COM file

thumb|A number of COM files in [[IBM PC DOS 1.0]]

A COM file is a type of simple executable file. On the Digital Equipment Corporation (DEC) VAX operating systems of the 1970s, <code>.COM</code> was used as a filename extension for text files containing commands to be issued to the operating system (similar to a batch file). . The bytes are placed starting at offset 0100h (256 decimal) because the previous bytes are reserved for system use (i.e., the DOS program segment prefix).

Before MS-DOS and the 8086 processor, in the Intel 8080 CPU architecture, only 65,536 bytes of memory could be addressed (address range 0000h to FFFFh). Under CP/⁠M, the first 256 bytes of this memory, from 0000h to 00FFh were reserved for system use by the zero page, and any user program had to be loaded at exactly 0100h to be executed.

Although the file format is the same in DOS and CP/M, .COM files for the two operating systems are not compatible; DOS COM files contain x86 instructions and possibly DOS system calls, while CP/M COM files contain 8080 instructions and CP/M system calls (programs restricted to certain machines could also contain additional instructions for 8085 or Z80).

MS-DOS was designed to run on the Intel 8086 processor which could address sixteen different memory "segments", each of which held 65,536 bytes of memory. Since .COM files were never intended to span multiple segments, Microsoft created a successor file format that allowed for larger programs: .EXE.

.COM files in DOS set all x86 segment registers to the same value and the SP (stack pointer) register to the offset of the last word available in the first 64 KiB segment (typically FFFEh) or the maximum size of memory available in the block the program is loaded into for both, the program plus at least 256 bytes stack, whatever is smaller, thus the stack begins at the very top of the corresponding memory segment and works down from there.

Execution preference

In DOS, if a directory contains both a COM file and an EXE file with same name, when no extension is specified the COM file is preferentially selected for execution. For example, if a directory in the system path contains two files named <code>foo.com</code> and <code>foo.exe</code>, the following would execute <code>foo.com</code>:

C:\>foo

A user wishing to run <code>foo.exe</code> can explicitly use the complete filename:

C:\>foo.exe

Taking advantage of this default behaviour, virus writers and other malicious programmers have used names like <code>notepad.com</code> for their creations, hoping that if it is placed in the same directory as the corresponding EXE file, a command or batch file may accidentally trigger their program instead of the text editor <code>notepad.exe</code>. Again, these .com files may in fact contain a .exe format executable.

On Windows NT and derivatives (Windows 2000, Windows XP, Windows Vista, and Windows 7), the environment variable is used to override the order of preference (and acceptable extensions) for calling files without specifying the extension from the command line. The default value still places <code>.com</code> files before <code>.exe</code> files. This closely resembles a feature previously found in JP Software's line of extended command line processors 4DOS, 4OS2, and 4NT.

Malicious usage of the .com extension

Some computer virus writers have hoped to take advantage of modern computer users' likely lack of knowledge of the file extension and associated binary format, along with their more likely familiarity with the .com Internet domain name. E-mails have been sent with attachment names similar to "www.example.com". Unwary Microsoft Windows users clicking on such an attachment would expect to begin browsing a site named <code><nowiki>http://www.example.com/</nowiki></code>, but instead would run the attached binary command file named <code>www.example</code>, giving it full permission to do to their machine whatever its author had in mind.

There is nothing malicious about the COM file format itself; this is an exploitation of the coincidental name collision between .com command files and .com commercial web sites.

Execution preference

Malicious usage of the .com extension

See also

Notes

References

External links