Do you understand .exe file format?

[Academia]

I have down loaded two versions of tidy.exe (they are from different sites)

One is about 300K and the other is about 100K long.

The program has the option of asking for the version.

They each reply the same version!

I looked with notebook and each start out with about 10 lines of gibberish.

Then the smaller one has about 10 blank lines followed by many gibberish
lines.

The larger one has about 30 blank lines followed by many gibberish lines.

They appear to run the same.

Can you explain what might cause the difference in the files?



Thanks in advance

 

[mayayana]

It's hard to know how they're different from looking
at them in Notepad. A PE file (portable executable,
which includes EXE, DLL, OCX) has a structure that
starts with a very complex header, defining information
about how and where the file runs, and also includes a sort
of index of the file's contents. But that data is mainly
present as byte groups representing numeric values.
You can't just read it. It has to be deciphered. Most of
the rest of the file typically consists of native code
instructions, the actual code instructions that run when
you run an EXE. That's also not readable in any normal
sense.

Near the end of an EXE file there's usually a Resource
Table which can contain bitmap images, icons, strings,
etc. If two EXEs are identical in function it's likely that
the larger one has extra resources that the first doesn't
have (though that's not guaranteed).

It may be that all you can find out for sure is that the
author of the EXE is very sloppy about setting versions
on their product.

 

[Academia]

Thanks for all the info

It's hard to know how they're different from looking
at them in Notepad. A PE file (portable executable,
which includes EXE, DLL, OCX) has a structure that
starts with a very complex header, defining information
about how and where the file runs, and also includes a sort
of index of the file's contents. But that data is mainly
present as byte groups representing numeric values.
You can't just read it. It has to be deciphered. Most of
the rest of the file typically consists of native code
instructions, the actual code instructions that run when
you run an EXE. That's also not readable in any normal
sense.

Near the end of an EXE file there's usually a Resource
Table which can contain bitmap images, icons, strings,
etc. If two EXEs are identical in function it's likely that
the larger one has extra resources that the first doesn't
have (though that's not guaranteed).

It may be that all you can find out for sure is that the
author of the EXE is very sloppy about setting versions
on their product.

 

[Plato]

I have down loaded two versions of tidy.exe (they are from different sites)

One is about 300K and the other is about 100K long.

Best to download from the Authors site.

 

[M.I.5¾]

I have down loaded two versions of tidy.exe (they are from different sites)

One is about 300K and the other is about 100K long.

The program has the option of asking for the version.

They each reply the same version!

I looked with notebook and each start out with about 10 lines of
gibberish.

Then the smaller one has about 10 blank lines followed by many gibberish
lines.

The larger one has about 30 blank lines followed by many gibberish lines.

They appear to run the same.

Can you explain what might cause the difference in the files?

The one thing I can tell you about the .exe file format is that the first
two bytes are always 'MZ'. I have never attempted to find out if an .exe
file runs if they are not.

 

[Academia]

I think he bailed out.

thanks

Best to download from the Authors site.

 

[Academia]

thanks

The one thing I can tell you about the .exe file format is that the first
two bytes are always 'MZ'. I have never attempted to find out if an .exe
file runs if they are not.

 

[HeyBub]

I have down loaded two versions of tidy.exe (they are from different
sites)
One is about 300K and the other is about 100K long.

The program has the option of asking for the version.

They each reply the same version!

I looked with notebook and each start out with about 10 lines of
gibberish.
Then the smaller one has about 10 blank lines followed by many
gibberish lines.

The larger one has about 30 blank lines followed by many gibberish
lines.
They appear to run the same.

Can you explain what might cause the difference in the files?



Thanks in advance

It could be this: Once upon a time there existed programs to take an EXE and
compress it (like ZIP). Added to the front of the file was a small program
to expand the compressed stuff and transfer control to the actual underlying
program. This technique had a couple of advantages:

1. It could take a large EXE and shrink it by as much as 80%. This was a
boon when disks were small or in delivering code via diskettes, modems, and
the like.
2. The compressed file resisted inspection by hex editors when looking for
passwords and other text.

The downside was that running the de-compress code added a few milliseconds
to the overall execution time.

 

[Academia]

That could be it because the smaller version shows no text in notepad while
the larger one show the text as readable.

thanks

 

[mayayana]

That could be it because the smaller version shows no text in notepad while
the larger one show the text as readable.

That's something I hadn't thought of. As far as
I know, upx.exe is the main program used for
EXE file compression. If that was used you should
see the characters "UPX" one or more times near
the beginning of the file when viewed in a hex
editor. (I've used UPX myself occasionally, but
generally don't bother as I found that any compression
achieved is pretty much negated when putting the
EXE file into a ZIP. Since the only real advantage of
compression is for transport, that makes UPX of
limited value. In other words, a 100KB EXE that
compresses to 40 KB with UPX will probably also
shrink to about 40 KB inside a ZIP. But if it's already
UPX'ed then the ZIP won't provide any further
significant compression. So it's 100-to-40 either
way.)

 

[M.I.5¾]

That's something I hadn't thought of. As far as
I know, upx.exe is the main program used for
EXE file compression. If that was used you should
see the characters "UPX" one or more times near
the beginning of the file when viewed in a hex
editor. (I've used UPX myself occasionally, but
generally don't bother as I found that any compression
achieved is pretty much negated when putting the
EXE file into a ZIP. Since the only real advantage of
compression is for transport, that makes UPX of
limited value. In other words, a 100KB EXE that
compresses to 40 KB with UPX will probably also
shrink to about 40 KB inside a ZIP. But if it's already
UPX'ed then the ZIP won't provide any further
significant compression. So it's 100-to-40 either
way.)

There are seceral others, so the absence of 'UPX' doesn not necessarily mean
that this is not the case.

 

[Academia]

You solved it. There is "UPX" in the smaller file?

 

[Academia]

Right - it contained "UPX"

thanks again

It could be this: Once upon a time there existed programs to take an EXE
and compress it (like ZIP). Added to the front of the file was a small
program to expand the compressed stuff and transfer control to the actual
underlying program. This technique had a couple of advantages:

1. It could take a large EXE and shrink it by as much as 80%. This was a
boon when disks were small or in delivering code via diskettes, modems,
and the like.
2. The compressed file resisted inspection by hex editors when looking for
passwords and other text.

The downside was that running the de-compress code added a few
milliseconds to the overall execution time.