Do you understand .exe file format?

I have down loaded two versions of tidy.exe (they are from different sites)

One is about 300K and the other is about 100K long.

The program has the option of asking for the version.

They each reply the same version!

I looked with notebook and each start out with about 10 lines of gibberish.

Then the smaller one has about 10 blank lines followed by many gibberish
lines.

The larger one has about 30 blank lines followed by many gibberish lines.

They appear to run the same.

Can you explain what might cause the difference in the files?



Thanks in advance

mayayana
Mon Jan 07 07:48:36 PST 2008

It's hard to know how they're different from looking
at them in Notepad. A PE file (portable executable,
which includes EXE, DLL, OCX) has a structure that
starts with a very complex header, defining information
about how and where the file runs, and also includes a sort
of index of the file's contents. But that data is mainly
present as byte groups representing numeric values.
You can't just read it. It has to be deciphered. Most of
the rest of the file typically consists of native code
instructions, the actual code instructions that run when
you run an EXE. That's also not readable in any normal
sense.

Near the end of an EXE file there's usually a Resource
Table which can contain bitmap images, icons, strings,
etc. If two EXEs are identical in function it's likely that
the larger one has extra resources that the first doesn't
have (though that's not guaranteed).

It may be that all you can find out for sure is that the
author of the EXE is very sloppy about setting versions
on their product. :)


> I have down loaded two versions of tidy.exe (they are from different
sites)
>
> One is about 300K and the other is about 100K long.
>
> The program has the option of asking for the version.
>
> They each reply the same version!
>
> I looked with notebook and each start out with about 10 lines of
gibberish.
>
> Then the smaller one has about 10 blank lines followed by many gibberish
> lines.
>
> The larger one has about 30 blank lines followed by many gibberish lines.
>
> They appear to run the same.
>
> Can you explain what might cause the difference in the files?
>
>
>
> Thanks in advance
>
>

Academia
Mon Jan 07 12:02:55 PST 2008

Thanks for all the info

"mayayana" <mayaXXyana1a@mindXXspring.com> wrote in message
news:uuhmlTUUIHA.4584@TK2MSFTNGP03.phx.gbl...
> It's hard to know how they're different from looking
> at them in Notepad. A PE file (portable executable,
> which includes EXE, DLL, OCX) has a structure that
> starts with a very complex header, defining information
> about how and where the file runs, and also includes a sort
> of index of the file's contents. But that data is mainly
> present as byte groups representing numeric values.
> You can't just read it. It has to be deciphered. Most of
> the rest of the file typically consists of native code
> instructions, the actual code instructions that run when
> you run an EXE. That's also not readable in any normal
> sense.
>
> Near the end of an EXE file there's usually a Resource
> Table which can contain bitmap images, icons, strings,
> etc. If two EXEs are identical in function it's likely that
> the larger one has extra resources that the first doesn't
> have (though that's not guaranteed).
>
> It may be that all you can find out for sure is that the
> author of the EXE is very sloppy about setting versions
> on their product. :)
>
>
>> I have down loaded two versions of tidy.exe (they are from different
> sites)
>>
>> One is about 300K and the other is about 100K long.
>>
>> The program has the option of asking for the version.
>>
>> They each reply the same version!
>>
>> I looked with notebook and each start out with about 10 lines of
> gibberish.
>>
>> Then the smaller one has about 10 blank lines followed by many gibberish
>> lines.
>>
>> The larger one has about 30 blank lines followed by many gibberish lines.
>>
>> They appear to run the same.
>>
>> Can you explain what might cause the difference in the files?
>>
>>
>>
>> Thanks in advance
>>
>>
>
>

Plato
Mon Jan 07 22:35:03 PST 2008

Academia wrote:
>
> I have down loaded two versions of tidy.exe (they are from different sites)
>
> One is about 300K and the other is about 100K long.

Best to download from the Authors site.



















--
http://www.bootdisk.com/

M
Tue Jan 08 05:17:07 PST 2008


"Academia" <academiaNOSPAM@a-znet.com> wrote in message
news:eBzhVAUUIHA.4092@TK2MSFTNGP06.phx.gbl...
>I have down loaded two versions of tidy.exe (they are from different sites)
>
> One is about 300K and the other is about 100K long.
>
> The program has the option of asking for the version.
>
> They each reply the same version!
>
> I looked with notebook and each start out with about 10 lines of
> gibberish.
>
> Then the smaller one has about 10 blank lines followed by many gibberish
> lines.
>
> The larger one has about 30 blank lines followed by many gibberish lines.
>
> They appear to run the same.
>
> Can you explain what might cause the difference in the files?
>
>

The one thing I can tell you about the .exe file format is that the first
two bytes are always 'MZ'. I have never attempted to find out if an .exe
file runs if they are not.

Academia
Tue Jan 08 09:36:28 PST 2008

I think he bailed out.

thanks

"Plato" <|@|.|> wrote in message
news:4783194f$0$333$bb4e3ad8@newscene.com...
> Academia wrote:
>>
>> I have down loaded two versions of tidy.exe (they are from different
>> sites)
>>
>> One is about 300K and the other is about 100K long.
>
> Best to download from the Authors site.
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> --
> http://www.bootdisk.com/
>

Academia
Tue Jan 08 10:48:49 PST 2008

thanks

"M.I.5¾" <no.one@no.where.NO_SPAM.co.uk> wrote in message
news:478373f7$1_1@glkas0286.greenlnk.net...
>
> "Academia" <academiaNOSPAM@a-znet.com> wrote in message
> news:eBzhVAUUIHA.4092@TK2MSFTNGP06.phx.gbl...
>>I have down loaded two versions of tidy.exe (they are from different
>>sites)
>>
>> One is about 300K and the other is about 100K long.
>>
>> The program has the option of asking for the version.
>>
>> They each reply the same version!
>>
>> I looked with notebook and each start out with about 10 lines of
>> gibberish.
>>
>> Then the smaller one has about 10 blank lines followed by many gibberish
>> lines.
>>
>> The larger one has about 30 blank lines followed by many gibberish lines.
>>
>> They appear to run the same.
>>
>> Can you explain what might cause the difference in the files?
>>
>>
>
> The one thing I can tell you about the .exe file format is that the first
> two bytes are always 'MZ'. I have never attempted to find out if an .exe
> file runs if they are not.
>
>

HeyBub
Tue Jan 08 14:29:53 PST 2008

Academia wrote:
> I have down loaded two versions of tidy.exe (they are from different
> sites)
> One is about 300K and the other is about 100K long.
>
> The program has the option of asking for the version.
>
> They each reply the same version!
>
> I looked with notebook and each start out with about 10 lines of
> gibberish.
> Then the smaller one has about 10 blank lines followed by many
> gibberish lines.
>
> The larger one has about 30 blank lines followed by many gibberish
> lines.
> They appear to run the same.
>
> Can you explain what might cause the difference in the files?
>
>
>
> Thanks in advance

It could be this: Once upon a time there existed programs to take an EXE and
compress it (like ZIP). Added to the front of the file was a small program
to expand the compressed stuff and transfer control to the actual underlying
program. This technique had a couple of advantages:

1. It could take a large EXE and shrink it by as much as 80%. This was a
boon when disks were small or in delivering code via diskettes, modems, and
the like.
2. The compressed file resisted inspection by hex editors when looking for
passwords and other text.

The downside was that running the de-compress code added a few milliseconds
to the overall execution time.

Academia
Tue Jan 08 16:14:42 PST 2008

That could be it because the smaller version shows no text in notepad while
the larger one show the text as readable.

thanks

"HeyBub" <heybub@gmail.com> wrote in message
news:eNii6XkUIHA.1168@TK2MSFTNGP02.phx.gbl...
> Academia wrote:
>> I have down loaded two versions of tidy.exe (they are from different
>> sites)
>> One is about 300K and the other is about 100K long.
>>
>> The program has the option of asking for the version.
>>
>> They each reply the same version!
>>
>> I looked with notebook and each start out with about 10 lines of
>> gibberish.
>> Then the smaller one has about 10 blank lines followed by many
>> gibberish lines.
>>
>> The larger one has about 30 blank lines followed by many gibberish
>> lines.
>> They appear to run the same.
>>
>> Can you explain what might cause the difference in the files?
>>
>>
>>
>> Thanks in advance
>
> It could be this: Once upon a time there existed programs to take an EXE
> and compress it (like ZIP). Added to the front of the file was a small
> program to expand the compressed stuff and transfer control to the actual
> underlying program. This technique had a couple of advantages:
>
> 1. It could take a large EXE and shrink it by as much as 80%. This was a
> boon when disks were small or in delivering code via diskettes, modems,
> and the like.
> 2. The compressed file resisted inspection by hex editors when looking for
> passwords and other text.
>
> The downside was that running the de-compress code added a few
> milliseconds to the overall execution time.
>

mayayana
Tue Jan 08 20:10:36 PST 2008



> That could be it because the smaller version shows no text in notepad
while
> the larger one show the text as readable.
>

That's something I hadn't thought of. As far as
I know, upx.exe is the main program used for
EXE file compression. If that was used you should
see the characters "UPX" one or more times near
the beginning of the file when viewed in a hex
editor. (I've used UPX myself occasionally, but
generally don't bother as I found that any compression
achieved is pretty much negated when putting the
EXE file into a ZIP. Since the only real advantage of
compression is for transport, that makes UPX of
limited value. In other words, a 100KB EXE that
compresses to 40 KB with UPX will probably also
shrink to about 40 KB inside a ZIP. But if it's already
UPX'ed then the ZIP won't provide any further
significant compression. So it's 100-to-40 either
way.)

M
Tue Jan 08 23:59:43 PST 2008


"mayayana" <mayaXXyana1a@mindXXspring.com> wrote in message
news:OcSh3WnUIHA.5160@TK2MSFTNGP05.phx.gbl...
>
>
>> That could be it because the smaller version shows no text in notepad
> while
>> the larger one show the text as readable.
>>
>
> That's something I hadn't thought of. As far as
> I know, upx.exe is the main program used for
> EXE file compression. If that was used you should
> see the characters "UPX" one or more times near
> the beginning of the file when viewed in a hex
> editor. (I've used UPX myself occasionally, but
> generally don't bother as I found that any compression
> achieved is pretty much negated when putting the
> EXE file into a ZIP. Since the only real advantage of
> compression is for transport, that makes UPX of
> limited value. In other words, a 100KB EXE that
> compresses to 40 KB with UPX will probably also
> shrink to about 40 KB inside a ZIP. But if it's already
> UPX'ed then the ZIP won't provide any further
> significant compression. So it's 100-to-40 either
> way.)
>

There are seceral others, so the absence of 'UPX' doesn not necessarily mean
that this is not the case.

Academia
Wed Jan 09 08:37:40 PST 2008

You solved it. There is "UPX" in the smaller file?

"mayayana" <mayaXXyana1a@mindXXspring.com> wrote in message
news:OcSh3WnUIHA.5160@TK2MSFTNGP05.phx.gbl...
>
>
>> That could be it because the smaller version shows no text in notepad
> while
>> the larger one show the text as readable.
>>
>
> That's something I hadn't thought of. As far as
> I know, upx.exe is the main program used for
> EXE file compression. If that was used you should
> see the characters "UPX" one or more times near
> the beginning of the file when viewed in a hex
> editor. (I've used UPX myself occasionally, but
> generally don't bother as I found that any compression
> achieved is pretty much negated when putting the
> EXE file into a ZIP. Since the only real advantage of
> compression is for transport, that makes UPX of
> limited value. In other words, a 100KB EXE that
> compresses to 40 KB with UPX will probably also
> shrink to about 40 KB inside a ZIP. But if it's already
> UPX'ed then the ZIP won't provide any further
> significant compression. So it's 100-to-40 either
> way.)
>
>
>
>

Academia
Wed Jan 09 08:40:17 PST 2008

Right - it contained "UPX"

thanks again

"HeyBub" <heybub@gmail.com> wrote in message
news:eNii6XkUIHA.1168@TK2MSFTNGP02.phx.gbl...
> Academia wrote:
>> I have down loaded two versions of tidy.exe (they are from different
>> sites)
>> One is about 300K and the other is about 100K long.
>>
>> The program has the option of asking for the version.
>>
>> They each reply the same version!
>>
>> I looked with notebook and each start out with about 10 lines of
>> gibberish.
>> Then the smaller one has about 10 blank lines followed by many
>> gibberish lines.
>>
>> The larger one has about 30 blank lines followed by many gibberish
>> lines.
>> They appear to run the same.
>>
>> Can you explain what might cause the difference in the files?
>>
>>
>>
>> Thanks in advance
>
> It could be this: Once upon a time there existed programs to take an EXE
> and compress it (like ZIP). Added to the front of the file was a small
> program to expand the compressed stuff and transfer control to the actual
> underlying program. This technique had a couple of advantages:
>
> 1. It could take a large EXE and shrink it by as much as 80%. This was a
> boon when disks were small or in delivering code via diskettes, modems,
> and the like.
> 2. The compressed file resisted inspection by hex editors when looking for
> passwords and other text.
>
> The downside was that running the de-compress code added a few
> milliseconds to the overall execution time.
>