFERENCE {OWN} "own research"

######## 68K

TITLE 68k:CP/M-68K and GEMDOS Executable Format
SECTION :Overall layout

> Multiple systems support multiple versions of the file format. Executables can be contiguous or non-contiguous (the latter only supported on CP/M-68K). The header fields have some variations between the various operating systems. The format of the relocations between CP/M-68K, GEMDOS/Atari TOS, and crunched relocations. The symbol table has a standardized format for CP/M-68K, but other linkers can use different formats.

{header}
Text segment image
Data segment image
{symtab}
{relocs}

SECTION header:Header

> There are multiple versions of the header. They are very similar, but for ease of navigation, we will separate them according to versions. The following is the general layout:

@00	i16be	Magic number
		=0x601A	Contiguous executable
		=0x601B	Non-contiguous executable{CPM68K}
		=0x601C	Contiguous executable with crunched relocations{CDOS68K}
@02	i32be	Size of text segment
@06	i32be	Size of data segment
@0A	i32be	Size of bss segment
@0E	i32be	Size of symbol table
@12	i32be	Size of stack{CDOS68K}
@16	i32be	Address of text segment{CPM68K} or program flags{TOSHYP1}
@1A	i16be	Relocations suppressed
@1C	i32be	Address of data segment{CPM68K} (optional)
@20	i32be	Address of bss segment{CPM68K} (optional)

SECTION 1/cpm68kheader:CP/M-68K and Concurrent DOS 68K header for contiguous executables

> Format used by CP/M-68K{CPM68K} and Concurrent DOS 68K{CDOS68K} for contiguous executables:

@00	i16be	Magic number
		=0x601A	Contiguous executable
		=0x601C	Contiguous executable with crunched relocations (Concurrent DOS 68K only){CDOS68K}
@02	i32be	Size of text segment
@06	i32be	Size of data segment
@0A	i32be	Size of bss segment (image not included in file)
@0E	i32be	Size of symbol table
@12	i32be	CP/M-68K: Reserved, must be 0<br>Concurrent 68K: Size of stack{CDOS68K}
@16	i32be	Address of text segment, start of execution
@1A	i16be
		=0x0000	Relocations exist
		non-0	No relocations present
@1C	c[*]	Start of image

SECTION 1/cpm68knoncontheader:CP/M-68K non-contiguous executables

> Format used by CP/M-68K{CPM68K} for non-contiguous executables:

@00	i16be	0x601B (Magic number for Non-contiguous executable)
@02	i32be	Size of text segment
@06	i32be	Size of data segment
@0A	i32be	Size of bss segment (image not included in file)
@0E	i32be	Size of symbol table
@12	i32be	Reserved, must be 0
@16	i32be	Address of text segment, start of execution
@1A	i16be
		=0x0000	Relocations exist
		non-0	No relocations present
@1C	i32be	Address of data segment
@20	i32be	Address of bss segment
@24	c[*]	Start of image

SECTION 1/gemdosheader:Header for early versions of GEMDOS

> Format used by early versions of GEMDOS{GEMDOS}:

@00	i16be	0x601A (Magic number for Contiguous executable)
@02	i32be	Size of text segment
@06	i32be	Size of data segment
@0A	i32be	Size of bss segment (image not included in file)
@0E	i32be	Size of symbol table
@12	i32be	Reserved, must be 0
@16	i32be	Reserved, must be 0
@1A	i32be	Reserved, must be 0
@1E	c[*]	Start of image

SECTION 1/tosheader:Atari TOS header

> Format used by Atari TOS:

@00	i16be	0x601A (Magic number for Contiguous executable)
@02	i32be	Size of text segment
@06	i32be	Size of data segment
@0A	i32be	Size of bss segment (image not included in file)
@0E	i32be	Size of symbol table
@12	i32be	Reserved, must be 0
@16	i32be	Program flags
		%0	Only clear bss, not heap
		%1	May load program into alternative RAM
		%2	May use alternative RAM for Malloc calls
		%3	Only requires basepage, text, data, bss segments and symbol tables, used for shared libraries{TOSHYP2}
		%4-5
			=0	All memory is private
			=1	All memory is public
			=2	Supervisor mode can access memory
			=3	All memory is read only
		%6-11	Reserved, must be 0
		%12	Text segment is shared, no absolute address refers to DATA and BSS (unsure if bit 11 or bit 12)
		%13-27	Reserved, must be 0
		%28-31	Maximum amount of memory to allocate in alternate RAM, in 128KiB
@1A	i16be
		=0x0000	Relocations exist
		non-0	No relocations present
@1C	c[*]	Start of image

SECTION 1/human68kheader:Human68k .Z header

> Format used by Human68k for .Z executables:

@00	i16be	0x601A (Magic number for Contiguous executable)
@02	i32be	Size of text segment
@06	i32be	Size of data segment
@0A	i32be	Size of bss segment, including common and stack (image not included in file)
@0E	i32be	Reserved, must be 0
@12	i32be	Reserved, must be 0
@16	i32be	Load address, start of execution
@1A	i16be	0xFFFF (Magic number)
@1C	c[*]	Start of image

SECTION symtab:Symbol Table

> CP/M-68K has the following format for each symbol.

@00	c[8]	Symbol name, null padded
@08	i16be	Type
		=0x0100	Bss based relocatable
		=0x0200	Text based relocatable
		=0x0400	Data based relocatable
		=0x0800	External reference
		=0x1000	Equated register
		=0x2000	Global
		=0x4000	Equated
		=0x8000	Defined
@0A	i32be	Value

SECTION relocs:Relocation Table

SECTION 1/cpm68krelocs:CP/M-68K relocations

> For CP/M-68K relocations are stored as a sequence of 16-bit words, one for each 16-bit word in the text and data sections. The least significant 3 bits of the word determine if the word requires a relocation.

@00	i16be	Relocation information
		%0-3	Relocation type
			=0	Absolute reference, no relocation required
			=1	Reference relative to the base address of the data segment
			=2	Reference relative to the base address of the text segment
			=3	Reference relative to the base address of the bss segment
			=4	Undefined symbol, bits 4-15 index the symbol table
			=5	The upper word of a 32-bit longword.<br>The following word contains the relocation type, and the longword to be relocated is at the address of the first word
			=6	PC-relative reference
			=7	Instruction word, no relocation required
		%4-15	References a symbol in the symbol table (optional)

SECTION 1/crunchedrelocs:Crunched relocations

> Concurrent DOS 68K also recognizes CP/M-68K relocations. It also supports crunched relocations. The type of relocations is determined by the magic word, if it is 0x601C, it uses crunched relocations, otherwise CP/M-68K relocations. Relocations are represented as a sequence of offsets between 16-bit words and 32-bit longwords that need to be relocated. Each byte has the following format.{CRUNCH}

@00	i8
		%0-6
			=00	End of relocations
			=01-7C	Advance with the quantity, relocate next quantity
			=7D	Read next u8, advance as much, relocate next quantity
			=7E	Read next u16be, advance as much, relocate next quantity
			=7F	Read next u32be, advance as much, relocate next quantity
		%7	Set for 16-bit relocations, cleared for 32-bit relocations

SECTION 1/gemdosrelocs:GEMDOS/Atari TOS relocations

> GEMDOS relocations are represented as a sequence of offsets between the 32-bit longwords that need to be relocated. The first offset is stored directly in the code.

@00	i32be	The first offset to relocate, or 0 if there are none

> Every other offset is stored as a command to a pointer that gets moved and updates 32-bit longwords as it advances.

@00	i8
		=00	End of list
		=01	Advance 254 bytes, do not relocate
		=02-FE (even)	advance N bytes, relocate the next 32-bit longword
		=03-FF (odd)	undefined

SECTION 1/human68krelocs:Human68k relocations

> Human68k .Z files do not contain relocations.

REFERENCE {CPM68K} "CP/M-68K Programmer's Guide" http://www.cpm.z80.de/randyfiles/DRI/CPM-86_Programmers_Guide.pdf
REFERENCE {CDOS68K} "LOAD68K.H from Concurrent DOS 68K disks" http://www.cpm.z80.de/download/cdos3.zip
REFERENCE {CRUNCH} "CRUNCH.C source from Concurrent DOS 68K disks" http://www.cpm.z80.de/download/cdos3.zip
REFERENCE {GEMDOS} "Atari GEMDOS Reference Manual (1986-04-04)" http://www.bitsavers.org/pdf/atari/ST/Atari_ST_GEM_Programming_1986/GEM_0042.pdf
REFERENCE {AC} "GEMDOS Overview" http://cd.textfiles.com/ataricompendium/BOOK/HTML/CHAP2.HTM
REFERENCE {TOSHYP1} "The documentation for TOS: The program file format" https://freemint.github.io/tos.hyp/en/gemdos_programs.html
# old link: http://toshyp.atari.org/en/005005.html
REFERENCE {TOSHYP2} "The documentation for TOS: Shared libraries" https://freemint.github.io/tos.hyp/en/magic_sharelib.html#PH_BIT3.TTP
# old link: http://toshyp.atari.org/en/00b017.html#PH_BIT3.TTP
REFERENCE {X68KPM} "Sharp X68000 Programmer's Manual" https://datacrystal.romhacking.net/wiki/X68k:PM

######## Z8K

TITLE z8k:CP/M-8000 Executable Format
SECTION :Overall layout

{header}
{seginf}
Segment 1 image
Segment 2 image
...
{relocs}
{symtab}

SECTION header:Executable Header

@00	i16be	Magic number, denotes file type
		=0xEE00	Segmented, nonexecutable
		=0xEE01	Segmented, executable
		=0xEE02	Nonsegmented, nonexecutable
		=0xEE03	Nonsegmented, executable, nonshared Instruction & Data space
		=0xEE06	Nonsegmented, nonexecutable, shared Instruction & Data space
		=0xEE07	Nonsegmented, executable, shared Instruction & Data space (apparently CP/M-8000 cannot execute these{OWN})
		=0xEE0A	Nonsegmented, nonexecutable, split Instruction & Data space
		=0xEE0B	Nonsegmented, executable, split Instruction & Data space
@02	i16be	Number of entries in {seginf}
@04	i32be	Combined size of all segment data in bytes
@08	i32be	Size of {relocs} in bytes
@0C	i32be	Size of {symtab} in bytes

SECTION seginf:Segment Information Array

> This table contains one entry for each segment.

@00	i8	Segment's assigned number<br>For segmented executables, this is the segment number that will be used{OWN}<br>0xFF lets the linker choose a value
@01	i8	Segment type
		=01	Bss (no data in file)
		=02	Stack (no data in file)
		=03	Code
		=04	Constant data (rodata)
		=05	Data
		=06	Mixed code/data, not protectable (might write data in it)
		=07	Mixed code/data, protectable (may be put in ROM)
@02	i16be	Length of segment

> Note: {CPM8KPG} (likely erroneously) claims that there is another byte following this record indicating the number of segment entries in the table.{OWN}

SECTION relocs:Relocation Data

@00	i8	Segment number
@01	i8	Relocation type
		=0x01	OFF: A 16-bit offset value to segment
		=0x02	SSG: A 16-bit short form segment:offset value to segment
		=0x03	LSG: A 32-bit long form segment:offset value to segment
		=0x05	XOFF: A 16-bit offset value to external item
		=0x06	XSSG: A 16-bit short form segment:offset value to external item
		=0x07	XLSG: A 32-bit long form segment:offset value to external item
@02	i16be	Location within segment
@04	i16be	Index into symbol table or segment number

SECTION symtab:Symbol Table

@00	i8	Segment number
@01	i8	Symbol type
		=0x01	Local (for debugging)
		=0x02	Undefined, external
		=0x03	Global definition
		=0x04	Segment name
@02	i16be	Value
@04	c[8]	Name, null padded

REFERENCE {CPM8KPG} "CP/M-8000 Programmer's Guide" http://www.cpm.z80.de/randyfiles/DRI/CPM8000_programmersGuide.pdf
REFERENCE {OWN} "own research"

######## HU

TITLE hu:X Executable Files
SECTION :Overall layout

{header}
Text segment
Data segment
{reltbl}
{symtab}

SECTION header:Executable Header

@00	c[2]	"HU"
@02	i8	Reserved
@03	i8	Load mode{X68KPM}
		=0	Normal
		=1	Smallest block
		=2	High address
@04	i32be	Base address{X68KPM}
@08	i32be	Initial PC (entry){X68KPM}
@0C	i32be	Size of text segment
@10	i32be	Size of data segment
@14	i32be	Size of bss segment
@18	i32be	Size of relocation table
@1C	i32be	Size of symbol table
@20	i32be	Size of SCD (debug{LYDUX}) line number table in bytes{X68KPM}
@24	i32be	Size of SCD (debug{LYDUX}) symbol table in bytes{X68KPM}
@28	i32be	Size of SCD (debug{LYDUX}) string table in bytes{X68KPM}
@2C	c[0x10]	Reserved
@3C	i32be	Position of bound module list from beginning of file{X68KPM}

SECTION reltbl:Relocation Table

> Relocations are represented as a sequence of offsets between 16-bit words and 32-bit longwords that need to be relocated. Each 16-bit word has the following format.{X68KPM}

@00	i16be	Relocation type
		=0x0001	Read next i32be, then
			Even	Move to position, relocate i32be
			Odd	Move to position - 1, relocate i16be
		Even	Advance by amount of bytes, relocate i32be
		Odd	Advance by amount-1 of bytes, relocate i16be

SECTION symtab:Symbol Table

@00	i8	Location
		=0x00	External{LYDUX}
		=0x02	Local{LYDUX}
@01	i8	Section
		=0x00	Absolute{CA}
		=0x01	Text
		=0x02	Data
		=0x03	Bss or common{CA} (if external)
		=0x04	Stack
@02	i32be	Value
@04	c[*]	Name (zero terminated){CA}

REFERENCE {X68KPM} "Sharp X68000 Programmer's Manual" https://datacrystal.romhacking.net/wiki/X68k:PM
REFERENCE {CA} "68000 Assembly programming for the Sharp x68000" https://www.chibiakumas.com/68000/x68000.php
REFERENCE {LYDUX} "Binutils for Human68k from Lydux" https://github.com/Lydux/binutils-2.22-human68k/blob/master/bfd/xfile.c

######## MZ

TITLE mz:MS-DOS Executable Format
SECTION :Overall layout

{exehdr} including {reltbl} and {pifed}
Program image

SECTION exehdr:EXE Header

@00	c[2]	"MZ" (for <a href='https://en.wikipedia.org/wiki/Mark_Zbikowski'>Mark Zbikowksi</a>, a lead developer of MS-DOS)<br>alternatively "ZM"{RB}<br>"DL"{RB}{NKIT} for System Manager module
@02	i16le	Number of bytes in the last 512 byte pages in file, 0 if entire page is used
@04	i16le	Size of entire file in 512 byte pages; if value at 0x02 is non-zero, only that much of the last page is used
@06	i16le	Number of relocations
@08	i16le	Offset to load image from start of file; size of header in 16 byte paragraphs (including the {reltbl})
@0A	i16le	Minimum supplementary 16 byte paragraphs allocated after program image. Corresponds to bss+stack.<br>If both this and the next field are zero, the program is loaded in the highest possible memory
@0C	i16le	Maximum supplementary 16 byte paragraphs allocated after program image. This will be used as the heap
@0E	i16le	Initial SS value (segment of stack), relative to start of program image
@10	i16le	Initial SP value (top of stack)
@12	i16le	Checksum, the sum of all 16-bit words in the file should be zero. Alternatively, it is the negation of the modular sum of all 16-bit words except this one
@14	i16le	Initial IP value (segment of entry)
@16	i16le	Initial CS value (entry point), relative to start of program image
@18	i16le	Offset of {reltbl} from file start in bytes. Relocation table is typically part of the header.<br>Some extensions of the file format expect this to be at least 0x40
@1A	i16le	Overlay number, 0 for main program<br>for "DL" executables, starting paragraph of data relative to program image{NKIT}
@1C	c[*]	Other proprietary fields

SECTION reltbl:Relocation Table

> A sequence of address of 16-bit words that have to be incremented by the physical first paragraph of the loaded program image. Note that the offset, paragraph pair of an address is not unique.

@00	i16le	Offset of word to relocate
@02	i16le	Paragraph of word to relocate

SECTION pifed:Program Information

> The <tt>PIFED</tt>{PIFED} utility from Concurrent DOS 386 embeds a special structure to encode program information data. It either immediately follows the last relocation in the file, or if there are no relocations (the relocation offset is 0), it starts at offset 0x1E.

@00	c[4]	Signature, always 0xC1 0xED 0x13 0x00
@04	i16le	Maximum number of extra paragraphs (PIFED asks in KiBs, default: 1023KiB{PIFED})
@06	i16le	Minimum number of extra paragraphs (PIFED asks in KiBs, default: 65KiB{PIFED})
@08	i8	Flags
		%0	Requires 8087 coprocessor
		%1	May run in banked memory
		%2	Runs only in the foreground
		%4	Waits in idle loop
		%5	Requires aligned memory
@09	i8	0x00
@0A	i8	Lowest used interrupt (default: 0x08{PIFED})
@0B	i8	Highest used interrupt (default: 0x2F{PIFED})
@0C	i8	COM port usage
		%4	Direct access to COM1
		%5	Direct access to COM1
@0D	i8	LPT port usage
		%0	Direct access to LPT1
		%1	Direct access to LPT2
		%2	Direct access to LPT3
@0E	i8	Screen usage
		%1
			=0	Uses 24 lines
			=1	Uses 25 lines
		%2	Uses ANSI escape sequences
		%3	Uses ROS calls
		%4	Direct video access
@0F	c[4]	Signature, always 0x13 0x00 0xC1 0xED

REFERENCE {DOSPR} "Microsoft MS-DOS Version 4.0 Programmer's Reference" https://www.pcjs.org/documents/books/mspl13/msdos/dosref40/
REFERENCE {RB} "Ralf Brown's interrupt list (Int 21/AH=4Bh)" http://www.ctyme.com/intr/rb-2939.htm
REFERENCE {NKIT} "MAKEEXM.C from NKIT Version 0.63 source; from The Largest 200LX Software Archive" https://casio.ledudu.com/HPLX/super5.html
REFERENCE {DJ} "EXE Format (DJ Delorie's homepage)" http://www.delorie.com/djgpp/doc/exe/
REFERENCE {PIFED} "Concurrent DOS 386 PIFED.EXE"

######## NE

TITLE ne:New Executable Format

SECTION :Overall layout

Old-style {segexefmt} stub
{segexehdr}
{segtab}
{restab}
{rntab}
{modreftab}
{impntab}
{enttab}
{nrntab}
{segdata} and {reloc}

SECTION segexefmt:Segmented EXE Format

> After Windows 1.0 Development Release 5 (where a <tt>.mod</tt> file until Development Release 4, or <tt>.exe</tt> file in Development Release 5 starts immediately with an earlier version of the {segexehdr}{BETA}), a new executable file starts with an MZ stub program, with the following additional or modified field.

@18	i16le	Must be 0x40{WIN3.0} or greater {WIN3.1}
@3C	i32le	Offset to {segexehdr} from file start in bytes

SECTION segexehdr:Segmented EXE Header

> The segmented EXE header{WIN3.0} or information block {WIN3.1}

@00	c[2]	<tt>'NE'</tt><br>DOS/16M can patch this to <tt>'DX'</tt> to distinguish it from Windows applications
@02	i8	Linker version number
@03	i8	Linker revision number
@04	i16le	Offset of {enttab} from {segexehdr} start in bytes
@06	i16le	Size of {enttab} in bytes
@08	i32le	32-bit CRC of entire file{WIN3.0}, calculated with this field being 0{DOSENC}
@0C	i16le	Module flag word
		%0:1	Executable file format
			=0	NOAUTODATA, no automatic data segment. Only for DLLs{DOSENC}
			=1	SINGLEDATA, one{WIN3.1} shared{WIN3.0} automatic data segment. Set for DLLs
			=2	MULTIPLEDATA, multiple{WIN3.1} or instanced{WIN3.0} automatic data segments. Set for Windows applications
		%2	For DLLs, per-process initialization{OW}<br>({RB} claims global initialization)<br>1 if module runs in real mode{DOSENC}
		%3	Runs in protected mode{DOSENC}, protected mode only{OW}{RB}
		%4	(Windows) Uses LIM EMS directly{OW}<br>({RB} claims 8086 instructions)
		%5	(OS/2) Requires 80286{OW}{RB}<br>(Windows) Each instance has separate EMS bank{OW}
		%6	(OS/2) Requires 80386{OW}{RB}<br>(Windows) For DLLs, global memory above EMS line{OW}
		%7	Needs 80x87{OW}{RB}
		%8:9	Presentation Manager compatibility (OS/2 GUI){OW}{RB}
			=1	Incompatible{OW}, fullscreen{RB}
			=2	Compatible
			=3	Requires Presentation Manager
		%11	(Windows) First segment contains code that loads application{WIN3.1}<br>(OS/2) Family Application, runs in DOS as well{RB}
		%13	Errors detected during linking, module will not load
		%14	(Windows) For DLLs, set if private DLL and only one program can access it{OW}<br>Non-conforming program, valid stack is not maintained{RB}{DOSENC}
		%15	Library module. SS:SP is invalid{WIN3.0}. CS:IP points to initialization procedure, called with AX set to the module handle, return far with nonzero AX on success. DS is set to the automatic data segment for SINGLEDATA, to caller data otherwise
@0E	i16le	Automatic segment number, starting at 1. Set to 0 for NOAUTODATA
@10	i16le	Size of initial heap in bytes, added to the automatic data segment following initial stack
@12	i16le	Size of initial stack in bytes, added to the automatic data segment
@14	i16le	Initial IP (entry)
@16	i16le	Segment of initial CS (entry), starting at 1
@18	i16le	Initial SP (stack). If SS is the automatic data segment and SP is 0, SP is set to top of the automatic segment below the initial heap
@1A	i16le	Segment of initial SS (stack), starting at 1. 0 for library modules
@1C	i16le	Number of entries in {segtab}
@1E	i16le	Number of entries in {modreftab}<br>(official Windows 2.0 documentation mistakenly has this field missing and the other fields shifted)
@20	i16le	Size of {nrntab} in bytes
@22	i16le	Offset of {segtab} from {segexehdr} start in bytes
@24	i16le	Offset of {restab} from {segexehdr} start in bytes
@26	i16le	Offset of {rntab} from {segexehdr} start in bytes
@28	i16le	Offset of {modreftab} from {segexehdr} start in bytes
@2A	i16le	Offset of {impntab} from {segexehdr} start in bytes
@2C	i32le	Offset of {nrntab} from file start in bytes
@30	i16le	Number of movable entries in {enttab}
@32	i16le	Logical sector alignment shift count. A 0 value represents 9{DOSENC}
@34	i16le	Number of resource segments, and entries in {restab}{WIN3.1}<br>Under OS/2, the last segments correspond to resources{OW}
@36	i8	Executable type
		=00	unknown{WIN3.1}
		=01	OS/2{OW}{RB}
		=02	Windows
		=03	Multitasking (a.k.a. "European") MS-DOS 4.0{RB}{OW}
		=04	Windows 386{RB}
		=05	BOSS (Borland Operating System Services){RB}
		=81	Phar Lap 286|DOS-Extender, OS/2{RB}
		=81	Phar Lap 286|DOS-Extender, Windows{RB}
@37	i8	Additional information{WIN3.1}
		%0	(OS/2) Supports long filenames{OW}{RB}
		%1	Windows 2.x application supporting proportional fonts{OW}<br>(The official documentation{WIN3.1}{RB} mistakenly claims this is bit 2)
		%2	Windows 2.x application running in Windows 3.x protected mode{OW}<br>(The official documentation{WIN3.1}{RB} mistakenly claims this is bit 1)
		%3	(Windows) Contains fast-load (gangload) area
@38	i16le	(Windows) Offset of fast-load area (gangload area{RB}{OW}) in sectors{WIN3.1}
@3A	i16le	(Windows) Size of fast-load area (gangload area{RB}{OW}) in sectors{WIN3.1}
@3C	i16le	Minimum code swap area{RB}{OW}
@3E	i16le	(Windows) Expected Windows version number{WIN3.1}

SECTION segtab:Segment Table

> Each entry has the following format

@00	i16le	Offset to segment data and following segment information from file start in sectors. Zero if no data appears in file
@02	i16le	Size of segment data stored in file in bytes. Zero for 65536 bytes
@04	i16le	Flag word
		%0
			=0	Code segment
			=1	Data segment
		%1
			=1	Loader has allocated memory for segment{WIN3.1}
		%2
			=1	Segment is loaded{WIN3.1}<br>Real mode segment{RB}
		%3
			=1	Iterated data{DOSENC}{OW}{RB}
		%4
			=0	FIXED{WIN3.1}{DOSENC}
			=1	MOVABLE{WIN3.1}{DOSENC}
		%5
			=0	IMPURE or NONSHAREABLE{WIN3.1}{DOSENC}
			=1	PURE or SHAREABLE{WIN3.1}{DOSENC}{OW}{RB}
		%6
			=0	LOADONCALL{WIN3.1}{DOSENC}
			=1	PRELOAD{WIN3.1}{DOSENC}
		%7
			=1	Code segment: EXECUTEONLY{WIN3.1}{DOSENC}{RB}<br>Data segment: READONLY{WIN3.1}{DOSENC}{OW}{RB}
		%8
			=1	Relocation information is present, follows segment data
		%9
			=1	Debugging information is present (former meaning){DOSENC}{OW}{RB}<br>Conforming code segment{OW}
		%10:11	Descriptor privilege level (DPL){DOSENC}{OW}{RB}
		%12	Discardable segment{WIN3.1}{OW}{RB}
		%12:15	Discard priority{DOSENC}{WIN3.0}
		%13:15	Discard priority{RB}
		%13	32-bit segment{OW}
		%14	Part of huge segment{OW}
		%15	<tt>RESRC_HIGH</tt>{OW}
@06	i16le	Minimum allocated size of segment in bytes. Zero means 65536 bytes

SECTION restab:Resource Table

SECTION 1/:Windows resource table

> The resource table consists of an alignment shift count field, an array of types and a sequence of resource names.

@00	i16le	Alignment shift count, for encoding the offsets to resources

> A list of types follow. There must be a single entry for each type.

@00	i16le	Type ID<br>A value of 0 terminates the resource table<br>If the high order bit is clear, it is an offset to a type string, relative to the beginning of the resource table<br>Otherwise, it is a resource type value:{FFENC}
		=01	<tt>RT_CURSOR</tt> &mdash; cursor
		=02	<tt>RT_BITMAP</tt> &mdash; bitmap
		=03	<tt>RT_ICON</tt> &mdash; icon
		=04	<tt>RT_MENU</tt> &mdash; menu
		=05	<tt>RT_DIALOG</tt> &mdash; dialog box
		=06	<tt>RT_STRING</tt> &mdash; string table
		=07	<tt>RT_FONTDIR</tt> &mdash; font directory
		=08	<tt>RT_FONT</tt> &mdash; font component
		=09	<tt>RT_ACCELERATOR</tt> &mdash; keyboard accelerator table
		=0A	<tt>RT_RCDATA</tt> &mdash; resource data
#		=0B	<tt>RT_MESSAGETABLE</tt> &mdash; message table
		=0C	<tt>RT_GROUP_CURSOR</tt> &mdash; cursor directory
		=0E	<tt>RT_GROUP_ICON</tt> &mdash; icon directory
#		=10	<tt>RT_VERSION</tt> &mdash; version information
#		=11	<tt>RT_DLGINCLUDE</tt> &mdash; dialog include
#		=13	<tt>RT_PLUGPLAY</tt> &mdash; plug and play
#		=14	<tt>RT_VXD</tt> &mdash; virtual device driver (VxD)
#		=15	<tt>RT_ANICURSOR</tt> &mdash; animated cursor
@02	i16le	Number of resources for this type
@04	i32le	Reserved
@08	...	Table of resources for this type

> Each resource has one entry for it:

@00	i16le	Offset to resource data from file start, must be shifted by alignment shift count to get offset
@02	i16le	Length of resource, shifted by alignment shift count{DOSENC}{OW} ({WIN3.0} and {WIN3.1} mistakenly claim it is in bytes)
@04	i16le	Flags, similar to segment flags
		%4	MOVEABLE
		%5	PURE, can be shared
		%6	PRELOAD
		%12:15	Discard priority{DOSENC}
@06	i16le	Resource ID<br>If the high order bit is clear, it is an offset to a resource string, relative to the beginning of the resource table<br>Otherwise, it is an integer
@08	i16le	Handle, reserved
@0A	i16le	Usage, reserved

> These structures are followed by a resource name table that contains the names of entries exported by name, with the entry number included.

@00	i8	Length of the string or 0 to terminate the table
@01	c[*]	ASCII text of the string name, not terminated with null

SECTION 1/:OS/2 resource table

> Contains a series of resources, identified by their type and name IDs. Each entry corresponds to a segment, and the last segments (out of the total list of segments) are the resources.{OW}

@00	i16le	Type ID
@02	i16le	Name ID

SECTION rntab:Resident Name Table

> The table contains the names of entries exported by name, with the entry number included.

@00	i8	Length of the string or 0 to terminate the table
@01	c[*]	ASCII text of the string name, not terminated with null
@...	i16le	Ordinal number

SECTION modreftab:Module Reference Table

> The table contains a list of module references, each of which is identified by the module name within the {impntab}.

@00	i16le	Offset to module name in {impntab}

SECTION impntab:Imported Name Table

> A list of names of imported modules and procedures. Names are identified via their offsets within the table.

@00	i8	Length of the string
@01	c[*]	ASCII text of the string name, not terminated with null

SECTION enttab:Entry Table

> Contains a sequence of entry bundles

@00	i8	Number of entries in bundle. A zero value terminates the table
@01	i8	Segment indicator for bundle
		=00	Unused entries, skip entry numbers
		=*	{norment}
		=FE	{const} defined in module{WIN3.1}
		=FF	{movent}

SECTION 1/norment:Normal entries

@00	i8	Flag word
		%0	Set for exported entry
		%1	Set if entry uses a global/shared data segment, only valid for SINGLEDATA library modules. First instruction must be <tt>MOV AX, segment_number</tt>
		%3:7	On ring transition, specifies number of words to be copied on call{WIN3.1}
@01	i16le	Offset to entry point within segment

SECTION 1/const:Constant

> Undocumented

SECTION 1/movent:Moveable entries

@00	i8	Flag word
		%0	Set for exported entry
		%1	Set if entry uses a global/shared data segment, only valid for SINGLEDATA library modules
		%3:7	On ring transition, specifies number of words to be copied on call{WIN3.1}
@01	c[2]	An <tt>INT 0x3F</tt> instruction, <tt>0xCD 0x3F</tt>
@03	i8	Segment number
@04	i16le	Offset to entry point within segment

SECTION nrntab:Non-Resident Name Table

> The table contains the names of entries exported by ordinal, with the internal entry name included. The table has an identical format to the {rntab}.

@00	i8	Length of the string or 0 to terminate the table
@01	c[*]	ASCII text of the string name, not terminated with null
@...	i16le	Ordinal number

SECTION segdata:Segment Data

> For iterated data, the file has the following structure{DOSENC}:

@00	i16le	Number of iterations
@02	i16le	Pattern length
@04	c[*]	Pattern to be repeated

SECTION reloc:Relocations

> Every segment data may optionally have a sequence of relocations followed, if specified in the {segtab}.

@00	i16le	Number of relocations

> Afterwards, relocations have the following format each.

@00	i8	Source type
		%0:3
			=00	low 8-bit
			=02	16-bit selector/segment
			=03	16:16-bit far pointer (32-bit)
			=05	16-bit offset within a segment
			=0B	16:32-bit far pointer (48-bit){WIN3.1}
			=0D	32-bit offset within a segment{WIN3.1}
@01	i8	Flags byte
		%0:2	Relocation type
			=00	internal reference
			=01	imported by ordinal
			=02	imported by name
			=03	OSFIXUP
		%3	ADDITIVE flag
			=0	The source offset references the first word in a chain terminated by 0xFFFF. The word is replaced by the address, and the old value references the second word in the chain, which is then also replaced
			=1	The source offset references a word and the target value is added to it
@02	i16le	Offset within this segment to source
@04	c[4]	Relocation data

> The interpretation of the relocation data depends on the relocation type.

SECTION 1/:Internal reference to a fixed segment

> References an address within the same module.

@04	i8	Segment number in {segtab}, not equal to 0xFF
@05	i8	0x00
@06	i16le	Offset into the fixed segment

SECTION 1/:Internal reference to a movable segment

@04	i8	0xFF
@05	i8	0x00
@06	i16le	Ordinal index into {enttab}

SECTION 1/:Import by ordinal

@04	i16le	Index into {modreftab} to module
@06	i16le	Ordinal number for procedure

SECTION 1/:Import by name

@04	i16le	Index into {modreftab} to module
@06	i16le	Offset within {impntab} to procedure name

SECTION 1/:OSFIXUP

> Represents a floating point instruction that Windows will "fix up" when the coprocessor is emulated.{QB}

@04	i16le	Fixup type<br>(apparently the relocations containing the J are supposed to refer to the second byte of the command sequence{OW})<br>(including relocations and interrupts supported by other platforms for completeness sake)
		=0x0001	<tt>FIARQQ, FJARQQ</tt> &mdash; <tt>wait; DS: esc</tt> turns into <tt>int 0x3C; byte 0x18-0x1F</tt> by adding 0xFE32 and 0x4000 respectively
		=0x0002	<tt>FISRQQ, FJSRQQ</tt> &mdash; <tt>wait; SS: esc</tt> turns into <tt>int 0x3C; byte 0x58-0x5F</tt> by adding 0x0632 and 0x8000 respectively
		=0x0003	<tt>FICRQQ, FJCRQQ</tt> &mdash; <tt>wait; CS: esc</tt> turns into <tt>int 0x3C; byte 0x98-0x9F</tt> by adding 0x0E32 and 0xC000 respectively
		=0x0004	<tt>FIERQQ</tt> &mdash; <tt>wait; ES: esc</tt> turns into <tt>int 0x3C</tt> by adding 0x1632
		=0x0005	<tt>FIDRQQ</tt> &mdash; <tt>wait; esc</tt> turns into <tt>int 0x34-0x3B</tt> by adding 0x5C32
		=0x0006	<tt>FIWRQQ</tt> &mdash; <tt>nop; wait</tt> turns into <tt>int 0x3D</tt> by adding 0xA23D
		&mdash;	<tt>FIFRQQ, FJFRQQ</tt> &mdash; <tt>wait; FS: esc</tt>{OW}
		&mdash;	<tt>FIGRQQ, FJGRQQ</tt> &mdash; <tt>wait; GS: esc</tt>{OW}
		&mdash;	the sequence <tt>int 0x3E; byte 0xDC, 0x01-0x08</tt><br>Load 8087 registers to 8086 stack, count specified in byte{RB}
		&mdash;	the sequence <tt>int 0x3E; byte 0xDE, 0x01-0x08</tt><br>Load 8086 stack to 8087 registers, count specified in byte{RB}
		&mdash;	the sequence <tt>int 0x3E; byte 0xE0; nop</tt><br>Round, compare and pop the two top elements on the<br>8087 stack as single precision, store status word in<br>AX and condition bits in FLAGS{RB}
		&mdash;	the sequence <tt>int 0x3E; byte 0xE2; nop</tt><br>Round, compare and pop the two top elements on the<br>8087 stack as double precision, store status word in<br>AX and condition bits in FLAGS{RB}

@06	i16le	0

REFERENCE {WIN3.0} "Windows 3.0 16-bit NE Executable Format" https://web.archive.org/web/20240422070115/http://bytepointer.com/resources/win16_ne_exe_format_win3.0.htm
REFERENCE {WIN3.1} "Windows 3.1 16-bit NE Executable Format" https://web.archive.org/web/20240615140011/http://bytepointer.com/resources/win16_ne_exe_format_win3.1.htm
REFERENCE {DOSENC} "The MS-DOS Encyclopedia: Appendix K: Segmented (New) .EXE File Header Format" https://www.pcjs.org/documents/books/mspl13/msdos/encyclopedia/appendix-k/
REFERENCE {OW} "OpenWatcom sources" https://github.com/open-watcom/open-watcom-v2
REFERENCE {RB} "Ralf Brown's interrupt list" http://www.delorie.com/djgpp/doc/rbinter/ix/
REFERENCE {QB} "QB CULT MAGAZINE - Vol. 4 Iss. 1 - January 2004" http://qbcm.hybd.net/issues/4-1/
REFERENCE {BETA} https://betawiki.net/wiki/Windows_1.0_Development_Release_5
REFERENCE {FFENC} "File Format Encyclopedia: Windows Resource (.RES) Files" https://ffenc.blogspot.com/2008/04/windows-resource-res-files.html

######## LE

TITLE le:Linear Executable Format
SECTION :Overall layout

{oldhdr}
{modhdr}
{ldrsect}
{fixsect}
{datasect}
{debugsect}

SECTION oldhdr:Old-style EXE header and executable

> A linear executable file starts with an MZ stub program, with the following additional or modified field.

@18	i16le	Should be 0x0040
@24	i16le	OEM Identifier
@26	i16le	OEM Info
@3C	i32le	Offset to {modhdr} from file start in bytes

SECTION modhdr:Linear Executable Module Header

> Starts at the offset indicated in the {oldhdr}. The general layout is as follows.

Executable Info
Module Info
Loader Section Info
Table Offset Info

#SECTION 1/execinfo:Executable Info
#SECTION 1/modinfo:Module Info
#SECTION 1/ldrsectinfo:Loader Section Info
#SECTION 1/tbloffinfo:Table Offset Info

> The following table lists the actual fields.

@00	c[2]	Magic number
		=<tt>'LE'</tt>	original version{OW}{RB}{VXD}
		=<tt>'LX'</tt>	OS/2 2.0 optimizations
@02	u8	Byte ordering
		=0x00	little endian (8086, PDP-11)
		=0x01	big endian (68000)
@03	u8	Word ordering
		=0x00	little endian (8086)
		=0x01	big endian (68000, PDP-11)
@04	i32le	Format level, version of executable, current version is 0
@08	i16le	CPU Type
		=0x01	Intel 80286 or upward compatible
		=0x02	Intel 80386 or upward compatible
		=0x03	Intel 80486 or upward compatible
		=0x04	Intel Pentium (80586) or upward compatible{RB}{LEEXE}{VXD}
		=0x20	Intel i860 (N10) or compatible{RB}{LEEXE}{VXD}
		=0x21	Intel "N11" or compatible{RB}{LEEXE}{VXD}
		=0x40	MIPS I (R2000, R3000) or compatible{RB}{LEEXE}{VXD}
		=0x41	MIPS II (R6000) or compatible{RB}{LEEXE}{VXD}
		=0x42	MIPS III (R4000) or compatible{RB}{LEEXE}{VXD}
@0A	i16le	OS Type
		=0x00	Unknown
		=0x01	OS/2
		=0x02	Windows
		=0x03	DOS 4.x, Multitasking ("European") MS-DOS 4.0{RB}
		=0x04	Windows 386
		=0x05	IBM Microkernel Personality Neutral{IBM96}
@0C	i32le	Module version
@10	i32le	Module type
		%1	Single data{OW}
		%2
			=0	Global library initialization
			=1	Per-process library initialization. EIP Object number and EIP must have valid values
		%4	Internal fixups have been applied. If set, each object has a preferred address at which it can be loaded without internal fixups
		%5	External fixups have been applied
		%8:9	Application type
			=00	Unknown{LEEXE}
			=01	Incompatible with PM windowing
			=02	Compatible with PM windowing
			=03	Uses PM windowing API
		%13	Module is not loadable. Either there were errors during linking or the module is being incrementally linked
		%15:17	Module type
			=00	Program. Modules cannot contain dynamic links to program modules
			=01	Library<br>Windows 3.x device driver (must have external fixups done){OW}
			=03	Protected memory library
			=04	Physical device driver
			=05	Virtual device driver<br>(Windows VxD) Static device driver{OW}
			=07	(Windows VxD) Dynamic device driver{OW}
		%19	Unsafe to run in multiple-processor environment{IBM96}
		%30
			=0	Global library termination
			=1	Per-process library termination. EIP Object number and EIP must have valid values
@14	i32le	Number of pages physically appearing in the module. This includes pages with enumerated or iterated data, or according to {IBM92} but not {IBM96}, zero-filled pages with relocations
@18	i32le	Object number of EIP (entry or library initialization). Must be non-zero for programs
@1C	i32le	Initial EIP (entry or library initialization)
@20	i32le	Object number of ESP (stack). Must be non-zero for programs, ignored for libraries
@24	i32le	Initial ESP (stack). Ignored for libraries
@28	i32le	Size of a single page in bytes. Should be 4096
@2C	i32le	(LE) Byte count of final page{RB}{VXD}<br>(LX) Page offset shift for {objpgtbl} entry offsets{IBM92}{IBM96}{RB}
@30	i32le	Size of {fixsect} in bytes
@34	i32le	Checksum of {fixsect}
@38	i32le	Size of {ldrsect} in bytes
@3C	i32le	Checksum of {ldrsect}
@40	i32le	Offset of {ldrsect} from {modhdr} start in bytes
@44	i32le	Number of objects in {objtbl}
@48	i32le	Offset of {objpgtbl} from {modhdr} start in bytes
@4C	i32le	Offset of {objitpgtbl} from file start in bytes
@50	i32le	Offset of {restbl} from {modhdr} start in bytes
@54	i32le	Number of entries in {restbl}
@58	i32le	Offset of {rntbl} from {modhdr} start in bytes
@5C	i32le	Offset of {enttbl} from {modhdr} start in bytes
@60	i32le	Offset of {modfmtdirtbl} from {modhdr} start in bytes
@64	i32le	Number of entries in {modfmtdirtbl}
@68	i32le	Offset of {fixpgtbl} from {modhdr} start in bytes
@6C	i32le	Offset of {fixrectbl} from {modhdr} start in bytes
@70	i32le	Offset of {impmodtbl} from {modhdr} start in bytes
@74	i32le	Number of entries in {impmodtbl}
@78	i32le	Offset of {impproctbl} from {modhdr} start in bytes
@7C	i32le	Offset of {perpgcks} from {modhdr} start in bytes
@80	i32le	Offset of data pages from file start in bytes
@84	i32le	Number of preload pages. OS/2 2.0 does not respect the preload of pages
@88	i32le	Offset of {nrntbl} from file start in bytes
@8C	i32le	Size of {nrntbl} in bytes
@90	i32le	Checksum of {nrntbl}
@94	i32le	(16-bit compatibility) Automatic DS object
@98	i32le	Offset of {debugsect} from file start{IBM96} in bytes. ({IBM92} claims it is from {modhdr} but {IBM96} clarifies that this is wrong)
@9C	i32le	Size of debug information in bytes
@A0	i32le	Number of instance pages in preload section
@A4	i32le	Number of instance pages in demand section
@A8	i32le	(16-bit compatibilty) Size of initial heap in bytes
@AC	i32le	(OS/2 only) Size of stack in bytes{IBM96}. Byte at offset 0xAD should not be 0x02 or 0x04 for OS/2 2.0
@B0	c[8]	reserved
@B8	i32le	(Windows VxD only) Offset of VERSIONINFO resource{OW}{RB}
@BC	i32le	(Windows VxD only) Size of VERSIONINFO resource{OW}{RB}
@C0	i16le	(Windows VxD only) Device ID{OW}{RB}
@C2	i16le	(Windows VxD only) DDK version{OW}{RB} (0x030A{OW})

SECTION ldrsect:Loader Section

{objtbl}
{objpgtbl}
{objitpgtbl}
{restbl}
{rntbl}
{enttbl}
{modfmtdirtbl}
{resdirdattbl}
{perpgcks} (LX only)

SECTION 1/objtbl:Object Table

> The object table's location and length can be read from the {modhdr} directly. Each entry is 24 bytes long.

@00	i32le	Size of object loaded into memory
@04	i32le	The base address of the object. If the internal relocations have been removed, the object must be loaded at this address
@08	i32le	Object flags
		%0	Readable
		%1	Writable
		%2	Executable
		%3	Resource
		%4	Discardable
		%5	Shared
		%6	Object has Preload pages
		%7	Object has Invalid pages
		%8:9	(LE) Type{LEEXE}
			=00	Normal
			=01	Zero-filled
			=02	Resident
			=03	Resident/contiguous
		%8	(LE) Object is Permanent and Swappable{OW}<br>(LX) Object has Zero Filled pages (non-Contiguous){OW}{IBM92}
		%9	(device drivers only) Object is Resident{OW}{IBM92}
		%10	(device drivers only) Object is Resident and long-lockable{OW}{IBM92}{LEEXE}
		%11	Object is marked as an IBM Microkernel extension{IBM96}
		%12	(x86 specific) 16:16 alias required
		%13	(x86 specific) the Big bit for data segments and the Default bit for code segments
		%14	(x86 specific) Object is conforming code
		%15	(x86 specific) Object I/O privilege level, for 16:16 alias objects
@0C	i32le	{objpgtbl} index
@10	i32le	{objpgtbl} entry count, any remaining pages are zero filled unless last defined entry is illegal, in which case all remaining pages are illegal
@14	i32le	reserved

SECTION 1/objpgtbl:Object Page Table

> Every page stored in the image has a corresponding page table entry. The format of an entry differs between the LE and LX formats.

> This is the format of an LE entry.

@00	i24be	Page number{LEEXE} and index into {fixpgtbl}{RB}{OW}{LEEXE}<br>Note: all sources agree that the third byte stores the low order byte.<br>{OW} handles this as a 24-bit big endian value.<br>{RB} only documents the second and third bytes, and indicates that the first one is usually 0.<br>{LEEXE} clarifies that the first two bytes contain the "high page number", but does not detail its structure.
@03	i8	Flags{RB}{OW}{LEEXE}<br>Note: the sources disagree on its format.<br>Microsoft's own header files seem to imply it can contain values 0 to 4 as the LX entry.<br>{OW} treats it as identical to LX flags, always generates 0.<br>{RB} only defines values 0 and 3, with 3 being relocations required.<br>{LEEXE} provides a bit field:
		%0:1
			=03	Last page in file
		%6:7
			=00	Legal page
			=01	Iterated page
			=02	Invalid page
			=03	Zero filled page

> This is the format of an LX entry.

@00	i32le	Offset to page data shifted by the Page offset shift. For zero filled pages, this is 0
@04	i16le	Data size. The remainder of the page size is filled with zero for a legal physical page or the iterated data records
@06	i16le	Flags
		=00	Legal physical page, offset from start of Preload pages
		=01	Iterated data page, offset from start of Iterated data pages
		=02	Invalid page
		=03	Zero filled page
		=04	Range of pages
		=05	Compressed page, offset from Preload pages{IBM96}
		=08	M3-packed{OW}

> The two formats encode different information. The LE format contains the page number and the offset into the fixup page table. For LX, the fixup page table goes in parallel with the object page table, and each entry corresponds to the accompanying other entry.

> The LX format contains the offset and size of each page. For LE, every page but the last one in the file has the same size, and they come consecutively.

SECTION 1/objitpgtbl:Object Iterated Page Table

> Same structure as {objpgtbl}.

SECTION 1/restbl:Resource Table

@00	i16le	Type ID
		=01	<tt>RT_POINTER</tt> &mdash; mouse pointer shape{IBM96}
		=02	<tt>RT_BITMAP</tt> &mdash; bitmap{IBM96}
		=03	<tt>RT_MENU</tt> &mdash; menu template{IBM96}
		=04	<tt>RT_DIALOG</tt> &mdash; dialog template{IBM96}
		=05	<tt>RT_STRING</tt> &mdash; string tables{IBM96}
		=06	<tt>RT_FONTDIR</tt> &mdash; font directory{IBM96}
		=07	<tt>RT_FONT</tt> &mdash; font{IBM96}
		=08	<tt>RT_ACCELTABLE</tt> &mdash; accelerator tables{IBM96}
		=09	<tt>RT_RCDATA</tt> &mdash; binary data{IBM96}
		=0A	<tt>RT_MESSAGE</tt> &mdash; error message tables{IBM96}
		=0B	<tt>RT_DLGINCLUDE</tt> &mdash; dialog include file name{IBM96}
		=0C	<tt>RT_VKEYTBL</tt> &mdash; key to vkey tables{IBM96}
		=0D	<tt>RT_KEYTBL</tt> &mdash; key to UGL tables{IBM96}
		=0E	<tt>RT_CHARTBL</tt> &mdash; glyph to character tables{IBM96}
		=0F	<tt>RT_DISPLAYINFO</tt> &mdash; screen display information{IBM96}
		=10	<tt>RT_FKASHORT</tt> &mdash; function key area short form{IBM96}
		=11	<tt>RT_FKALONG</tt> &mdash; function key area long form{IBM96}
		=12	<tt>RT_HELPTABLE</tt> &mdash; help table for Cary Help manager{IBM96}
		=13	<tt>RT_HELPSUBTABLE</tt> &mdash; help subtable for Cary Help manager{IBM96}
		=14	<tt>RT_FDDIR</tt> &mdash; DBCS uniq/font driver directory{IBM96}
		=15	<tt>RT_FD</tt> &mdash; DBCS uniq/font driver{IBM96}
@02	i16le	Name ID
@04	i32le	Resource size
@08	i16le	Object number
@0A	i32le	Offset within object image

SECTION 1/rntbl:Resident Name Table

@00	i8	Length of the string or 0 to terminate the table. {IBM92} reserved bit 7 as an Overload bit for additional information for parameter type checking, but this behavior is absent from {IBM96}
@01	c[*]	ASCII text of the string name, not terminated with null
@...	i16le	Ordinal number

SECTION 1/enttbl:Entry Table

> Entries are combined into bundles. Every bundle has the following heading:

@00	i8	Number of entries in the bundle. A 0 value indicates the end of the {enttbl}
@01	i8	Bundle (entry) type
		%0:6
			=00	{unent}
			=01	{16ent}
			=02	{286ent}
			=03	{32ent}
			=04	{forwent}
		%7	Parameter typing information

SECTION 2/unent:Unused entry

> Unused entries have no following data, the next bundle follows directly after the first 2 bytes.

SECTION 2/16ent:16-bit entry

> The bundle has a 4 byte header followed by 3 byte entries:

@02	i16le	Object number

>

@00	i8	Flags
		%0	Exported entry
		%1	(LE) Segment uses a global/shared data segment{LEEXE}
		%3:7	Parameter word count
@01	i16le	Offset in object

SECTION 2/286ent:286 call gate entry

> The bundle has a 4 byte header followed by 5 byte entries:

@02	i16le	Object number

>

@00	i8	Flags
		%0	Exported entry
		%3:7	Parameter word count
@01	i16le	Offset in object
@03	i16le	Call gate selector, reserved

SECTION 2/32ent:32-bit entry

> The bundle has a 4 byte header followed by 5 byte entries:

@02	i16le	Object number

>

@00	i8	Flags
		%0	Exported entry
		%1	(LE) Segment uses a global/shared data segment{LEEXE}
		%3:7	Parameter word count
@01	i32le	Offset in object

SECTION 2/forwent:Forwarder entry

> The bundle has a 4 byte header followed by 5 byte entries:

@02	i16le	Reserved

>

@00	i8	Flags
		%0
			=0	Import by name
			=1	Import by ordinal
@01	i16le	Module number
@03	i16le	Procedure name offset<br>Import ordinal number

SECTION 1/modfmtdirtbl:Module Format Directives Table (optional)

> TODO

SECTION 1/resdirdattbl:Resident Directives Data Table (optional)

> TODO

SECTION 1/perpgcks:Per-Page Checksum

> TODO

SECTION fixsect:Fixup Section (resident)

{fixpgtbl}
{fixrectbl}
{impmodtbl}
{impproctbl}
{perpgcks} (LE only){VXD}

SECTION 1/fixpgtbl:Fixup Page Table

> For every page there is a 32-bit (little endian) value for the offset of the first relocation record within {fixrectbl} in bytes. There is a final 32-bit (little endian) value that is the size of the {fixrectbl}.

SECTION 1/fixrectbl:Fixup Record Table

> A collection of variable length fixup records, each referring to a fixup within a specific page. The header is either 3 or 4 bytes long, depending on the Source list flag.

@00	u8	Source flags
		%0:3	Source type
			=00	low 8-bit
			=02	16-bit selector
			=03	16:16-bit far pointer (32-bit)
			=05	16-bit offset within a segment
			=06	16:32-bit far pointer (48-bit)
			=07	32-bit offset within a segment
			=08	32-bit self relative fixup, {RB}for 16-bit segments, 16-bit self relative fixup
		%4	Fixup to 16:16-bit alias
		%5	Source list, providing a list of source offsets instead of a single one
@01	u8	Target flags
		%0:1	Target type
			=00	{intref}
			=01	{impordref}
			=02	{impnamref}
			=03	{entref}
		%2	Additive fixup, an additive field follows the record (but before the source offset list, if the Source list flag is set)
		%3	Internal chaining fixup. When set, the source offset is an offset to the first entry of a chain of fixups{IBM96}
		%4	Target offset width
			=0	16-bit
			=1	32-bit
		%5	Additive value width
			=0	16-bit
			=1	32-bit
		%6	Object number/module ordinal number width
			=0	8-bit
			=1	16-bit
		%7	Ordinal number width
			=0	16-bit or 32-bit
			=1	8-bit
@02	i16le	If the Source list flag is 0, this is the offset to the source
@02	i8	If the Source list flag is 1, this is the number of source offsets appearing after the target data
@03/<sub>x</sub>04	c[*]	Target data, depending on the reference type
@...	i16le[*]	If Source list flag is 1, this is a list of offsets

SECTION 2/intref:Internal reference

Target object number	Object number width (8-bit/16-bit)
Target offset	Target offset width (16-bit/32-bit)

SECTION 2/impordref:Imported reference by ordinal

Module index	Object number/module ordinal number width (16-bit/32-bit)
Imported ordinal	Ordinal number width (8-bit)<br>Target offset width (16-bit/32-bit)
Additive value	(Additive fixup) Additive value width (16-bit/32-bit)

SECTION 2/impnamref:Imported reference by name

Module index	Object number/module ordinal number width (16-bit/32-bit)
Procedure name offset into {impproctbl}	Target offset width (16-bit/32-bit)
Additive value	(Additive fixup) Additive value width (16-bit/32-bit)

SECTION 2/entref:Internal reference via entry table

Index into entry table	Object number/module ordinal number width (16-bit/32-bit)
Additive value	(Additive fixup) Additive value width (16-bit/32-bit)

SECTION 2/chain:Internal chaining fixups

> When the internal chaining fixup flag is set, the source address becomes the first element of a chain. Each chain element contains a 32-bit value at the source which is used to determine the next chain element and a relocation addend.{IBM96}

@00	i32le
		%0:19	Target offset, added to the base address, which is the target address minus the first target offset.
		%20:31	Source offset, to the next fixup within the same page, or 0xFFF

SECTION 1/impmodtbl:Import Module Name Table

@00	i8	Length of the string or 0 to terminate the table
@01	c[*]	ASCII text of the string name, not terminated with null

SECTION 1/impproctbl:Import Procedure Name Table

>  The first entry must be the null string.

@00	i8	Length of the string or 0 to terminate the table. reserved bit 7 as an Overload bit for additional information for parameter type checking, but this behavior is absent from
@01	c[*]	ASCII text of the string name, not terminated with null

SECTION datasect:Data Section

Preload pages
Demand load pages
{itdatpg}
{nrntbl}
{nrdirdat}

SECTION 1/itdatpg:Iterated data pages

@00	i16le	Number of iterations
@02	i16le	Pattern length
@04	c[*]	Pattern to be repeated

SECTION 1/nrntbl:Non-Resident Name Table

> Same format as the {rntbl}.

SECTION 1/nrdirdat:Non-Resident Directives Data

> TODO

SECTION debugsect:Debug Section

> TODO

REFERENCE {IBM92} "LX - Linear eXecutable Module Format Description" http://www.edm2.com/index.php/LX_-_Linear_eXecutable_Module_Format_Description
REFERENCE {IBM96} "IBM OS/2 16/32-bit Object Module Format (OMF) and Linear eXecutable Module Format (LX)" http://www.edm2.com/index.php/IBM_OS/2_16/32-bit_Object_Module_Format_(OMF)_and_Linear_eXecutable_Module_Format_(LX)
REFERENCE {OW} "OpenWatcom sources" https://github.com/open-watcom/open-watcom-v2
REFERENCE {RB} "Ralf Brown's interrupt list" http://www.delorie.com/djgpp/doc/rbinter/ix/
REFERENCE {LEEXE} "LINEAR-EXECUTABLE File Header Layout" https://www.ecsdump.net/?page_id=1151
REFERENCE {VXD} "(.vxd) LINEAR-EXECUTABLE (LE) File Header Layout (new header and object table only)" https://faydoc.tripod.com/formats/exe-LE.htm

######## PE

TITLE pe:Portable Executable
SECTION :Overall layout

> The PE format is probably the most widespread format for personal computer. It is based on the COFF file format, and several fields are similar to it. Similarly to other Microsoft formats, it starts with an MS-DOS stub that typically displays a message that this application can only be run in Windows, and then exits.

{stub}
{signature}
{coffhdr}
{opthdr1}
{opthdr2}
{opthdr3}
{secthdr}s
Section data
{symtab}
{relocs}

SECTION stub:MS-DOS stub

> A portable executable file starts with an MZ stub program, with the following additional or modified field.

@18	i16le	Should be 0x0040
@24	i16le	OEM Identifier
@26	i16le	OEM Info
@3C	i32le	Offset to {signature} from file start in bytes

SECTION signature:Signature

> Only part of an image.{PE} This signature identifies the application as PE. A COFF image follows it.

@00	i32le	<tt>'PE\0\0'</tt><br>Phar Lap uses <tt>'PL\0\0'</tt> to distinguish from Windows applications

SECTION coffhdr:COFF File Header

@00	i16le	Machine (COFF magic)
		=0x0000	unknown{TIS}{PE08}{PE}
		=0x014C	Intel 386{TIS}{PE99}{PE08}{TOUR}{PE}
		=0x8664	AMD64{PE08}{PE}
		=0x01C0	ARM{PE99}{PE08} little endian{PE}
		=0x01C2	ARM Thumb{PE08}{PE}
		=0x01C4	ARM Thumb-2 little endian{PE}
		=0xAA64	ARM64 little endian{PE}
		=0xA641	ARM64EC{MAGIC}
		=0x0200	Intel Itanium{PE99}{PE08}{PE}
		=0x5032	RISC-V 32-bit{PE}
		=0x5064	RISC-V 64-bit{PE}
		=0x5128	RISC-V 128-bit{PE}
		=0x0268	Motorola 68000{PE99}
		=0x014D	Intel i860{TOUR}
		=0x014D	Intel 486{TIS}
		=0x014E	Intel Pentium{TIS}
		=0x0162	MIPS Mark I: R2000{TIS}, R3000{TIS}{PE99}{TOUR}
		=0x0163	MIPS Mark 2: R6000{TIS}
		=0x0166	MIPS Mark 3: R4000{PE99}{TOUR}, MIPS{PE08} little endian{PE}
		=0x0168	MIPS R10000{PE99}
		=0x0266	MISP16{PE99}{PE08}{PE}
		=0x0366	MIPS with FPU{PE99}{PE08}{PE}
		=0x0466	MIPS16 with FPU{PE99}{PE08}{PE}
		=0x0169	MIPS WCE v2{PE08} little endian{PE}
		=0x0183	DEC Alpha AXP{TOUR}
		=0x0184	DEC Alpha AXP{PE99}
		=0x0284	DEC Alpha AXP 64-bit{PE99}
		=0x01D3	Matsushita AM33{PE08}{PE}
		=0x0EBC	EFI byte code{PE08}{PE}
		=0x9041	Mitsubishi M32R{PE08}{PE}
		=0x01F0	PowerPC{PE08}{PE99} little endian{PE}
		=0x01F1	PowerPC with floating point{PE08}{PE}
		=0x0601	PowerPC based Macintosh (stored in little endian) [checked with MSVC cross compiler]
		=0x01A2	Hitachi SH3{PE08}{PE}
		=0x01A3	Hitachi SH3 DSP{PE08}{PE}
		=0x01A6	Hitachi SH4{PE08}{PE}
		=0x01A8	Hitachi SH5{PE08}{PE}
		=0x0500	Hitachi SH big endian{MAGIC}
		=0x0550	Hitachi SH little endian{MAGIC}
#		=0x01DF	RISC System/6000 V3.1{MAGIC} # TODO
		=0x0290	PA-RISC{MAGIC}
		=0x6232	LoongArch 32-bit{PE}
		=0x6264	LoongArch 64-bit{PE}
@02	i16le	Number of Sections (COFF)
@04	i32le	Time Date Stamp, seconds since 1970-01-01 midnight (COFF)
@08	i32le	Offset to symbol table (COFF)<br>Should be 0 in PE image
@0C	i32le	Number of symbols in symbol table (COFF)<br>Should be 0 in PE image
@10	i16le	Size of optional header (COFF)
@12	i16le	Characteristics (COFF flags)
		%0	No relocations (COFF)
		%1	No unresolved symbols, executable (COFF)
		%2	No line number information, deprecated (COFF)
		%3	No local symbols, deprecated (COFF)
		%4	Aggressively trim working set (obsolete since Windows 2000){PE}
		%5	> 2GB support
		%6	Reserved
		%7	Little endian (deprecated)
		%8	Little endian, 32-bit (COFF)
		%9	No debugging information
		%10	Removable run from swap, fully load and run from swap if on removable media
		%11	Net run from swap, fully load and run from swap if on network
		%12	System file
		%13	DLL
		%14	Uniprocessor machine
		%15	Big endian (deprecated)

SECTION opthdr:Optional header

> The following parts only appear inside load images.

SECTION 1/opthdr1:Optional header standard fields

@00	i16le	Magic
		=0x0107	ROM image{PE}
		=0x010B	PE32, 32-bit
		=0x020B	PE32+, 64-bit
@02	i8	Major version
@03	i8	Minor version
@04	i32le	Size of code (COFF: text)
@08	i32le	Size of data (COFF)
@0C	i32le	Size of bss (COFF)
@10	i32le	Entry point relative to image base (COFF)
@14	i32le	Address of code relative to image base (COFF)
@18	i32le	(Not PE+) Address of data relative to image base (COFF)

SECTION 1/opthdr2:Optional header Windows-specific fields

@1C/18	i32le/i64le	Image base address, added to almost all address fields, must be multiple of 64Ki
		=0x00010000	Default for Windows CE executables
		=0x00400000	Default for Windows NT/95 executables and higher
		=0x10000000	Default for DLLs
@20	i32le	Section alignment in bytes<br>Default: page size
@24	i32le	File alignment of raw data sections in file, should be power of 2 between 512 and 64Ki
@28	i16le	OS major version
@2A	i16le	OS minor version
@2C	i16le	Image major version
@2E	i16le	Image minor version
@30	i16le	Subsystem major version
@32	i16le	Subsystem minor version
@34	i32le	Win32 version; must be 0
@38	i32le	Size of complete image in bytes (multiple of section alignment)
@3C	i32le	Size of headers, including DOS stub and section headers (multiple of file alignment)
@40	i32le	Checksum
@44	i16le	Subsystem
		=0x0000	Unknown
		=0x0001	Device driver, native Windows process
		=0x0002	Windows GUI
		=0x0003	Windows character mode
		=0x0005	OS/2 character mode{TIS}{TOUR}{PE}
		=0x0007	POSIX character mode
		=0x0008	Native Win9x driver{PE}
		=0x0009	Windows CE{PE08}{PE}
		=0x000A	EFI application{PE08}{PE}
		=0x000B	EFI driver with boot services{PE08}{PE}
		=0x000C	EFI driver with runtime services{PE08}{PE}
		=0x000D	EFI ROM image{PE08}{PE}
		=0x000E	Xbox{PE08}{PE}
		=0x0010	Windows boot application{PE}
@46	i16le	DLL characteristics
		=0x0001	Call on process startup{TIS}{TOUR}
		=0x0002	Call on process{TIS} termination ({TOUR} claims thread)
		=0x0004	Call on thread startup{TIS}{TOUR}
		=0x0008	Call on thread{TIS} termination ({TOUR} claims process)
		=0x0020	Can handle high entropy 64-bit virtual address space{PE}
		=0x0040	Can be relocated at load time{PE08}
		=0x0080	Code integrity check enforced{PE08}
		=0x0100	NX compatible image{PE08}
		=0x0200	Isolation aware, do not isolate{PE08}
		=0x0400	Does not use structured exception handling{PE08}
		=0x0800	Image must not be bound{PE08}
		=0x1000	Must execute in AppContainer{PE}, Reserved{PE08}
		=0x2000	WDM driver{PE08}
		=0x4000	Supports Control Flow Guard{PE}
		=0x8000	Terminal server aware{PE08}
@48	i32le/i64le	Size of stack to reserve
@4C/50	i32le/i64le	Size of stack to commit
@50/58	i32le/i64le	Size of heap to reserve
@54/60	i32le/i64le	Size of heap to commit
@58/68	i32le	Loader flags, 0
@5C/6C	i32le	Number of data directory entries

SECTION 1/opthdr3:Optional header data directories

> Stored as 4-byte relative virtual address and 4-byte size

@00	i32le[2]	Export table ({edata})
@08	i32le[2]	Import table ({idata})
@10	i32le[2]	Resource table ({rsrc})
@18	i32le[2]	Exception table
@20	i32le[2]	Certificate table; stored as file pointer and size
@28	i32le[2]	Base relocation table ({reloc})
@30	i32le[2]	Debug data
@38	i32le[2]	Architecture/Description string, must be 0
@44	i32le	Global pointer
@44	i32le	=0
@48	i32le[2]	Thread local storage table
@50	i32le[2]	Load configuration table{PE08}{PE}
@58	i32le[2]	Bound table import{PE08}{PE}
@60	i32le[2]	Import address table{PE08}{PE}
@68	i32le[2]	Delay import descriptor{PE08}{PE}
@70	i32le[2]	CLR runtime header{PE08}{PE}
@78	i32le[2]	Reserved, 0{PE08}{PE}

SECTION secthdr:Section header

> A sequence of structures encoding the sections.

@00	c[8]	Section name, padded with nulls (COFF)<br>A '/' followed by a decimal number gives an offset into the string table (not for executables)
@08	i32le	Total size of section
@0C	i32le	Virtual address (COFF)
@10	i32le	Size of data in image (COFF)
@14	i32le	Offset to section data from PE start (COFF)
@18	i32le	Offset to relocation data, 0 for executables (COFF)
@1C	i32le	Offset to line number entries (deprecated) (COFF)
@20	i16le	Number of relocations, 0 for executables (COFF)
@22	i16le	Number of line numbers (deprecated)
@24	i32le	Flags
		%3	<tt>TYPE_NO_PAD</tt> - Must not be padded (obsolete)
		%5	<tt>CNT_CODE</tt> - Executable (COFF)
		%6	<tt>CNT_INITILIAZED_DATA</tt> - Initialized data (COFF)
		%7	<tt>CNT_UNINITIALIZED_DATA</tt> - Uninitialized data (COFF)
		%8	<tt>LNK_OTHER</tt> - reserved
		%9	<tt>LNK_COMMENT</tt> - Comments
		%11	<tt>LNK_REMOVE</tt> - Not part of final image (object only)
		%12	<tt>LNK_COMDAT</tt> - COMDAT{PE}
		%15	<tt>GPREL</tt> - Data in section is referenced through the global pointer{PE}
		%16	<tt>MEM_PURGEABLE</tt> - reserved{PE} (typo in documentation, shows bit 17)
		%17	<tt>MEM_16BIT</tt> - reserved{PE}
		%18	<tt>MEM_LOCKED</tt> - reserved{PE}
		%19	<tt>MEM_PRELOAD</tt> - reserved{PE}
		%20:23	Alignment: 2 ** (value - 1)
		%24	<tt>LNK_NRELOC_OVFL</tt> - Contains extended relocations
		%25	<tt>MEM_DISCARDABLE</tt> - Discardable
		%26	<tt>MEM_NOT_CACHED</tt> - Non-cachable
		%27	<tt>MEM_NOT_PAGED</tt> - Non-pageable
		%28	<tt>MEM_SHARED</tt> - Shareable
		%29	<tt>MEM_EXECUTE</tt> - Executable
		%30	<tt>MEM_READ</tt> - Readable
		%41	<tt>MEM_WRITE</tt> - Writable

SECTION :Section data

> RVA is an abbreviation of relative virtual address. It is relative to the image base.

SECTION 1/:.debug section

> TODO

SECTION 1/:.drectve section

> TODO

SECTION 1/edata:Export (.edata) section

@00	i32le	Flags, reserved
@04	i32le	Date time stamp
@08	i16le	Major version
@0A	i16le	Minor version
@0C	i32le	RVA of ASCII string of name of DLL
@10	i32le	Starting ordinal number, typically 1
@14	i32le	Number of {expadrtab} entries
@18	i32le	Number of entries in the {expnamptrtab} as well as the ordinal table
@1C	i32le	RVA of {expadrtab}
@20	i32le	RVA of {expnamptrtab}
@24	i32le	RVA of {expordtab}

SECTION 2/expadrtab:Export address table

> A sequence of 32-bit RVA for the exported values. It is either the exported address, or a forwarder: a null-terminated ASCII string within the export table directory referencing another DLL entry, consisting of the DLL name, a '.' and either the name of the export, or '#' and the decimal value of the ordinal.

> An export can be accessed by ordinal by providing the index into this table, relative to the starting ordinal number.

SECTION 2/expnamptrtab:Export name pointer table

> A sequence of 32-bit RVA into the {expnamtab}. The entries should be ordered lexically. A symbol imported by name will match this entry, and the associated ordinal entry in the export ordinal table provides the ordinal value for an entry in the {expadrtab}.

SECTION 2/expordtab:Export ordinal table

> A sequence of 16-bit ordinal values, referencing the {expadrtab}, where each entry corresponds to the corresponding entry in the {expnamptrtab}.

SECTION 2/expnamtab:Export name table

> A series of null-terminated ASCII strings, referenced by {expnamptrtab}.

SECTION 1/idata:Import (.idata) section

SECTION 2/:Import directory table

> A sequence of entries for each imported DLL. It is closed by an entry of all zeros.

@00	i32le	RVA of {impluptab} (also called Characteristic)
@04	i32le	Datetime stamp
@08	i32le	Index of first forwarder reference
@0C	i32le	RVA of ASCII string of the DLL name
@10	i32le	RVA of {impadrtab}

SECTION 2/impluptab:Import lookup table

> A sequence of 32-bit or 64-bit entries. If the most significant bit (bit 31 or bit 63) is set, it provides a 16-bit ordinal import. Otherwise the low 31 bits provide the RVA of an entry in the {hinttab}. The table is closed by a 0 value.

SECTION 2/hinttab:Hint/name table

@00	i16le	Index into {expnamptrtab} of the imported DLL. If it fails, lookup uses the name instead
@02	c[*]	Null-terminated ASCII string of the imported name. An extra null byte is added to align to 2 bytes

SECTION 2/impadrtab:Import address table

> Identical in format and content to the {impluptab}, but the values get replaced by the actual addresses when loaded into memory.

SECTION 1/:.pdata section

> TODO

SECTION 1/reloc:Base relocation table (.reloc) section

> Each 4 KiB page has an associated relocation block that starts on a 4-byte boundary, containing the addresses that should be relocated by the base address.

SECTION 2/:Base relocation block

@00	i32le	RVA of the page
@04	i32le	Size of block in bytes, including these two fields
@08	i16le[*]
		%0:11	Offset from page start to the
		%12:15	Type of base relocation
			=0	Skipped
			=1	High 16 bits
			=2	Low 16 bits
			=3	32 bits
			=4	High 16 bits, followed by low 16 bits
			=5	MIPS jump instruction<br>ARM 32-bit MOVW/MOVT instruction pair<br>RISC-V high 20 bits
			=6	reserved
			=7	ARM Thumb 32-bit MOVW/MOVT instruction pair<br>RISC-V low 12-bit I-type format
			=8	RISC-V low 12-bit S-type format<br>LoongArch 32-bit consecutive 2 instructions<br>LoongArch 64-bit 4 consecutive instructions
			=9	MIPS16 jump instruction
			=10	64-bit

SECTION 1/:.tls section

> TODO

SECTION 1/:Load configuration section

> TODO

SECTION 1/rsrc:.rsrc section

> Resources are stored in a multi-level hierarchy. Windows uses 3 levels: type, name, language.

SECTION 2/resdirtab:Resource directory table

@00	i32le	Flags, reserved
@04	i32le	Datetime stamp
@08	i32le	Major version
@0A	i32le	Minor version
@0C	i16le	Number of entries identified by strings
@10	i32le	Number of entries identified by numbers

> This is then followed by the entries. First are the entries identified by strings, then the entries identified by numbers follow. All entries are stored lexicographically, then numerically.

@00	i32le	Offsets in the resource data directory to strings<br>Or 32-bit numbers
@04	i32le	If the high bit is clear, the address of a resource data<br>If the high bit is set, the address of another resource directory

SECTION 2/:Resource directory strings

> A sequence of Unicode strings used in {resdirtab}.

@00	i16le	Length of the string
@02	c16[*]	UTF-16 string

SECTION 2/:Resource data description

> Each resource has one entry.

@00	i32le	RVA of data
@04	i32le	The size of the resource in bytes
@08	i32le	Codepage
@0C	i32le	Reserved

SECTION 2/:Resource data

SECTION 1/:.cormeta section

> TODO

SECTION 1/:.sxdata section

> TODO

SECTION relocs:COFF relocations

> Only present in object files.

@00	i32le	Virtual address, relative to the image base (COFF)
@04	i32le	Symbol name<br>A 0-based index into the symbol table (COFF)
@08	i16le	Type (COFF)

> Relocation types for AMD64:

@08	i16le	Type (COFF)
		0x0001	64-bit address
		0x0002	32-bit address
		0x0003	32-bit RVA address
		0x0004	32-bit address relative from following byte
		0x0005-0x0009	32-bit address relative from byte at distance 1-5
		0x000A	16-bit section index
		0x000B	32-bit offset from its section
		0x000C	CLR token
		0x000D	7-bit offset from its section
		0x000E	32-bit signed span-dependent value
		0x000F	pair following span-dependent value
		0x0010	32-bit signed span-dependent value applied

> Relocation types for Intel 386:

@08	i16le	Type (COFF)
		0x0006	32-bit address (COFF)
		0x0007	32-bit RVA address
		0x000A	16-bit section index
		0x000B	32-bit offset from its section
		0x000C	CLR token
		0x000D	7-bit offset from its section
		0x0014	32-bit relative displacement (COFF)

> TODO: other systems

SECTION linenos:COFF line numbers

> These are deprecated.

@00	i32le	Symbol table index (if line number is 0) or virtual address
@04	i16le	1-based line number<br>0 for symbol table index

SECTION symtab:COFF symbol table

@00	c[8]	Symbol name, zero-padded (first 4 bytes should not be all zero)
@00	i32le	If zero, the symbol is inlined
@04	i32le	Offset to name in symbol table (only if first 4 bytes are zero)
@08	i32le	Value of symbol
@0C	i16le	Section number, 1-based
		=0x0000	External/undefined symbol
		=0xFFFF	Absolute symbol
		=0xFFFE	Debugging symbol
@0E	i16le	Symbol type: base type (Microsoft tools set this to 0x00 or 0x20)
		0x0000	No symbol
		0x0001	void
		0x0002	char, int8
		0x0003	short int, int16
		0x0004	int
		0x0005	long int, int32
		0x0006	float
		0x0007	double
		0x0008	struct ...
		0x0009	union ...
		0x000A	enum ...
		0x000B	Member in enumeration
		0x000C	unsigned char, uint8
		0x000D	unsigned short int, uint16
		0x000E	unsigned int
		0x000F	unsigned long int, uint32
		0x0010	Pointer
		0x0020	Function
		0x0030	Array
@10	i8	Storage class, only certain values are used
		0x00	No entry
		0x01	Automatic
		0x02	External/public (used)
		0x03	Static/private (used)
		0x04	External definition (TODO: swapped from COFF?)
		0x05	Register (TODO: swapped from COFF?)
		0x06	Label
		0x07	Undefined label
		0x08	Member of structure
		0x09	Function argument
		0x0A	Structure tag
		0x0B	Member of union
		0x0C	Union tag
		0x0D	Type definition
		0x0E	Undefined static
		0x0F	Enumeration tag
		0x10	Member of enumeration
		0x11	Register parameter
		0x12	Bitfield
		0x64	Beginning/end of block (.bb, .eb)
		0x65	Beginning/end of function (.bf, .ef) (used)
		0x66	End of structure
		0x67	File name (used)
		0x68	Section defintion
		0x69	Weak external
		0x6B	CLR token symbol
		0xFF	Physical end of function
@11	i8	Number of auxiliary entries, each entry occupying a symbol record

SECTION :Auxiliary symbols

> TODO

SECTION :COMDAT sections

> Object only.
> TODO

SECTION :CLR token definition

> Object only.
> TODO

SECTION :COFF string table

> Object only.
> TODO

SECTION :Attribute certificate table

> Image only.
> TODO

SECTION :Delay-load import tables

> Image only.
> TODO

REFERENCE {TIS} "Tool Interface Standard (TIS) Formats Specification for Windows TM, Version 1.0, 1993-02" https://www.x-ways.net/winhex/kb/ff/PE_EXE.pdf
REFERENCE {PE99} "Microsoft Portable Executable and Common Object File Format Specification, Revision 6.0, 1999-02" http://www.skyfree.org/linux/references/coff.pdf
REFERENCE {PE08} "Microsoft Portable Executable and Common Object File Format Specification, Revision 8.1, 2008-02-15" https://github.com/kazzmir/decompiler/blob/master/disassembler/pecoff_v8.pdf
#https://msdn.microsoft.com/en-us/library/ms809762.aspx
REFERENCE {TOUR} "Peering Inside the PE: A Tour of the Win32 Portable Executable File Format, 2010-06-30" https://learn.microsoft.com/en-us/previous-versions/ms809762(v=msdn.10)?redirectedfrom=MSDN
REFERENCE {PE} "PE Format - Microsoft" https://learn.microsoft.com/en-us/windows/win32/debug/pe-format
REFERENCE {MAGIC} "UNIX file magic numbers"

######## MP, MQ

TITLE mp:Phar Lap Executable Format ('MQ' and 'MQ')
SECTION :Overall layout

> This format comes in two modes: load modules '.exp' and relocatable load modules '.rex'. An '.exp' load module consists of a header and the following image data. A '.rex' module is similar but it is followed by relocations.

> The '.exp' or '.rex' file can also be combined with an MS-DOS stub into an '.exe' file that loads the image following the MZ structure. The Win386 does the same but it combines a '.rex' module with a Windows based loader (one that also comes with its own MS-DOS stub).

{stub}
{header} (including {relocs} for MQ)
Image

SECTION stub:Executable stub and loader

> When embedded inside a DOS .exe file, an additional entry in the header is used to store the start of the load module.

@3C	i32le	Offset to {header} from file start in bytes

> For executables using the Win386 Windows extender, that field is already used for the 'NE' header, which will load the executable into memory from Windows. Instead, the previous field is used:

@38	i32le	Offset to {header} from file start in bytes
@3C	i32le	Offset to the NE header for the Win386 extender

SECTION header:Header

@00	c[2]	'MP' for a regular module or 'MQ' for a relocatable module
@02	i16le	Number of bytes in the last 512 byte page, or 0 if the entire page is used
@04	i16le	Number of 512 byte pages in load module, rounded up
@06	i16le	Number of relocations, should be 0 for an 'MP' file
@08	i16le	Size of this header in 16 bytes paragraphs
@0A	i16le	Required minimum additional memory in 4KiB pages
@0C	i16le	Required maximum additional memory in 4KiB pages, 0xFFFF means all memory{RM}
@0E	i32le	Initial value of ESP (stack)
@12	i16le	Checksum, the sum of all 16-bit words in the file should be zero. Alternatively, it is the negation of the modular sum of all 16-bit words except this one{RM}
@14	i32le	Initial value of EIP (entry)
@18	i16le	Offset of first relocation from '.exp' module, should be 0x1E{OW}
@1A	i16le	Overlay number, should be 0{RM}{OW}
@1C	i16le	=0x0001{RM}{RB}

SECTION relocs:Relocations

> A sequence of i32le offsets from the image start that should be relocated. They contain addresses the base of the image should be added to.

@00	i32le
		%0:30	Address of value to be relocated
		%31
			=0	32-bit value
			=1	16-bit value{RM}

REFERENCE {RM} "386|LINK Reference Manual" https://archive.org/details/386-link/mode/2up
REFERENCE {RB} "Ralf Brown's interrupt list (Int 21/AH=4Bh)" http://www.ctyme.com/intr/rb-2939.htm
REFERENCE {OW} "OpenWatcom sources" https://github.com/open-watcom/open-watcom-v2

######## BW

TITLE bw:DOS/16M Executable Format ('BW')
SECTION :Overall layout

> An '.exp' load module consists of a header and the following segment data. It can appear on its own, or multiple modules can be spliced together, with an MZ stub attached.

> Information is organized around the concept of a global descriptor table (GDT), as used on the Intel 80286 CPU. Every part of the program is accessed in one of several segments. The physical address, size and access permissions for these segments are stored in a system structure called the GDT. Segments are addressed as 16-bit values, incremented by a value of 8, as an index into the GDT. The BW file format exposes this architecture to a high degree.

> The actual module header structure can be further subdivided into multiple parts.

{stub}
{dosbwhdr}
{bwaddhdr}
{gdthdr}
{gdtdata}
Segment data
{relocdata}
{dosbwhdr} for .exp file 2

> Relocations can come in two formats: RSI-1 or RSI-2.

SECTION stub:Executable stub and loader

> When embedded inside a DOS .exe file, an additional entry in the header is used to store the start of the load module.

@3C	i32le	Offset to {modhdr} from file start in bytes

SECTION modhdr:Module Header

> The module header consists of a block of header fields, followed by a GDT image. The block of header fields starts with a set of fields similar to those in the MZ header, followed by a few more specific to the DOS/16M extender. The GDT image also contains several header fields, however addressing GDT entries starts at that address, so they are separated out.

SECTION 1/dosbwhdr:DOS-style 'BW' header

@00	c[2]	'BW', signature that identifies it as a DOS/16M load module
@02	i16le	Number of bytes in the last 512 byte page, or 0 if the entire page is used
@04	i16le	Number of 512 byte pages in load module, rounded down{CD}
@06	i16le[2]	Reserved
@0A	i16le	Required minimum additional memory in KiB
@0C	i16le	Required maximum additional memory in KiB (implies private allocation)
@0E	i16le	Initial SS (stack segment)
@10	i16le	Initial SP (stack)
@12	i16le	For RSI-2, the selector for the first relocation (huge relocation list)
@14	i16le	Initial IP (entry)
@16	i16le	Initial CS (segment of entry)
@18	i16le	Size of the GDT (global descriptor table) at runtime in bytes - 1
@1A	i16le	Version of the tool that created the file<br>MAKEPM: major version * 100 + minor version<br>GLU{OW}: major version * 1000 + minor version (Watcom pretends to be GLU version 2.0)<br>GLU{CD}: (major version + 10) * 100 + minor version

SECTION 1/bwaddhdr:Additional fields in header

@1C	i32le	Position of next spliced .exp entry from start of file<br>Also end pointer to current load module
@20	i32le	Offset to start of CodeView{CD} debug info (TODO: not sure where it is stored inside the file)
@24	i16le	Last used selector value in GDT image<br>0 means the last used value can be derived from the size of the GDT image<br>(TODO: Watcom drops the last entry in the table)
@26	i16le	Private memory allocation in KiB{OW}
@28	i16le	Allocation increment (<tt>ExtReserve</tt>) in KiB{OW}
@2A	c[6]	Reserved

SECTION 1/:GDT image

> The first few GDT entries are overwritten by some additional header fields.

SECTION 2/gdthdr:Additional fields, inside GDT image

> Selector #0 (0x00)

@30	i16le	Runtime options{OW}, switch control{CD}
		%0	Force A20 line to 0 in 80386 real mode{CD}
		%1	Do not test for VCPI at startup{OW}
		%2	Do not defer BIOS INT 16h function 1{CD}<br>Do not inhibit keyboard polling{OW}
		%3	Allow overloading{OW}
		%4	<tt>OPT_INT10</tt> - ?{OW}
		%5	Initialize newly allocated memory to 0x00
		%6	Initialize newly allocated memory to 0xFF
		%7	Rotate selector assignment{OW}, do not reuse selectors immediately after cancelling{CD}
		%12	Relocation table is present, must be set to make relocatable{OW}
@32	i16le	Selector of transparent stack (obsolete{CD})
@34	i16le	Module flags
		%0	<tt>ef_auto</tt> - Automatic selectors, module is relocatable
		%1	<tt>ef_package</tt> - Module is an .exp package
		%2	<tt>ef_nobigfoot</tt> - Do not place stack in low DPMI memory{OW}
		%13	<tt>ef_sharedata</tt> - Data is global, not per-instance{OW}
		%14	<tt>ef_shareable</tt> - Component may be shared{OW}
		%15	<tt>ef_dos4g</tt> - Module requires DOS/4G{OW}
@36	i16le	Size of program in 16 byte paragraphs (obsolete{CD})

> Selector #1 (0x08)

@38	i16le	Size of GDT in file, in bytes
@3A	i16le	First used selector, first selector actually containing data<br>0 means 0x80 (selector #16)<br>The first selector is always stored at offset 0xB0{OWN}
@3C	i8	Default memory strategy
		=0x00	<tt>MPreferExt</tt> - Prefer extended memory<br>No strategy specified
		=0x01	<tt>MPreferLow</tt> - Prefer conventional memory
		=0x02	<tt>MForceExt</tt> - Requires extended memory
		=0x03	<tt>MForceLow</tt> - Requires conventional memory
		=0x04	<tt>MTransparent</tt> - Requires conventional memory, allocate selectors for transparent addressing{CD}
		=0x05	<tt>MTransStack</tt> - Transparent, aligned for use as stack{CD}
@3D	i8	Reserved, 0x92 (usually)
@3E	i16le	Size of transfer buffer in bytes, 0 means 8 KiB

> Selectors #2-#7 (0x10-0x38)

@40	i32le	Load module length (according to Watcom, not reflected in actual files)
@44	c[0x2C]	-

> Selectors #8-#15 (0x40-0x78)

@70	c[0x20]	Original .EXP file name

SECTION 2/:Old run-time selectors

> At run-time, the first few selectors were originally used by DOS/16M to refer to various system structures.{CD}

@00	i16le	Null selector (CPU enforced)
@08	i16le	Selector to access GDT (or LDT)
@10	i16le	Selector to access IDT
@18	i16le	Kernel code
@20	i16le	Kernel data
@28	i16le	MS-DOS program segment prefix
@30	i16le	MS-DOS environment
@38	i16le	Physical memory address 0
@40	i16le	BIOS data
@48	i16le	Reserved
@50	i16le	GDT auxiliary information segment
@58	i16le	Reserved
@60	i16le	Scratch descriptor for debugging
@68	i16le	Reserved
@70	i16le	Kernel code in extended memory
@78	i16le	Reserved
@80	i16le	First user-mode selector

SECTION 2/gdtdata:GDT data

> The actual GDT data typically starts at selector #16 (offset 0xB0). It is a sequence of structures similar to entries in an Intel 80286 GDT.

@00	i16le	Size of segment as stored in file - 1<br>0 means empty<br>Watcom generates 16 byte paragraph aligned values
@02	i24le	Address of segment in 16-byte paragraphs{OWN}, optional field, typically 0
@05	i8	Access bits
		%1	For code segments, set if readable<br>For data segments, set if writable (always readable)
		%3
			=0	Data segment
			=1	Code segment
		%4	1
		%5:6	Descriptor privilege level (0 for system/highest privilege, 3 for user mode/lowest)
		%7	1
@06	i16le
		%0:12	Required memory size in 16 byte paragraphs, maximum of 0x10000 allowed
		%13	If set, segment is empty, no file data or memory allocated
		%15	If set, marks a transparent stack

SECTION relocdata:Relocation data

> Relocation data is stored in segments, following the image segments. No image data comes after the relocations.

> Each relocation specifies a selector and offset that must be relocated. The data to be relocated contains a selector that will be modified according to what the actual loaded selector values are.

SECTION 1/:RSI-1

> The last two segments contain the relocations. The first of these two segments contains the selector values, the second one the offset values. Each relocation position is specified by the corresponding selector and offset values at the same position in the two segments.

> The list is terminated when the segment data terminates, or when both the selector and offset values are 0.

> Note that this gives a limit of 32768 relocations.

SECTION 1/:RSI-2

> The last several segments contain the relocations. Relocations are provided as a sequence of variable length structures of the following form:

@00	i16le	Selector values of addresses needed to be relocated
		%1	Set if this is the last relocation required
@02	i16le	Number of offsets corresponding to this selector value
@04	i16le[*]	Sequence of offsets that need relocation within this segment

REFERENCE {OW} "OpenWatcom sources" https://github.com/open-watcom/open-watcom-v2
REFERENCE {CD} "PMODE.H (1990-10-16), DOS16.H (1990-10-05) - USD-III sources" ftp://59.125.31.221/CD-ROM%20From%20MICROTEK/Cd-rom2/Sw/USD-III.220/SOURCE/
REFERENCE {OWN} "own research"

######## XP

TITLE xp:Ergo OS/286 Executable Format ('XP')
SECTION :Overall layout

> Much of the format is deduced through reverse engineering.

> The file consists of a header, a segment table, followed by the binary image.

{header}
{desctab}, part of the header
Binary image
Relocations?

SECTION header:Header

@00	c[4]	<tt>'XP\1\0'</tt>
@04	i32le	Offset to segment table base, typically 0x68
@08	i32le	Number of entries in segment table
@0C	i32le	Offset to image, typically directly following header
@10	i32le	Image size in bytes
@14	i32le	Offset to fixups (probably)
@18	i32le	Number of fixup entries (format unknown)
@1C	i32le	Minimum extent (unknown)
@20	i32le	Maximum extent (unknown)
@24	i32le	=0
@28	i32le	GS (16-bit register stored in a 32-bit field)
@2C	i32le	FS
@30	i32le	DS
@34	i32le	SS
@38	i32le	CS
@3C	i32le	ES
@40	i32le	EDI
@44	i32le	ESI
@48	i32le	EBP
@4C	i32le	ESP
@50	i32le	EBX
@54	i32le	EDX
@58	i32le	ECX
@5C	i32le	EAX
@60	i32le	EFLAGS
@64	i32le	EIP

SECTION desctab:Segment Table

> The segment table typically follows the header. Each entry has a structure very similar to an Intel 80386 segment descriptor inside an LDT.

@00	i16le	Limit or size of segment - 1, least significant 2 bytes
@02	i24le	Base, relative to image base + 0x100, least significant 3 bytes
@05	i8	Attributes (seems to only recognize segment descriptors)
		%0	=0
		%1	=1
		%2	=0
		%3
			=0	Data segment
			=1	Code segment
		%4	=1
		%5-6	DPL, typically 3
		%7	=1
@06	i8	Attributes
		%0-3: limit, most significant 1 byte
		%4: selector is alias (must not be set together with window)
		%5: selector is window (must not be set together with alias)
		%6: 32-bit (as for 386)
		%7: limit is given in pages instead of bytes (as for 386)
@07	i8	Base, most significant 1 byte

> The <tt>EXPRESS</tt> command seemingly generates pairs of data and an optional code segment. The first segment is supposed to correspond to the PSP.

SECTION :Needing more information

> The format of the fixups is currently not known. The meaning of extents is not understood. There may be additional unknown flags or entries. The runtime layout is not known. It is also not known if OS/386 uses the same file format, however based on the structure of the file, whether an executable is 16-bit or 32-bit can be determined from the segment table.

REFERENCE {OS286} "DMPEXP.EXE (OS/286)"

######## P3

TITLE p3:Phar Lap New Executable Format ('P3', 'P2')
SECTION :Overall layout

> This format comes in two models: flat model and multi-segmented model.

> The '.exp' file can also be combined with an MS-DOS stub into an '.exe' file that loads the image following the MZ structure.

SECTION 1/:Flat model

> The program consists of a header, followed by the run-time parameter block, an optional symbol table and the program image. (TODO: not sure about the position of the symbol table)

{header}
{rtpb}
{symtab}
Program image
{debinfo} (optional)

SECTION 1/:Multi-segmented model

> The program consists of a header, followed by the segment information table, relocations, run-time parameter block, an optional symbol table and the program image.{OW} (TODO: not sure about the position of the symbol table)

> The program image consists of multiple segment images. It also contains some low level Intel 80286/80386 specific entries such as the task state segment and descriptor tables.

{header}
{seginftab}
{relocs}
{rtpb}
{symtab}
{tss} in program image
{gdt} in program image
{idt} in program image
{ldt} in program image
Code and data segments in program image
{debinfo} (optional)

> A 16-bit (<tt>P2</tt>) file could typically be segmented, with relocations, a runtime parameter block and an LDT, but no segment information table, TSS, GDT or IDT. The Watcom compiler can also generate 32-bit (<tt>P3</tt>) segmented files, complete with a segment-information table, TSS, GDT, an 8-byte long IDT and an LDT, with code/data segments being stored in the LDT, while the TSS/GDT/IDT/LDT accessible via selectors in GDT.

SECTION header:Header

@00	c[2]	'P3' for 80386<br>'P2' for 80286{RB}
@02	i16le
		=0001	Flat model
		=0002	Multi-segmented model{RB}{OW}
@04	i16le	Size of {header} in bytes, should be 0x0180
@06	i32le	Size of entire '.exp' file, including all header information
@0A	i16le	Checksum, the sum of all 16-bit words in the file should be zero. Alternatively, it is the negation of the modular sum of all 16-bit words except this one{RM}
@0C	i32le	Offset to {rtpb} from start of '.exp' file, should be 0x0180 for flat model progarms
@10	i32le	Size of {rtpb}
@14	i32le	(Multi-segmented) Offset to {relocs} from start of '.exp' file{RB}{OW}, should be 0x00000000 for flat model programs{RM}
@18	i32le	(Multi-segmented) Size of {relocs}{RB}{OW}, should be 0x0000 for flat model programs{RM}
@1C	i32le	(Multi-segmented) Offset to {seginftab} from start of '.exp' file{RB}{OW}, should be 0x00000000 for flat model programs{RM}
@20	i32le	(Multi-segmented) Size of {seginftab}{RB}{OW}, should be 0x0000 for flat model programs{RM}
@24	i16le	(Multi-segmented) Size of {relocs} entry{RB}{OW}, should be 0x000C{OW}, should be 0x0000 for flat model programs{RM}
@26	i32le	Offset to program image from start of '.exp' file
@2A	i32le	Size of program image in file, containing the code and data
@2E	i32le	Offset to {symtab}, 0x00000000 if no symbols are present
@32	i32le	Size of {symtab}, 0x00000000 if no symbols are present
@36	i32le	(Multi-segmented) Offset of {gdt} within program image, should be 0x00000000 for flat model programs{RM}
@3A	i32le	(Multi-segmented) Size of {gdt}, should be 0x00000000 for flat model programs{RM}
@3E	i32le	(Multi-segmented) Offset of {ldt} within program image, should be 0x00000000 for flat model programs{RM}
@42	i32le	(Multi-segmented) Size of {ldt}, should be 0x00000000 for flat model programs{RM}
@46	i32le	(Multi-segmented) Offset of {idt} within program image, should be 0x00000000 for flat model programs{RM}
@4A	i32le	(Multi-segmented) Size of {idt}, should be 0x00000000 for flat model programs{RM}
@4E	i32le	(Multi-segmented) Offset of {tss} within program image, should be 0x00000000 for flat model programs{RM}
@52	i32le	(Multi-segmented) Size of {tss}, should be 0x00000000 for flat model programs{RM}, 0x0000002C or more for 80286{286}, 0x00000068 or more for 80386{386}
@56	i32le	(Flat{RB}) Minimum number of bytes to allocate after the program image
@5A	i32le	(Flat{RB}) Maximum number of bytes to allocate after the program image
@5E	i32le	(Flat{RB}) Base offset at which the executable is linked<br>Used to trap null references{RM}
@62	i32le	Initial ESP (stack)
@66	i16le	(Multi-segmented) Initial SS (segment of stack){RB}{OW}
@68	i32le	Initial EIP (entry)
@6C	i16le	(Multi-segmented) Initial CS (segment of entry){RB}{OW}
@6E	i16le	(Multi-segmented) Initial LDT value{RB}{OW}
@70	i16le	(Multi-segmented) Initial TSS value{RB}{OW}
@72	i16le	Flags
		%0	Load image is compressed (packed)
		%1	32-bit checksum is present{RB}
		%2:4	Relocation table type{RB}
@74	i32le	Load image in memory when uncompressed, same as image size of uncompressed files
@78	i32le	Optional 32-bit checksum{RB}
@7C	i32le	Size of initial stack in bytes
@80	c[0x100]	Reserved

SECTION seginftab:Segment Information Table

> Only for multi-segmented programs.{RB}{OW} For every segment in the data, there should be a corresponding entry in the segment information table. The descriptor tables and task state segments normally do not require an entry.

@00	i16le	Selector number
		%0:1	Privilege level
		%2
			=0	Addresses a GDT entry
			=1	Addresses an LDT entry
@02	i16le	Flags
@04	i32le	Base offset within program image
@08	i32le	Extra bytes to be allocated for the segment

SECTION relocs:Relocation Table

> Only for multi-segmented programs.{RB}{OW} Addresses of 16-bit selector values in the image that need to be relocated.

> For a 16-bit file (<tt>'P2'</tt>), each entry in the relocation table consists of a 4-byte entry:{OWN}

@00	i16le	Offset to value to be relocated
@02	i16le	Selector of segment of value to be relocated

> For a 32-bit file (<tt>'P3'</tt>), each entry in the relocation table consists of a 6-byte entry:{OW}

@00	i32le	Offset to value to be relocated
@04	i16le	Selector of segment of value to be relocated

SECTION rtpb:Run-time Parameter Block

> This should begin at offset 0x0180 for flat-model programs. The format is usually the 'DX' format.

@00	c[2]	'DX' for extended '.exp' files, it can be changed{RM}
@02	i16le	<tt>MINREAL</tt>, minimum number of 16-byte paragraphs of real mode memory to leave free
@04	i16le	<tt>MAXREAL</tt>, maximum number of 16-byte paragraphs of real mode memory to leave free
@06	i16le	<tt>MINIBUF</tt>, minimum number of 1KiB blocks for data buffer for DOS system calls
@08	i16le	<tt>MAXIBUF</tt>, maximum number of 1KiB blocks for data buffer for DOS system calls
@0A	i16le	<tt>NISTACK</tt>, number of interrupt stacks, controls the maximum number of nested switches between real mode and protected mode
@0C	i16le	<tt>ISTSIZE</tt>, size in 1KiB blocks of each interrupt stack buffer
@0E	i32le	<tt>REALBREAK</tt>, end of real mode code and data
@12	i16le	<tt>CALLBUFS</tt>, size of call buffer in 1KiB to be used for passing data between real mode and protected mode
@14	i16le	Flags
		%0	File is virtual memory manager{RB}, reserved for Phar Lap{RM}
		%1	File is debugger{RB}, reserved for Phar Lap{RM}
		%2:15	Reserved{RM}
@16	i16le	Unprivileged flag{RM}
		=0x0000	<tt>PRIVILEGED</tt>, run program at privilege level 0{RM}{RB}
		=0x0001	<tt>UNPRIVILEGED</tt>, run program at privilege level 1, 2 or 3{RM}{RB}
@18	c[0x66]	Reserved

SECTION symtab:Symbol Table

> The PUBSYM symbol table has the following layout:{RM}

{symtabhdr}
{segsymtab}
{pubsymtab}

SECTION 1/symtabhdr:Symbol Table Header

@00	c[4]	<tt>'SYM1'</tt>
@04	i16le	Size of {symtabhdr} in bytes, should be 0x0E
@06	i32le	Size of {segsymtab} in bytes
@0A	i32le	Size of {pubsymtab} in bytes

SECTION 1/segsymtab:Segment Symbol Table

> Each entry starts with a variable length field containing its name.

@00	i8	Length of name
@01	c[*]	String containing name

> The name is then followed by a fixed 12-byte structure.

@00	i32le	Offset to segment within program image
@04	i32le	Size of segment
@08	i16le	Selector (real mode) or paragraph (protected mode) of segment
@0A	i16le	Segment flags
		%0	Absolute segment (only in real mode)

SECTION 1/pubsymtab:Public Symbol Table

> Each entry starts with a variable length field containing its name.

@00	i8	Length of name
@01	c[*]	String containing name

> The name is then followed by a fixed 12-byte structure.

@00	i32le	Offset to symbol within segment<br>Constant value for absolute symbols
@04	i16le	1-based index of selector of symbol in {segsymtab}

SECTION tss:Intel Task State Segment

> Only for multi-segmented programs.{RB}{OW} This is part of the program image and reflects an Intel 80286/80386 Task State Segment (TSS).

> The Intel 80286/80386 architecture contains a structure that permits hardware assisted task switching. It contains entries for each register, stack segment and offset values for switching between different levels of privilege and some other administrative information. There are separate 16-bit and 32-bit versions (and later, 64-bit version) introduced for the 80286 and 80386, respectively.

SECTION 1/:16-bit Task State Segment

> This is the 16-bit version{286}, presumably used for 'P2' files. (TODO)

@00	i16le	Link
@02	i16le	SP (stack pointer) for ring 0 (highest privilege)
@04	i16le	SS (stack segment) for ring 0 (highest privilege)
@06	i16le	SP (stack pointer) for ring 1
@08	i16le	SS (stack segment) for ring 1
@0A	i16le	SP (stack pointer) for ring 2
@0C	i16le	SS (stack segment) for ring 2
@0E	i16le	IP, point of execution at task switching
@10	i16le	FLAGS, state of CPU flags
@12	i16le	AX
@14	i16le	CX
@16	i16le	DX
@18	i16le	BX
@1A	i16le	SP
@1C	i16le	BP
@1E	i16le	SI
@20	i16le	DI
@22	i16le	ES
@24	i16le	CS (code segment), segment of executing task at task switching
@26	i16le	SS (stack segment), segment of stack at task switching
@28	i16le	DS
@2A	i16le	LDTR

SECTION 1/:32-bit Task State Segment

> This is the 32-bit version{386}, used for 'P3' files.{OW}

@00	i16le	Link
@02	i16le	=0
@04	i32le	ESP (stack pointer) for ring 0 (highest privilege)
@08	i16le	SS (stack segment) for ring 0 (highest privilege)
@0A	i16le	=0
@0C	i32le	ESP (stack pointer) for ring 1
@10	i16le	SS (stack segment) for ring 1
@12	i16le	=0
@14	i32le	ESP (stack pointer) for ring 2
@18	i16le	SS (stack segment) for ring 2
@1A	i16le	=0
@1C	i32le	CR3 (control register 3), address of paging structure
@20	i32le	EIP, point of execution at task switching
@24	i32le	EFLAGS, state of CPU flags
@28	i32le	EAX
@2C	i32le	ECX
@30	i32le	EDX
@34	i32le	EBX
@38	i32le	ESP
@3C	i32le	EBP
@40	i32le	ESI
@44	i32le	EDI
@48	i16le	ES
@4A	i16le	=0
@4C	i16le	CS (code segment), segment of executing task at task switching
@4E	i16le	=0
@50	i16le	SS (stack segment), segment of stack at task switching
@52	i16le	=0
@54	i16le	DS
@56	i16le	=0
@58	i16le	FS
@5A	i16le	=0
@5C	i16le	GS
@5E	i16le	=0
@60	i16le	LDTR
@62	i16le	=0
@64	i16le
		%0	Debug trap bit, causes the CPU to raise an exception on task switch
@66	i16le	I/O permission map offset from TSS start

SECTION :Descriptor Tables

> The Intel architecture defines a wide range of descriptor types. The following gives a general overview of the structure.

@00	i16le	Limit or offset value
@02	i16le	Base address or selector value
@04	i8	Byte 2 of base address or supplementary information
@05	i8	Access flags
		%0:3	Descriptor type
		%4
			=0	System descriptor
			=1	Code or data segment descriptor
		%5:6	Descriptor privilege level (0 for highest privilege, 3 for lowest privilege)
		%7	Present bit (must be 1 for properly accessing descriptor)
@06	i8	(80386 or later) Attribute bits or byte 2 of offset value
@07	i8	(80386 or later) Byte 3 of base address or offset value

> A typical segment descriptor has the following layout:

@00	i16le	Low 16 bits of limit, last byte in segment, or 0 for an empty segment
@02	i24le	Low 24 bits of starting address of segment, OpenWatcom sets this to 0{OW}
@05	i8	Access flags
		%0	Accessed bit
		%1	Data segments: writable<br>Code segments: readable
		%2	Data segments: expand-down, limit is the lower limit of the segment<br>Code segments: conforming, transfers to this segment will preserve the current privilege level
		%3
			=0	Data segment
			=1	Code segment
		%4	=1
		%5:6	Descriptor privilege level (0 for highest privilege, 3 for lowest privilege)
		%7	Present bit (must be 1 for properly accessing descriptor)
@06	i8	(80386 or later) Attribute bits
		%0:3	Bits 16 to 23 of limit
		%4	Bit available for user
		%5	Reserved (64-bit flag for 64-bit code segments, not used by Phar Lap)
		%6	32-bit segment
		%7	High granularity flag: limit value is shifted by 12 bits
@07	i8	(80386 or later) High 8 bits of starting address of segment, OpenWatcom sets this to 0{OW}

> The descriptor of an LDT or TSS:

@00	i16le	Low 16 bits of limit, last byte in segment
@02	i24le	Low 24 bits of starting address of segment, OpenWatcom sets this to 0{OW}
@05	i8	Access flags
		%0:3
			=0x01	16-bit available TSS (invalid in 64-bit mode)
			=0x02	LDT
			=0x03	16-bit busy TSS (invalid in 64-bit mode)
			=0x09	32-bit available TSS (also 64-bit)
			=0x0B	32-bit busy TSS (also 64-bit)
		%4	=1
		%5:6	Descriptor privilege level (0 for highest privilege, 3 for lowest privilege)
		%7	Present bit (must be 1 for properly accessing descriptor)
@06	i8	(80386 or later) Attribute bits
		%0:3	Bits 16 to 23 of limit
		%4	Bit available for user
		%5	Reserved
		%6	Reserved
		%7	High granularity flag: limit value is shifted by 12 bits
@07	i8	(80386 or later) High 8 bits of starting address of segment, OpenWatcom sets this to 0{OW}

> The descriptor of a call, interrupt or trap gate:

@00	i16le	Low 16 bits of offset
@02	i16le	Selector for gate
@04	i8	Usually reserved<br>For a call gate, the low 5 bits provide the parameter count, number of 16-bit/32-bit words that need to be transferred between privilege levels (invalid in 64-bit mode)<br>(in 64-bit mode, interrupt and trap gates use the lower 3 bits to reference an interrupt stack table)
@05	i8	Access flags
		%0:3
			=0x04	16-bit call gate (invalid in 64-bit mode)
			=0x06	16-bit trap gate (invalid in 64-bit mode)
			=0x07	16-bit interrupt gate (invalid in 64-bit mode)
			=0x0C	32-bit call gate (also 64-bit)
			=0x0E	32-bit trap gate (also 64-bit)
			=0x0F	32-bit interrupt gate (also 64-bit)
		%4	=0
		%5:6	Descriptor privilege level (0 for highest privilege, 3 for lowest privilege)
		%7	Present bit (must be 1 for properly accessing descriptor)
@06	i16le	(80386 or later) High 16 bits of offset

> The descriptor of a task gate (invalid in 64-bit mode):

@00	i16le	Reserved
@02	i16le	Selector for TSS
@04	i8	Reserved
@05	i8	Access flags
		%0:3	=0x05
		%4	=0
		%5:6	Descriptor privilege level (0 for highest privilege, 3 for lowest privilege)
		%7	Present bit (must be 1 for properly accessing descriptor)
@06	i16le	Reserved

SECTION 1/gdt:Intel Global Descriptor Table

> Only for multi-segmented programs.{RB}{OW} This is part of the program image and reflects an Intel 80286/80386 Global Descriptor Table (GDT). A global descriptor table provides the description of segments and gates that are supposed to be system wide. A GDT may contain all types of descriptors except interrupt and trap gates. Segment selectors address the GDT if bit 2 is 0.

> OpenWatcom stores a dummy selector, as required by the architecture, then a 32-bit TSS, followed by 16-bit data segments to access the TSS, GDT, IDT, then an LDT and a 16-bit data segment to access the LDT.{OW}

SECTION 1/idt:Intel Interrupt Descriptor Table

> Only for multi-segmented programs.{RB}{OW} This is part of the program image and reflects an Intel 80286/80386 Interrupt Descriptor Table (IDT). The Intel architecture defines 256 interrupt values, and in protected mode the IDT can hold a descriptor for each of these. Only task, interrupt and trap gates are permitted.

> OpenWatcom stores only a dummy selector.{OW}

SECTION 1/ldt:Intel Local Descriptor Table

> Only for multi-segmented programs.{RB}{OW} This is part of the program image and reflects an Intel 80286/80386 Local Descriptor Table (LDT). Similarly to a global descriptor table, it contains descriptions of segments and gates. The Intel architecture makes it convenient to switch local descriptor tables, so it is usually used for task specific information. An LDT may contain only segment descriptors, as well as call and task gates. Segment selectors address the LDT if bit 2 is 1.

> OpenWatcom stores a dummy selector, then an entry for each segment in the program image.{OW}

SECTION debinfo:Borland Debug Information

> This optional section appears after the program image.{RB}

> TODO

REFERENCE {RM} "386|LINK Reference Manual" https://archive.org/details/386-link/mode/2up
REFERENCE {RB} "Ralf Brown's interrupt list (Int 21/AH=4Bh)" http://www.ctyme.com/intr/rb-2939.htm
REFERENCE {OW} "OpenWatcom sources" https://github.com/open-watcom/open-watcom-v2
REFERENCE {286} "Intel 80286 Reference Programmer's Manual" https://archive.org/details/8028680287progra00inte
REFERENCE {386} "Intel 80386 Reference Programmer's Manual" https://nju-projectn.github.io/i386-manual/toc.htm
REFERENCE {OWN} "own research"

######## RSRC

TITLE rsrc:Macintosh Resource
SECTION :Overall layout

> Classic Macintosh executables are stored together with other resources, as <tt>'CODE'</tt> resources. The first part will be an overview of the resource file format in general.

{rsrchdr}
Reserved area
{rsrcdat}
{rsrcmap} (header)
{typelist}
{reflist}
{namelist}

SECTION rsrchdr:Resource header

@00	i32be	Offset of {rsrcdat} from start of resource header, should be 0x0100
@04	i32be	Offset of {rsrcmap} from start of resource header
@08	i32be	Length of {rsrcdat}
@0C	i32be	Length of {rsrcmap}

SECTION rsrcdat:Resource data

> A sequence of resources, each encoded as follows.

@00	i32be	Length of resource data, following this longword
@04	c[*]	Actual resource data

SECTION rsrcmap:Resource map

@00	c[0x10]	Reserved for copy of resource header
@10	c[4]	Reserved for handle to next resource map
@14	c[2]	Reserved for file reference number
@16	i16be	Reserved fork attributes
@18	i16be	Offset of {typelist} from beginning of resource map
@1A	i16be	Offset of {namelist} from beginning of resource map
@1C	i16be	Number of types in {typelist} - 1
@1E	c[*]	{typelist}
@...	c[*]	{reflist}
@...	c[*]	{namelist}

SECTION 1/typelist:Resource type list

> Each type has the following format.

@00	c[4]	Resource type
@04	i16be	Number of resources of this type - 1
@06	i16be	Offset of {reflist} entry from beginning of {typelist}

SECTION 1/reflist:Reference list

> Each resource type has a sequence of corresponding reference list entries.

@00	i16be	Resource ID
@02	i16be	Offset of resource name from beginning of {namelist}<br>0xFFFF otherwise
@04	i8	Resource attributes
@05	i24be	Offset of resource data from beginning of {rsrcdat}
@08	i32be	Reserved for handle to resource

SECTION 1/namelist:Resource name list

> Each resource name has the following format.

@00	i8	Length of resource name
@01	c[*]	Resource name

SECTION :<tt>'CODE'</tt> resources

SECTION 1/:Runtime view

> Every Classic Macintosh application consists of code segments, a stack and an area of memory addressed via the <tt>A5</tt> register, referred to as the <b>A5 world</b>. The A5 world contains global variables as well as the <b>jump table</b> that permits code transfers between different code segments.

> Code segments and the jump table are loaded from the <tt>'CODE'</tt> resources. The jump table is stored as the <tt>'CODE'</tt> resource with resource ID 0.

SECTION 2/:Jump table entries

> The jump table stored in the <tt>'CODE'0</tt> resource has the following layout.

@00	i32be	Above A5 size
@04	i32be	Below A5 size, including global variables and QuickDraw global variables
@08	i32be	Jump table size, 8 times the number of entries
@0C	i32be	Jump table offset, relative to the A5 register, should be 0x20

> This is then followed by a sequence of (unloaded) jump table entries. There are two types of jump table entries: near model jump table entries (offset fits 16 bits) and far model jump table entries (offset requires 32 bits). Jump table entries (near and far) are grouped according to their segment.

> A jump table entry is accessed via the instruction <tt>jsr offset(a5)</tt> for some offset.

SECTION 3/:Near model jump table

> A near model jump table consists of a sequence of near model jump table entries. The format of an unloaded jump table entry is as follows:

@00	i16be	Routine offset from beginning of segment
@02	i32be	Instruction to load segment number onto stack<br><tt>mov #number, -(sp)</tt>
		@02	i16be	0x3F3C
		@04	i16be	Segment number
@06	i16be	<tt>_LoadSeg</tt> trap number<br>0xA9F0

> The format of a loaded jump table entry, only appearing after the image is loaded in memory, is as follows.

@00	i16be	Segment number
@02	i16be[3]	Instruction to jump to routine
		@02	i16be	0x4ED9
		@04	i32be	Absolute offset

SECTION 3/:Far model jump table

> A far model jump table being with a sequence of near model jump table entries, followed by a flag and a sequence of far model jump table entries. It would typically start with a single near model jump table entry, addressing a bootstrap code that patches the <tt>_LoadSeg</tt> command.

> Far model jump table entries are separated by a flag entry of the following format:

@00	i16be	0x0000
@02	i16be	Version number, 0xFFFF
@04	i32be	0x00000000

> This is then followed by (unloaded) far model jump table entries:

@00	i16be	Segment number
@02	i16be	<tt>_LoadSeg</tt> trap number<br>0xA9F0
@04	i32be	Segment offset

SECTION 3/:CFM-68K jump table

> A CFM-68K application is very similar to a far model jump table but with a different flag entry:

@00	i16be	0x0000
@02	i16be	Version number, 0xFFFD
@04	i32be	0x00000000

> Note: it is unclear if the <tt>'CODE'0</tt> resource only contains a single near jump table entry and no flag.

SECTION 2/:Format of near <tt>'CODE'</tt> segments

> All other <tt>'CODE'</tt> resources are loadable segments, and their resource ID is the number of the segment. Near model segments have a 4 byte header referencing the jump table data:

@00	i16be	Offset to first jump table entry from the start of the jump table
@02	i16be	Number of jump table entries

SECTION 2/:Format of far <tt>'CODE'</tt> segments

> Far model segments have a different header format:

@00	i16be	Version number, 0xFFFF
@02	i16be	Reserved, 0x0000
@04	i32be	A5 offset of near entries
@08	i32be	A5 number of near entries
@0C	i32be	A5 offset of far entries
@10	i32be	A5 number of far entries
@14	i32be	Offset of A5-relative relocation information
@18	i32be	Value of A5, to be added to addresses
@1C	i32be	Offset of PC-relative relocation information
@20	i32be	Segment load address
@24	i32be	Reserved, 0x00000000

> This header is then followed by the segment image, then the A5-relative relocation information, then the PC-relative relocation information.

> Relocation information is stored as a compressed list of offsets between 32-bit words that need relocation.

0x01-0x7F	Shifted by 1 for values between 0x02 and 0xFE
0x8080-0xFFFF	Low 15 bits shifted by 1 for values between 0x0100 and 0xFFFE
0x00 0x80008000-0xFFFFFFFF	Low 31 bits shifted by 1 for values between 0x00010000 and 0xFFFFFFFE
0x00 0x00	End of relocation information

SECTION 2/:Format of CFM-68K <tt>'CODE'</tt> segments

> CFM-68K model segments have a format similar to that of far segments:

@00	i16be	Version number, 0xFFFD
@02	i16be	Reserved, 0x0000
@04	i32be	A5 offset of jump table entries
@08	i32be	A5 number of jump table entries
@0C	i32be	A5 offset of transition vectors
@10	i32be	A5 number of transition vectors
@14	i32be	Reserved, 0x00000000
@18	i32be	Reserved, 0x00000000
@1C	i32be	Reserved, 0x00000000
@20	i32be	Reserved, 0x00000000
@24	i32be	Reserved, 0x00000000

> This header is then followed by the segment image.

REFERENCE {MMT} "More Macintosh Toolbox" https://developer.apple.com/library/archive/documentation/mac/pdf/MoreMacintoshToolbox.pdf
REFERENCE {MRA} "Mac OS Runtime Architectures" https://developer.apple.com/library/archive/documentation/mac/pdf/MacOS_RT_Architectures.pdf

######## APPLE

TITLE apple:
SECTION :Overall layout

SECTION header:Header

@00	i32be	Magic number
		=0x00051600	AppleSingle
		=0x00051607	AppleDouble
@04	i32be	Version number
		=0x00010000	Version 1
		=0x00020000	Version 2
@08	c[16]	(Version 1) Home file system<br>(Version 2) reserved, all zeroes
		<tt>"Macintosh&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"</tt>	Macintosh, A/UX
		<tt>"ProDOS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"</tt>	ProDOS
		<tt>"MS-DOS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"</tt>	MS-DOS
		<tt>"Unix&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"</tt>	UNIX
		<tt>"VAX&nbsp;VMS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"</tt>	VMS
@0C	i16be	Number of entries

> Each entry has the following format:

@00	i32be	Entry ID
		=1	{DataFork}
		=2	{RsrcFork}
		=3	{RealName}, in its home file system
		=4	{Comment}
		=5	{IconBW}
		=6	{IconColor}
		=7	(Version 1 only) {FileInfo}
		=8	(Version 2 only) {FileDatesInfo}
		=9	{FinderInfo}
		=10	(Version 2 only) {MacintoshFileInfo}
		=11	(Version 2 only) {ProDOSFileInfo}
		=12	(Version 2 only) {MSDOSFileInfo}
		=13	(Version 2 only) {AFPShortName}
		=14	(Version 2 only) {AFPFileInfo}
		=13	(Version 2 only) {AFPDirectoryID}
		=0x80000000-0xFFFFFFFF	user IDs
@04	i32be	Offset
@08	i32be	Size of entry

SECTION DataFork:Data fork

> Contains an arbitrary length sequence of bytes as stored for the file.

SECTION RsrcFork:Resource fork

> Contains the resource fork of a Macintosh or ProDOS file. Its structure is described elsewhere.

SECTION RealName:Real name

> Contains a string of the file name in its home filesystem.

SECTION Comment:Comment

> Standard Macintosh comment, stored as an ASCII string of at most 200 characters.

SECTION IconBW:Icon, B&amp;W

> Macintosh black and white icon. Expected to be the copy of an <tt>'ICON'</tt> or <tt>'ICN#'</tt> resource. The <tt>ASIconBW</tt> structure is as follows:

@00	i32be[32]	32 rows of 32 1-bit pixels packed in longwords{RFC}

SECTION IconColor:Icon, color

> Macintosh color icon. Most likely a copy of an <tt>'ICN#'</tt>, <tt>'ics#'</tt>, <tt>'icl4'</tt>, <tt>'ics4'</tt>, <tt>'icl8'</tt> or <tt>'ics8'</tt> resource.
> TODO

SECTION FileInfo:File Info

> Version 1 only. The exact layout depends on the home file system.

SECTION 1/:Macintosh

@00	i32be	Creation date (moved to {FileDatesInfo} in Version 2)
@04	i32be	Modification date (moved to {FileDatesInfo} in Version 2)
@08	i32be	Last backup date (moved to {FileDatesInfo} in Version 2)
@0C	i32be	Attributes (moved to {MacintoshFileInfo} in Version 2)
		%0	Locked
		%1	Protected

SECTION 1/:A/UX File Info

@00	i32be	Creation date (moved to {FileDatesInfo} in Version 2)
@04	i32be	Last use date &amp; time (moved to {FileDatesInfo} in Version 2)
@08	i32be	Last modification date &amp; time (moved to {FileDatesInfo} in Version 2)

SECTION 1/:MS-DOS File Info

@00	i32be	Modification date (moved to {FileDatesInfo} in Version 2)
@00	i16be	MS-DOS attributes (moved to {MSDOSFileInfo} in Version 2)

SECTION 1/:ProDOS File Info

@00	i32be	Creation date &amp; time (moved to {FileDatesInfo} in Version 2)
@04	i32be	Modification date &amp; time (moved to {FileDatesInfo} in Version 2)
@08	i16be	Access (moved to {ProDOSFileInfo} in Version 2)
@0A	i16be	File Type (moved to {ProDOSFileInfo} in Version 2)
@04	i32be	Auxiliary ("A/UX" in {AUX}, likely typo) type (moved to {ProDOSFileInfo} in Version 2)

SECTION FileDatesInfo:File Dates Info

> Version 2 only, all systems. The structure is called <tt>ASFileDates</tt>.{RFC}
> All entries are stored as a signed number, counting the seconds since 2000-01-01 GMT, midnight. Unknown entries are set to 0x80000000.{RFC}

@00	s32be	Creation date
@04	s32be	Modification date
@08	s32be	Backup date
@0C	s32be	Access date

SECTION FinderInfo:Finder information

> The first part is the <tt>FInfo</tt> structure.

@00	c[4]	<tt>fdType</tt> - File type{RFC}
@04	c[4]	<tt>fdCreator</tt> - File's creator{RFC}
@08	i16be	<tt>fdFlags</tt> - Finder flag bits{RFC}
		%0	(HFS only) File is on desktop{RFC}
		%1:3	Color coding{RFC}
		%4:5	Reserved{RFC}
		%6	Application available to multiple users{RFC}
		%7	File contains no INIT resources{RFC}
		%8	Finder has loaded bundle resources{RFC}
		%9	Reserved{RFC}
		%10	File contains custom icon{RFC}
		%11	File is a stationary pad{RFC}
		%12	File cannot be renamed by Finder{RFC}
		%13	File has a bundle{RFC}
		%14	File's icon is invisible{RFC}
		%15	(System 7) File is an alias{RFC}
@0A	Point	<tt>fdLocation</tt> - File's location in finder{RFC}
		@00	i16be	<tt>v</tt> - Vertical coordinate (Y)
		@02	i16be	<tt>h</tt> - Horizontal coordinate (X)
@0E	i16be	<tt>fdFldr</tt> - File's folder{RFC}

> This is followed by the <tt>FXInfo</tt> structure.

@10	i16be	<tt>fdIconID</tt> - Icon ID number{RFC}
@12	i16be[3]	<tt>fdUnused</tt> - Reserved{RFC}
@18	s8	<tt>fdScript</tt> - Script flag and code{RFC}
@19	s8	<tt>fdXFlags</tt> - Reserved{RFC}
@1A	i16be	<tt>fdComment</tt> - Comment ID number{RFC}
@1C	i32be	<tt>fdPutAway</tt> - Home directory ID{RFC}

SECTION MacintoshFileInfo:Macintosh File Info

@00	i32be	Flags
		%0	Locked
		%1	Protected

SECTION ProDOSFileInfo:ProDOS File Info

@00	i16be	Access
@02	i16be	File Type
@04	i32be	Auxiliary Type

SECTION MSDOSFileInfo:MS-DOS File Info

@00	i16be	MS-DOS attributes
		%0	Read-only{RFC}
		%1	Hidden{RFC}
		%2	System file{RFC}
		%3	Volume label{RFC}
		%4	Subdirectory{RFC}
		%5	New or modified (archive bit){RFC}

SECTION AFPShortName:AFP short name

> The short name, as stored on the AppleTalk Filing Protocol. Arbitrary length string, usually ASCII printable, starting with '!'.{RFC}

SECTION AFPFileInfo:AFP File Info

@00	i32be	Flags
		%0	Invisible
		%1	Multi User
		%2	System
		%3	Backup Needed

SECTION AFPDirectoryID:AFP Directory ID

@00	i32be	File's directory ID on AFP server

REFERENCE {AUX} "AppleSingle and AppleDouble format internals - A/UX Toolbox: Macintosh ROM Interface" https://web.archive.org/web/20160325000219/http://kaiser-edv.de/documents/AppleSingle_AppleDouble_v1.pdf
REFERENCE {ASAD} "AppleSingle/AppleDouble Formats for Foreign Files Developer's Note" https://web.archive.org/web/20180311140826/http://kaiser-edv.de/documents/AppleSingle_AppleDouble.pdf
REFERENCE {RFC} "RFC 1740 - MIME Encapsulation of Macintosh files" https://datatracker.ietf.org/doc/html/rfc1740

######## MACBINARY

TITLE macbin:MacBinary format
SECTION :Overall layout

> The MacBinary is an alternative to the AppleSingle format to transfer Macintosh files to other systems, combining the resource and data forks into a single file.

{header}
Data Fork, aligned on 128 bytes
Resource Fork, aligned on 128 bytes
Get Info comment, aligned on 128 bytes

SECTION header:Header

@00	i8	0x00 (Version 1: version number{MACBIN1})<br>Suggested for file check for MacBinary
@01	i8	Length of filename (1-63)
@02	c[0x3F]	Filename
@41	c[4]	(FInfo) File type
@45	c[4]	(FInfo) File creator
@49	i8	(FInfo) Finder flags
		%0	Inited{MACBIN1}{MACBIN3}
		%1	Changed{MACBIN1}, reserved{MACBIN3}
		%2	Busy{MACBIN1}, hasCustomIcon{MACBIN3}
		%3	Bozo{MACBIN1}, isStationary{MACBIN3}
		%4	System{MACBIN1}, nameLocked{MACBIN3}
		%5	Bundle{MACBIN1}, hasBundle{MACBIN3}
		%6	Invisible{MACBIN1}{MACBIN3}
		%7	Locked{MACBIN1}, isAlias{MACBIN3}
@4A	i8	0<br>Suggested for file check for MacBinary
@4B	i16be	(FInfo) y position in window
@4D	i16be	(FInfo) x position in window
@4F	i16be	(FInfo) window/folder ID
@51	i8	Protected flag bit (low order bit)
@52	i8	0 (Version 3: change for incompatible update to MacBinary I)<br>Suggested for file check for MacBinary I
@53	i32be	Data Fork length
@57	i32be	Resource Fork length
@5B	i32be	File creation date
@5F	i32be	File modification date
@63	i16be	(Version 1 extension) Get Info comment length
@65	i8	(Version 2, FInfo) Finder flags (remaining bits)
		%0	isOnDesk{MACBIN3}
		%1:3	color{MACBIN3}
		%4	reserved{MACBIN3}
		%5	requiresSwitchLaunch{MACBIN3}
		%6	isShared{MACBIN3}
		%7	hasNoInits{MACBIN3}
@66	i32be	(Version 3) <tt>"mBIN"</tt><br>Suggested for file check for check for MacBinary III
@6A	i8	(Version 3, FXInfo) Script of file [fdScript]
@6B	i8	(Version 3, FXInfo) Extended Finder flags [fdXFlags]
@6C	c[8]	reserved
@74	i32be	(Version 2) Unpacked file size or 0
@78	i16be	(Version 2) Length of secondary header, must be 0
@7A	i8	(Version 2) Version number
		0x11	Version 2
		0x12	Version 3
@7B	i8	(Version 2) Minimum required version number, 0x11
@7C	i16be	(Version 2) CRC of previous 124 bytes<br>Suggested for file check for check for MacBinary II
@7E	i16be	reserved

SECTION 1/:CRC calculation

> CRC calculation for the field at offset 0x7C is done using the CRC16-CCITT algorithm.

> Start with 0x1021.
> For each byte, xor the byte shifted by 8.
> Do the CRC loop: rotate 8 times, and each time there is a carry, xor 0x1021 to the result of that rotation.

REFERENCE {MACBIN1} "Macintosh Binary Transfer Format (MacBinary) Standard Proposal (1985-03-13)" https://web.archive.org/web/20050307030202/http://www.lazerware.com/formats/macbinary/macbinary.html
REFERENCE {MACBIN2} "Macintosh Binary Transfer Format (MacBinary II) Standard Proposal (1987-06-21)" https://web.archive.org/web/20050305042909/http://www.lazerware.com/formats/macbinary/macbinary_ii.html
REFERENCE {MACBIN3} "Macintosh Binary Transfer Format (MacBinary III) Standard Proposal (1996-12)" https://web.archive.org/web/20050305044255/http://www.lazerware.com:80/formats/macbinary/macbinary_iii.html

######## GS/OS OMF

TITLE gsos_omf:Object Module Format

SECTION :Overall layout

> An file in the Object Module Format can be an object (type 0xB1), library (type 0xB2) or a load file (types 0xB3-0xBE). The general structure of an OMF file is a sequence of segment headers and segment records.

{seghdr} 1
{segrec} sequence 1
{seghdr} 2
{segrec} sequence 2
...

> Library files contain a library dictionary segment.

> Load files can contain code, data, direct-page/stack, initialization, jump-table and pathname segments. Each segment contains binary data (<tt>LCONST</tt> record followed by zerod out <tt>DS</tt>), followed by a relocation directory (sequence of <tt>RELOC</tt>, <tt>cRELOC</tt>, <tt>INTERSEG</tt>, <tt>cINTERSEG</tt>, <tt>SUPER</tt> records).

> Run-time library files have type 0xB4, shell applications have type 0xB5.

SECTION seghdr:Segment header

> Every segment has a segment header. The format and size of the segment has to be determined using this structure. The value at offset 0x0F provides the version of the segment (each segment in a file can have a different version). The value at 0x00 will then provide the length of the segment. According to {disc}, the way that field is interpreted depends on whether it is an executable/object or a library.

@00	i32le	(Version 1{OMF}) <tt>BLKCNT</tt> - Number of 512 byte blocks in segment, including header<br>(Version 2{REF} and static libraries{disc}) <tt>BYTECNT</tt> - Number of bytes in segment, including header<br>Offset to next segment data, no alignment required
@04	i32le	<tt>RESSPC</tt> - Number of additional zero bytes to append to segment data (can be replaced via a <tt>DS</tt> record)
@08	i32le	<tt>LENGTH</tt> - Number of bytes in segment when loaded into memory, including zero bytes of <tt>RESSPC</tt>
@0C	i8	(Version 1{OMF}) <tt>KIND</tt><br>(Version 2{REF}) Reserved
		%0:4	Type (version 1)
			=0x00	Code Segment
			=0x01	Data Segment
			=0x02	Jump Table Segment
			=0x04	Pathname Segment
			=0x08	Library Dictionary Segment
			=0x10	Initialization Segment
			=0x11	Absolute Bank Segment
			=0x12	Direct Page/Stack Segment
		%5	Position independent (version 1)
		%6	Private (version 1)
		%7
			=0	Static (version 1)
			=1	Dynamic (version 1)
@0D	i8	<tt>LABLEN</tt> - Length of all label fields<br>A value of 0 means a variable length field, the first byte of which specifies the number of characters following
@0E	i8	<tt>NUMLEN</tt> - Length of number fields, must be 4 for Apple IIGS
@0F	i8	<tt>VERSION</tt> - OMF version, currently 1 (version 1.0) and 2 (version 2.0 or 2.1) are valid
@10	i32le	<tt>BANKSIZE</tt> - Maximum bank size of segment, must be power of 2 and <= 0x10000 for Apple IIGS, and a value of 0 permits crossing bank boundaries
@12	i16le	(Version 1{OMF}) Reserved<br>(Version 2{REF}) <tt>KIND</tt>
		%0:4	Type (version 2)
			=0x00	Code Segment
			=0x01	Data Segment
			=0x02	Jump Table Segment
			=0x04	Pathname Segment
			=0x08	Library Dictionary Segment
			=0x10	Initialization Segment
			=0x12	Direct Page/Stack Segment
		%8	Bank-relative (version 2)
		%9	Skip segment (version 2)
		%10	Reload segment (version 2)
		%11	Absolute-bank segment (version 2)
		%12	Do not load in special memory (version 2)
		%13	Position independent (version 2)
		%14	Private (version 2)
		%15
			=0	Static (version 2)
			=1	Dynamic (version 2)
@14	i16le	Reserved
@18	i32le	<tt>ORG</tt> - Absolute address of segment, or 0 if relocatable
@1C	i32le	<tt>ALIGN</tt> - Alignment, must be power of 2 and <= 0x10000 for Apple IIGS<br>Apple IIGS only supports page alignment (0x100) and bank alignment (0x10000)
@20	i8	<tt>NUMSEX</tt>, must be 0
		=0	Little endian
		=1	Big endian
@21	i8	(Version 1{OMF}) <tt>LCBANK</tt> - Bank number to load into, if <tt>ORG</tt> specifies an address in the Language Card area (banks 0x00, 0x01, 0xE0, 0xE1)<br>(Version 2{disc}) <tt>REVISION</tt> - OMF revision number, set to 1 for version 2.1 ({REF} claims it is reserved)
@22	i16le	(not Version 0{disc})<tt>SEGNUM</tt> - Segment number, must be equal to the index of the segment within the file, starting from 1
@24	i32le	(not Version 0{disc})<tt>ENTRY</tt> - Entry point of the segment
@28	i16le	(not Version 0{disc})<tt>DISPNAME</tt> - Offset to <tt>LOADNAME</tt>, typically 0x2C {REF}, or 0x30 for 2.1 {disc}
@2A	i16le	(not Version 0{disc})<tt>DISPDATA</tt> - Offset to the segment data, typically 0x3A + <tt>LABLEN</tt>
@2C	i32le	(optional, Version 2.1{disc}) <tt>tempOrg</tt>{REF}

> This is then followed by the <tt>LOADNAME</tt> field, at offset <tt>DISPNAME</tt> (not Version 0{disc}):

@00	c[0xA]	<tt>LOADNAME</tt>, always length 10 - Name of the segment according to linker
@0A	c[?]	<tt>SEGNAME</tt> - Name of the segment

> Note: {REF} calls the field at 0x0A <tt>blockCount</tt> which is probably a bug{disc}.

SECTION segrec:Segment record

> The segment body starts at <tt>DISPDATA</tt> (stored in {seghdr}), and it is a sequence of records. The first byte defines the record type. The number fields length <tt>NUMLEN</tt> and byte ordering <tt>NUMSEX</tt>, the offsets are indicated with assuming a value of 4, as dictated by Apple IIGS. The label fields have length <tt>LABLEN</tt>.

SECTION 1/:Records used in all modules

@00	i8	0x00 - <tt>END</tt> - end of segment

>

@00	i8	0xF1 - <tt>DS</tt> - inserts a sequence of zero bytes at the current location counter
@01	number	Number of zeros to insert

>

@00	i8	0xF2 - <tt>LCONST</tt> - load absolute data
@01	i32	Number of bytes of data
@05	c[*]	Data to be loaded

>

@00	i8	0xFB - <tt>General</tt> - (Version 2) reserved for Apple Computer, Inc.<br>0xFC-0xFF - <tt>Experimental</tt> - (Version 2)
@01	i32	Number of bytes
@05	c[*]	Data

SECTION 1/:Records used in load modules only

>

@00	i8	0xE2 - <tt>RELOC</tt> - patches an address within a segment
@01	i8	Number of bytes to relocate
@02	i8	Shift amount to address before patching value; positive values shift to the left, negative values to the right
@03	number	Offset to location to patch
@07	number	Offset from 0 that should be written

>

@00	i8	0xF5 - <tt>cRELOC</tt> - compressed <tt>RELOC</tt>, patches an address within a segment
@01	i8	Number of bytes to relocate
@02	i8	Shift amount to address before patching value; positive values shift to the left, negative values to the right
@03	i16	Offset to location to patch
@05	i16	Offset from 0 that should be written

>

@00	i8	0xE3 - <tt>INTERSEG</tt> - patches an address between segments
@01	i8	Number of bytes to relocate
@02	i8	Shift amount to address before patching value; positive values shift to the left, negative values to the right
@03	number	Offset to location to patch
@07	i16	File number, if a program has only 1 load file, the value is 1<br>for dynamic segments, this references a file with a jump table segment
@09	i16	Segment number, starting from 1<br>for dynamic segments, this references a jump table segment
@0B	number	Offset from 0 that should be written<br>for dynamic segments, this references a call to the System Loader for that reference

>

@00	i8	0xF6 - <tt>cINTERSEG</tt> - compressed <tt>INTERSEG</tt>, patches an address between segments, with file number 1
@01	i8	Number of bytes to relocate
@02	i8	Shift amount to address before patching value; positive values shift to the left, negative values to the right
@03	i16	Offset to location to patch
@05	i8	Segment number, starting from 1<br>for dynamic segments, this references a jump table segment
@06	i16	Offset from 0 that should be written<br>for dynamic segments, this references a call to the System Loader for that reference

>

@00	i8	0xF7 - <tt>SUPER</tt> - (Version 2) A super-compressed relocation-dictionary record
@01	i32	Number of bytes in the rest of the record
@05	i8	Record type
@06	c[*]	Lists 16-bit offsets in a sequence of blocks, each block corresonding to that page
		@00	i8	0x00-0x7F - Patch 1-128 offsets, the low bytes given in the following bytes<br>0x81-0xFF - Skip 1-128 pages, no following bytes
		@01	i8[*]	Low bytes of the offsets to patch at, within the same page

SECTION 2/:Super-compressed records

> For super-compressed records, only the addresses of the patches are provided. The way it will be patched depends on the type of the record and the value stored at the address at the time of patching.

Type	i8	0x00 - <tt>SUPER RELOC2</tt>, super-compressed <tt>RELOC</tt>, patches an address within a segment, relocate 2 bytes, bit-shift count of zero
Value	i16	Offset from 0 that should be written

>

Type	i8	0x01 - <tt>SUPER RELOC3</tt>, super-compressed <tt>RELOC</tt>, patches an address within a segment, relocate 3 bytes, bit-shift count of zero
Value	i16	Offset from 0 that should be written

>

Type	i8	0x02-0x0D - <tt>SUPER INTERSEG1</tt>-<tt>SUPER INTERSEG12</tt> - super-compressed <tt>INTERSEG</tt>, patches an address between segments, with file number 1-12, relocate 3 bytes, bit-shift count of zero
Value	i16	Offset from 0 that should be written<br>for dynamic segments, this references a call to the System Loader for that reference
Value+2	i8	Segment number, starting from 1<br>for dynamic segments, this references a jump table segment

>

Type	i8	0x0E-0x19 - <tt>SUPER INTERSEG13</tt>-<tt>SUPER INTERSEG24</tt> - super-compressed <tt>INTERSEG</tt>, patches an address between segments, with file number 1, segment number 1-12, relocate 2 bytes, bit-shift count of zero
Value	i16	Offset from 0 that should be written<br>for dynamic segments, this references a call to the System Loader for that reference

>

Type	i8	0x1A-0x25 - <tt>SUPER INTERSEG25</tt>-<tt>SUPER INTERSEG36</tt> - super-compressed <tt>INTERSEG</tt>, patches an address between segments, with file number 1, segment number 1-12, relocate 2 bytes, bit-shift count of -16 (0xF0)
Value	i16	Offset from 0 that should be written<br>for dynamic segments, this references a call to the System Loader for that reference

SECTION 1/:Records used in run-time library dictionaries only

>

@00	i8	0xF4 - <tt>ENTRY</tt> - used in the run-time library entry dictionary
@01	i16	Segment number
@03	number	Relative location within the load segment of the label
@07	label	Label

SECTION 1/:Records used in object files only

>

@00	i8	0x01-0xDF - <tt>CONST</tt> - load absolute data
@01	c[*]	Data to be loaded

>

@00	i8	0xE0 - <tt>ALIGN</tt> - insert zero bytes to align to boundary
@01	i32	Alignment, must be a power of 2 that is at most <tt>ALIGN</tt>

>

@00	i8	0xE1 - <tt>ORG</tt> - moves present location counter<br>if negative, subsequent writes will overwrite the previous data
@01	number	Amount of bytes to move

>

@00	i8	0xE4 - <tt>USING</tt> - loads the local labels from a data segment for usage
@01	label	Segment name

>

@00	i8	0xE5 - <tt>STRONG</tt> - requires that a segment must be linked, even if it is not referenced
@01	label	Segment name

>

@00	i8	0xE6 - <tt>GLOBAL</tt> - defines a global label at the current position<br>0xEF - <tt>LOCAL</tt> - defines a local label at the current position
@01	label	Label name, of length <tt>LABLEN</tt>
@...	i16	Number of bytes generated by the line, or 0xFFFF if it is greater or equal to 0xFFFF
@...	i8	Operation type
		='A'	Address-type DC statement
		='B'	Boolean-type DC statement
		='C'	Character-type DC statement
		='D'	Double-precision floating-point-type DC statement
		='F'	Floating-point-type DC statement
		='G'	EQU or GEQU statement
		='H'	Hexadecimal-type DC statement
		='I'	Integer-type DC statement
		='K'	Reference-address-type DC statement
		='L'	Soft-reference-type DC statement
		='M'	Instruction
		='N'	Assembler directive
		='O'	ORG statement
		='P'	ALIGN statement
		='S'	DS statement
		='X'	Arithmetic symbolic parameter
		='Y'	Boolean symbolic parameter
		='Z'	Character symbolic parameter
@...	i8	Private flag, designates the code or data segment as private if 0x01

>

@00	i8	0xE7 - <tt>GEQU</tt> - defines a global label with expression<br>0xF0 - <tt>EQU</tt> - defines a local label with expression
@01	label	Label name, of length <tt>LABLEN</tt>
@...	i16	Number of bytes generated by the line, or 0xFFFF if it is greater or equal to 0xFFFF
@...	i8	Operation type (same as <tt>GLOBAL</tt>)
@...	i8	Private flag, designates the code or data segment as private if 0x01
@...	expr	Expression

>

@00	i8	0xE8 - <tt>MEM</tt> - reserves a memory range
@01	number	Start address
@05	number	End address

>

@00	i8	0xEB - <tt>EXPR</tt> - evaluates an expression and stores its truncated value<br>0xEC - <tt>ZEXPR</tt> - evaluates an expression and stores its value, making sure the truncated bytes are 0<br>0xED - <tt>BEXPR</tt> - evaluates an expression and stores its value, making sure the truncated bytes match those of the location counter<br>0xF3 - <tt>LEXPR</tt> - like <tt>EXPR</tt>, but if the expression evaluates to a label with fixed, constant offset in a different dynamic code segment, a jump-table segment entry is generated
@01	i8	Size of value in bytes
@02	expr	Expression

>

@00	i8	0xEE - <tt>RELEXPR</tt> - generates a relative branch offset from a location
@01	i8	Size of value in bytes
@02	number	Offset of origin of branch
@06	expr	Expression

SECTION Expressions

> TODO (only relevant to object files)

SECTION Jump-table segment

> The jump-table begins with 8 zero bytes. Afterwards, each jump-table entry is 14 bytes long.

SECTION 1/:Unloaded state

> This is the format stored in files.

@00	i16le	User ID, initially 0, filled in after loading
@02	i16le	Load-file number, a value of 0 terminates the list
@04	i16le	Load-segment number
@06	i32le	Load-segment offset
@0A	c[4]	A long subroutine jump to the load function using <tt>JSL</tt>, the actual address is filled in after loading

SECTION 1/:Loaded state

> This format is only used for the image in memory.

@00	i16le	User ID
@02	i16le	Load-file number
@04	i16le	Load-segment number
@06	i32le	Load-segment offset
@0A	c[4]	A long jump to the reference using <tt>JML</tt>

SECTION Initialization segment

> When encountering an initialization segment, the System Loader transfers control to it. It must then return to the System Loader via a long return <tt>RTL</tt> instruction. It must also not change the stack pointer, use the current direct page, or reference segments that have not been loaded yet. When an application is restarted, initialization segments are also rerun.

REFERENCE {OMF} "Object Module Format ERS version 00:93"
REFERENCE {REF} "GS/OS Reference, Volume 2 (Beta Draft)"
REFERENCE {disc} "OMF v1.0? - comp.sys.apple2.programmer" https://groups.google.com/g/comp.sys.apple2.programmer/c/_wUSsAQ_N1E

######## Hunk

TITLE hunk:AmigaOS Hunk binary file

SECTION :Further work

> This format requires documentation.

######## Adam

TITLE adam:Adam Seychell's DOS32 executable
SECTION :Overall layout

Optional MZ stub (DJGPP only)
{header}
Executable image
{relocs}

SECTION header:Executable Header

@00	c[4]	Signature
		<tt>"Adam"</tt> - executable
		<tt>"DLL "</tt> - dynamic linking library
@04	i16le	Version number of linker (DLINK), in packed BCD format
@06	i16le	Version number of DOS32 required, in packed BCD format
@08	i32le	Size of DOS32 executable, without stub
@0C	i32le	Start of executable image from header start
@10	i32le	Size of executable image, start of relocations
@14	i32le	Memory required, including executable image
@18	i32le	Initial EIP (entry)
@1C	i32le	Initial ESP (stack)
@20	i32le	Number of relocations
@24	i32le	Flags
		%0	Compressed image
		%1	Display DOS32 logo on start
@28	i32le	Size of relocations{WDOSX}, apparently not used

SECTION 1/:Executable Header for the version 3.5 beta

> According to Michael Tippach's research{WDOSX}, version 3.5 uses a different header format.

@00	c[4]	Signature
		<tt>"Adam"</tt> - executable
		<tt>"DLL "</tt> - dynamic linking library
@04	i16le	Version number of linker (DLINK), in packed BCD format
@06	i16le	Version number of DOS32 required, in packed BCD format
@08	i32le	Size of DOS32 executable, without stub
@0C	i32le	Size of executable image
@10	i32le	Start of executable image from header start
@14	i32le	Initial EIP (entry)
@18	i32le	Memory required, including executable image
@1C	i32le	Initial ESP (stack)
@20	i32le	Start of relocations
@24	i8	Logo color
@25	i8	Logo delay
@26	i8	Flags
		%0	Compressed image
		%1	Display DOS32 logo on start
		%2	Unregistered
@27	i8	=0
@28	i32le	=0

SECTION relocs:Relocations

> Each relocation is stored as a 32-bit offset from the executable image start, and addresses a 16-bit word that is the selector of the data segment.

REFERENCE {DOS32V33} "A 32-bit DOS extender package, DOS32 Version 3.3 (1995-11-27)" https://hornet.org/code/hardware/pmode/dos32v33.zip
REFERENCE {WDOSX} "dos32.asm - Wuschel's DOS eXtender sources" http://tippach.business.t-online.de/wdosx/