Netware Loadable Module Format

I was not able to find official documentation on NLM file format (I did not put lots of effort on this activity, though :) If you have better documentation, please send it, I'll put it here.

Here is a standard NLM file header. Each NLM file is started with it.

struct nlmexe_t {
#define NLM_MAGIC_SIZE 0x18
  char    magic[NLM_MAGIC_SIZE];
#define NLM_MAGIC "NetWare Loadable Module\x1A"
  ulong   version;      // file Version
#define NLM_COMPRESSED	0x00000080L	// compressed NLM file
  char    fnamelen;     // modulename length
  char    fname[12+1];
  ulong   codeoff;      // offset to code segment
  ulong   codelen;      // length of code segment
  ulong   dataoff;      // offset to data segment
  ulong   datalen;      // length of data segment
  ulong   bssSize;      // Unitialized data size
  ulong   custoff;      // help off
  ulong   custlen;      // help length
  ulong   autoliboff;   // autoload library offset
  ulong   autolibnum;   // number of autoload libraries
  ulong   fixupoff;     // offset to fixups
  ulong   fixupnum;     // number of fixups
  ulong   impoff;       // offset to imported names
  ulong   impnum;       // number of imported names
  ulong   expoff;       // offset to exported names
  ulong   expnum;       // number of exported names
  ulong   puboff;       // offset to public names
  ulong   pubnum;       // number of public names
  ulong   startIP;      // entry point?
  ulong   endIP;        // terminate NLM
  ulong   auxIP;        // additional entry point
  ulong   modType;      // Module type
  ulong   flags;        // Module flags
};

Go back to IDA home page

Your feedback is appreciated atmailto:ig@datarescue.com