Fact-checked by Grok 2 weeks ago

New Executable

The New Executable (NE), also known as NewEXE, is a 16-bit segmented executable file format developed by Microsoft as an extension of the earlier MZ format, supporting executable files (.exe), dynamic-link libraries (.dll), and resource-only modules. Introduced in 1985 alongside , it enables dynamic linking, multiple code and data segments, and integrated resource storage for graphical elements like menus and icons, facilitating the creation of multitasking applications in protected-mode environments. The format begins with a standard 2.0-compatible stub header (identified by the "" signature), followed by a pointer at offset 0x3C to the NE-specific header starting with the "" signature. This header includes critical such as the linker's version, address, segment count, and minimum data allocation, along with tables for (defining attributes like movability and preloading), resources (categorized by type and name), module references, imported names, and resident name offsets. Flags within the header specify operational modes, including , , or support for compatibility, while relocation records handle fixes for loaded . Historically, the NE format powered 16-bit Windows from versions 1.0 through 3.1 (1985–1992), as well as OS/2 1.x (1987–1991), and remained compatible in later systems like Windows 9x and NT via emulation layers such as WOW. It addressed limitations of the flat MZ format by supporting up to 64K segments for code, data, and resources, enabling larger and more modular programs essential for the graphical user interfaces of early Windows. However, its 16-bit architecture and segmentation model became outdated with the rise of 32-bit computing; it was largely supplanted by the Linear Executable (LE) format in OS/2 2.0 and Windows 3.1's protected-mode components, and fully replaced by the Portable Executable (PE) format starting with Windows NT 3.1 in 1993. Key advantages of NE included built-in support for dynamic linking to shared libraries, reducing memory usage in multitasking scenarios, and a resource compiler integration that streamlined GUI development. Despite its obsolescence, NE files persist in legacy software, particularly 16-bit games and utilities from the Windows 3.x era, with tools like disassemblers still available for analysis and preservation.

History

Development and Introduction

The New Executable (NE) format was created by in 1984 as a successor to the format, specifically designed for use with and the early versions of Windows to enable advanced features such as dynamic linking of libraries and support for multitasking environments. This development addressed limitations in the MZ format, which was constrained by the segmented model of 16-bit processors and lacked robust mechanisms for shared code and data across applications. Key motivations for the NE format included leveraging the protected mode capabilities of the processor to allow for better and larger address spaces, which were essential for implementing (GUI) elements in Windows applications. By extending the MZ structure, NE incorporated support for segmented memory loading, resource tables for GUI components like icons and menus, and the ability to handle overlays and dynamic link libraries (DLLs), thereby facilitating more efficient multitasking and reducing memory overhead in resource-constrained systems. These enhancements were critical for transitioning from simple command-line programs to more sophisticated windowed applications. The NE format was formally introduced with the release of on November 20, 1985, marking the debut of Microsoft's first graphical operating environment, and it was also integrated into versions 3.2 and 3.3 to provide compatibility and execution support for Windows executables on the base DOS platform. Its design drew influences from the concurrent collaboration between Microsoft and on , initiated in June 1985, which emphasized protected-mode multitasking and shared executable standards that would later be adopted in OS/2 1.0.

Adoption and Evolution

The New Executable (NE) format saw primary adoption as the standard for 16-bit applications across several early and operating systems. Introduced with in 1985, it became the native executable format for Windows versions up to 3.x through 1992, enabling protected-mode execution and dynamic linking for graphical applications. Similarly, 1.x from 1987 to 1991 utilized NE as its core format for 16-bit executables, supporting multitasking and compatibility with Windows binaries via subsystems like Win-OS/2. , released in 1993, retained NE support specifically for 16-bit Windows and applications through its (WOW) layer, ensuring backward compatibility for legacy software on the new 32-bit platform. NE's evolution involved incremental refinements tied to linker versions and operating system needs, with early implementations providing basic segment-based loading in Windows 1.0. By 1986, multitasking 4.0 incorporated NE support alongside MZ executables, adding preemptive multitasking capabilities for NE files to enable concurrent execution in a DOS environment. In , the format incorporated enhanced resource handling and module management for more complex 16-bit applications. These updates focused on improving and , with NE files featuring a version field in the header to indicate levels across platforms. Later extensions to accommodated hybrid 16/32-bit environments, particularly in series (1995–2000), where it supported 16-bit components within a predominantly 32-bit architecture. Through segment tables and dynamic linking, NE allowed seamless integration of legacy 16-bit code with 32-bit (PE) modules, such as in drivers and WOW execution for older Windows applications. This hybrid capability extended NE's utility in transitional systems like and 98, bridging DOS-era software with emerging 32-bit features. NE's decline began with the widespread adoption of the format in (1995), which offered better 32-bit support and supplanted NE for new development, relegating it to legacy 16-bit compatibility. Despite this shift, maintained NE support through and subsystems until version 5.0, allowing execution of older executables in a protected environment. By the early , NE phased out entirely in favor of PE, though its influence persisted in emulation tools and historical analysis.

File Format

Overall Structure

The New Executable (NE) format functions as a container for 16-bit executable files, extending the format to support advanced features in graphical and multitasking operating systems. It commences with a standard , ensuring compatibility with loaders, followed immediately by the NE-specific structures beginning with the "NE" signature. This design allows NE files to be executed under while providing the necessary metadata for protected-mode environments. The overall layout includes several key components that organize the file's contents and dependencies: the NE header, which contains essential and offsets to subsequent tables; the table, detailing the locations and properties of and data segments; the resource table, holding embedded assets like bitmaps and dialog templates; the entry table, specifying resident entry points for procedures; the module reference table, listing external modules; the import names table, defining imported names and ordinals; and relocation data, used for runtime address adjustments. These elements collectively enable modular and relocatable code organization. NE files are identified by common extensions including .exe for standalone executables, .dll for dynamic-link libraries, .fon for font resource files, and .drv for device drivers, reflecting their varied applications in 16-bit Windows systems. At its core, the format leverages a segmented , where , , and are divided into discrete segments designated as movable (dynamically allocatable) or preload (fixed at load time), optimizing usage and sharing in resource-constrained environments. To detect an NE file, the loader examines the MZ header's e_lfanew field at offset 0x3C, which points to the offset of the "NE" signature, confirming the transition from the DOS-compatible prefix to the extended format.

NE Header

The New Executable (NE) header is a fixed 64-byte structure located immediately after the DOS stub, with its position indicated by the offset value at byte 0x3C in the MZ (DOS) header. This header encapsulates critical metadata about the executable, including versioning, memory allocation parameters, entry points, and pointers to subsequent tables within the file, enabling the loader to initialize and execute the program correctly. The header commences with a two-byte signature "NE" (ASCII values 0x4E and 0x45) at offset 0x00, unequivocally identifying the file as adhering to the format. Immediately succeeding this are the one-byte linker version fields at offsets 0x02 and 0x03, respectively, which specify the of the linker tool employed during compilation; for instance, executables from typically feature a linker version of 0x01 (, ). These version indicators ensure compatibility assessments by the operating system loader. Succeeding the versioning information, the header defines offsets and sizes for key internal structures, beginning with the two-byte entry table offset at 0x04 and its corresponding length in bytes at 0x06; the entry table enumerates the module's resident and movable entry points for dynamic linking. The segment count, a two-byte value at offset 0x1C, denotes the total number of logical segments in the executable, while the module reference count at offset 0x1E indicates the quantity of external modules (such as DLLs) the program depends on. Additionally, the two-byte resource table offset at 0x24 points to the location of the resource table relative to the start of the NE header, facilitating access to embedded resources like icons and menus. A 32-bit checksum at offset 0x08 provides a (CRC) over the entire file contents, aiding in file integrity validation during loading, though some tools like Borland's set this field to zero. The two-byte flag word at offset 0x0C encodes behavioral attributes via bit , including bit 0 for single usage (indicating a unified and ), bit 1 for multiple , bit 2 for no automatic allocation, and bit 3 for API support, which signals the loader to utilize 80286 capabilities. The two-byte automatic index at offset 0x0E references the default for runtime allocation from the segment table (with index 0 denoting no automatic allocation if combined with specific settings). Initial and sizes, each two bytes at offsets 0x10 and 0x12, specify the byte allocations for the local and upon program startup, respectively, defaulting to zero if the differs from the . The 32-bit entry point at offset 0x14 stores the initial index (from the table) and instruction pointer offset (CS:IP), marking the starting execution address. Correspondingly, the initial stack pointer at offset 0x18 provides the stack index and stack pointer offset (SS:SP), with special handling if the stack pointer is zero: the loader positions it at the top of the automatic below the area. The two-byte at offset 0x20 specifies the in bytes of the non-resident names table.

Segment and Resource Tables

The segment table in a New Executable (NE) file consists of an array of fixed-length entries that define the layout and attributes of code and data segments within the file. Each entry is 8 bytes long, with the table's location and number of entries specified in the NE header. The first two bytes represent the file offset of the segment, shifted left by the file alignment shift count to obtain the actual byte offset. The next two bytes indicate the segment's length in bytes, where a value of 0x0000 denotes 65,536 bytes. Bytes 4-5 contain a flags word that specifies attributes such as the segment type (code or data), whether it is movable or fixed, preload status, and presence of relocation information; for example, bit 0 distinguishes code (0) from data (1), bit 2 indicates movability, bit 4 marks preload segments, and bit 6 flags segments with relocations. The final two bytes specify the minimum allocation size for the segment in memory, again with 0x0000 meaning 65,536 bytes. The resource table organizes non-executable data such as icons, menus, and dialogs in a hierarchical manner, allowing for grouped resources by type. It begins with a 2-byte alignment shift count that determines how offsets and lengths are scaled. The table then contains one or more resource type headers, each followed by resource entries; a header includes a 2-byte type ID (0x0000 to end the table, or predefined values like 1 for cursors, 2 for bitmaps, 3 for icons, 4 for menus, and 5 for dialogs), a 2-byte count of resources in the group, and reserved bytes. Each resource entry is 12 bytes: the first two bytes give the file offset (shifted by the alignment count), followed by two bytes for length (also shifted), two bytes for flags (e.g., bit 4 for movable resources), and two bytes for the resource name or ID (high bit set indicates an ordinal, otherwise an offset to a string in the name table). This structure enables the loader to map resources into memory separately from code and data segments. The entry table specifies the program's entry points, distinguishing between fixed and movable segments to support dynamic loading. It comprises bundles of entries, each starting with a 1-byte count of entries in the bundle (0x00 to end the table) and a 1-byte segment indicator (0xFF for movable segments). For fixed segments, each entry is 3 bytes: a flag byte (e.g., bit 0 for exported entries) followed by a 2-byte offset within the segment. Movable segment entries are 6 bytes: a flag byte, a 2-byte INT 3FH instruction for relocation patching (0xCD 0x3F), a 1-byte relative segment number, and a 2-byte offset. These entries allow the loader to resolve the initial execution point and other function starts after segment relocation. Relocation data corrects 16-bit addresses in segments to account for their loaded positions in memory, stored per-segment immediately after the segment data if the segment flags indicate relocations are present. Each segment's relocation block begins with a 2-byte count of items, followed by 8-byte entries. The first byte specifies the address type (1 for offset only, 2 for segment only, 3 for both), the second byte indicates the relocation type (0 for internal references, 1 for imported ordinals, 2 for imported names, with bit 7 possibly set for additive relocations). Bytes 2-3 provide the within the segment, while bytes 4-7 vary by type: for internal, they include the target segment number and ; for imports, a module index and either an ordinal or name table . This mechanism supports both intra-module adjustments and inter-module references in the 16-bit segmented . The reference table and imported names table facilitate dynamic linking to external modules, such as DLLs. The module table is an of 2-byte entries, each an into the imported names table pointing to a name. The imported names table follows, consisting of variable-length Pascal-style strings: a 1-byte length followed by that many ASCII characters (not null-terminated), listing module names first, then or type names used in import relocations. These tables enable the loader to resolve references to external code during execution.

Compatibility

DOS Stub

The DOS stub in the New Executable (NE) format serves as a minimal executable embedded at the beginning of the file, ensuring that NE executables can be loaded by pure systems while preventing unintended execution. If run under without a compatible loader such as or , the stub executes a small program that displays an —typically "This program cannot be run in DOS mode."—and then terminates, informing the user that the file requires a graphical environment. Structurally, the DOS stub forms a standard MZ executable header starting at the file's offset 0, with specific fields configured for NE compatibility: the e_lfarlc field at offset 0x18 is set to 0x40, indicating the location of the stub's relocation table, and the e_lfanew field at offset 0x3C points to the offset of the subsequent NE header. This setup allows DOS loaders to recognize and process the initial MZ portion without accessing the NE-specific data. The stub's code follows the 64-byte MZ header, consisting of assembly instructions to output the error message via DOS interrupts and exit gracefully. In terms of size, the DOS stub is usually 64 bytes or more to accommodate the MZ header and basic code, though it can be minimized for while maintaining functionality; larger stubs may include additional features like custom messages but adhere to the same hybrid principles. This minimal design enables the file to masquerade as a valid executable for DOS loaders, which load and run the instead of attempting to execute the protected-mode content, thereby providing during the transition to Windows environments.

Support in Later Systems

In 32-bit versions of Windows starting from , , and and later, New Executable (NE) files, which are 16-bit Windows applications, are executed through the (VDM) subsystem. This mechanism provides a protected environment for running legacy 16-bit code alongside 32-bit applications, emulating the necessary 16-bit addressing and calls without direct hardware access. In Windows NT-based systems, this is specifically handled by NTVDM.exe, which isolates 16-bit processes to prevent system instability. Native support for NE executables is absent in 64-bit versions of Windows, as the x64 architecture lacks the required for 16-bit code execution in . Instead, running such files necessitates third-party software, such as for simpler DOS-stubbed NE programs or more specialized tools like OTVDM for full 16-bit Windows compatibility. Resource extraction from files faces significant limitations in and subsequent versions, where the operating system ignores embedded resources like icons due to the inability to load 16-bit modules into 32-bit or 64-bit processes. To access these resources, users must rely on dedicated extraction tools capable of parsing the format, such as OpenWatcom's Resource Editor or eXeScope. OS/2 Warp and its successors provide partial support for executables through the Win-OS/2 compatibility subsystem, which allows execution of 16-bit Windows applications in a dedicated session. This support leverages the shared format between early and Windows but is handled via the LX loader for 32-bit contexts, and continues to be supported in modern OS/2 derivatives like .

Legacy and Successors

Relation to Portable Executable

The New Executable (NE) format served as the direct predecessor to the (PE) format, which Microsoft introduced with in 1993 to enable native 32-bit applications on the platform. This shift addressed limitations in the 16-bit NE design, particularly its reliance on segmented addressing suited to the architecture, by adopting a more efficient structure for 32-bit protected-mode execution. Both formats share foundational concepts, including organized headers that describe file layout, relocation information, and support for dynamic-link libraries (DLLs) to facilitate code modularity and sharing across applications. NE divides code and data into segments with associated selectors for , while PE maps these to sections in a flat 32-bit , eliminating the need for complex segment descriptors and enabling simpler relocation via relative virtual addresses (RVAs). DLL handling also evolved: NE uses per-segment fixups and entry tables for imports and exports, whereas PE consolidates this in dedicated sections like .idata and .edata for streamlined loading. The transition from to occurred gradually, with (released in 1995) supporting both formats to maintain compatibility: for legacy 16-bit Windows 3.x applications running in a , and for new 32-bit Win32 programs. Key differences further distinguished as a more robust successor; it builds on the Common Object File Format (COFF) for object modules, incorporates richer metadata such as debug directories and security attributes, and removes the mandatory DOS stub required in files—though often includes an optional DOS stub for pre-Windows execution fallback. In hybrid scenarios, some executables embed structures to accommodate 16-bit components, enabling transitional applications that mix 16-bit and 32-bit code during the era of format coexistence in systems. This approach supported without fully migrating legacy elements, though PE's design ultimately phased out such necessities in favor of pure 32-bit (and later 64-bit) architectures.

Modern Usage and Tools

In contemporary computing as of 2025, the New Executable (NE) format persists primarily in retro computing and preservation efforts, where it enables the and study of legacy Windows 3.x and software. Enthusiast projects, such as the eXoWin3x archive, have preserved over 1,100 unique Windows 3.x games packaged in NE executables, prioritizing original media and playability to maintain historical accessibility on modern hardware. These initiatives rely on to counteract the format's , ensuring that software from the late 1980s and early 1990s remains runnable without native operating system support. Several specialized tools facilitate the viewing, editing, and disassembly of files for analysis and modification. Tools such as Open Watcom Resource Editor allow extraction and viewing of resources within NE-formatted executables, including elements like icons and dialogs. Disassembly is supported by tools like , where commands such as rabin2 -s reveal exported functions and segment details in NE binaries, aiding tasks. Emulation environments are essential for executing NE applications on current hardware, bridging the gap left by the absence of native 16-bit support in 64-bit systems. DOSBox-X emulates DOS-based Windows 3.x environments, allowing NE executables to run with , including integration and video configurations for games and utilities. Similarly, provides full of era-appropriate PCs, enabling the installation and operation of Windows 3.x and its NE software in simulated configurations like 386DX systems. Open-source loaders like Wine offer execution of 16-bit NE applications through its mode; as of Wine 10.16 (October 2025), this includes explicit support for 16-bit apps in the new mode, though full compatibility may require additional setup for legacy behaviors. NE files find niche applications in font handling and . .fon bitmap font files, which use the NE format, remain readable and installable in , supporting applications that require fixed-pitch or low-resolution from older systems. In , NE executables serve as samples for studying historical threats, where tools dissect their structures to understand evasion techniques in legacy code that may resurface in modern attacks. As of 2025, no new native OS support has emerged for NE files, confining their use to these specialized domains.

References

  1. [1]
    Appendix K: Segmented (New) .EXE File Header Format
    The Old Executable Header The New Executable file header format incorporates the existing MS-DOS executable file header format. In fact, the beginning of a ...<|control11|><|separator|>
  2. [2]
    Windows Executables (NE, LE and PE Files) - Retro Reversing
    Oct 20, 2025 · The New Executable (NE) format was introduced with 16-bit Windows (starting from Windows 1.0 and 2.0) and OS/2 1.x. It extended the earlier MZ ...
  3. [3]
    NE - OSDev Wiki
    NE files are the native executable format of Windows 1.01 through 3.xx, Windows NT 3.1, as well as OS/2 1.x. The format can be run on later 32-bit Windows ...
  4. [4]
    PE Format - Win32 apps - Microsoft Learn
    Jul 14, 2025 · This document specifies the structure of executable (image) files and object files under the Microsoft Windows family of operating systems.
  5. [5]
    New Executable - DisNCord Community Wiki
    Jan 30, 2023 · New Executable (also known by its header identification NE) is a 16-bit x86 executable format created by Microsoft in the 1980s.
  6. [6]
    Windows 1.0 - BetaWiki
    Windows 1.0, released in 1985, is the first major release of Microsoft Windows, a graphical shell on MS-DOS, with a 16-bit architecture. It has a kernel, GDI, ...Development Release 5 · Development Release 1 · Development Release 4
  7. [7]
    The History of OS/2 - by Bradford Morgan White - Abort, Retry, Fail
    Oct 2, 2023 · The joint development agreement that created this new operating system was entered into on the 10th of June in 1985. For both IBM and Microsoft, ...Missing: Executable | Show results with:Executable
  8. [8]
    OS/2 1.0
    IBM and Microsoft announced OS/2 1.0 on April 2nd, 1987, with a projected shipping date in the first quarter of 1988.
  9. [9]
    The Oldest OS/2 Executable In the Wild
    Mar 22, 2013 · This EXEHDR.EXE from June 1986 is currently the earliest known OS/2 executable released outside Microsoft/IBM.
  10. [10]
    Multitasking MS-DOS 4.00 - PCjs Machines
    DOS 4.0 supported preemptive multitasking, shared memory, semaphores, advanced memory management, a session manager, imports, exports and a new executable ...
  11. [11]
    Under the Hood: Happy 10th Anniversary, Windows | Microsoft Learn
    Protected mode let the operating system assign attributes (such as read-only) to segments of memory, and the CPU would enforce those attributes. An attempt to ...Missing: 1984 | Show results with:1984
  12. [12]
    Where NE (Microsoft New Executable) specification can be found?
    Dec 15, 2014 · I'm trying to find anything about an internal structure of .fon files. I was unable to found any specification for it, but I figured out ...What is use of creating many executable file formats? - Stack OverflowPortable executable structure explanation - windows - Stack OverflowMore results from stackoverflow.com
  13. [13]
    Format of new executable header
    Format of new executable header ; 00h. 2 BYTEs. "NE" (4Eh 45h) signature ; 02h. 2 BYTEs. linker version (major, then minor) ; 04h. WORD. offset from start of this ...
  14. [14]
    MS-DOS EXE - Just Solve the File Format Problem
    Aug 8, 2025 · Under New Executable format, it mentions a 16-bit field "behavior bits" at offset 0x20 but there is limited information available on what that ...<|separator|>
  15. [15]
    (.exe) Segmented (New) .EXE File Header Format (NE)
    The segment table ; 06H, 2, Resource name. If high bit set, represented by a number; otherwise, type is ASCII text string and this value is offset from beginning ...<|control11|><|separator|>
  16. [16]
    DOS EXE Format description by Microsoft Corporation. - GitHub
    This file format is also referred to as the New Executable Format. This new format is an extension of the existing MS-DOS .EXE format (old-style format).
  17. [17]
    NTVDM and 16-bit app support - Compatibility Cookbook
    Nov 17, 2021 · NTVDM allows 16-bit apps on 32-bit Windows, but is not recommended due to limited support and security risks. It is only supported on x86  ...Missing: 95 | Show results with:95<|control11|><|separator|>
  18. [18]
    64-bit versions of Windows don't support 16-bit components, 16-bit ...
    May 29, 2025 · This article discusses the lack of support for 16-bit components, 16-bit processes, or 16-bit applications in x64-based versions Windows.
  19. [19]
    Running 16-bit applications on Windows 10 64-bit
    Sep 15, 2020 · I wrote this post as a proof of concept and as a best effort to make a 16-bit application run on Windows 10 64-bit. It will be demonstrated.<|separator|>
  20. [20]
    How to load 16-bit executables (NE) for resources? - Stack Overflow
    May 17, 2021 · 16-bit NE images cannot be loaded nor (directly) executed by 32-bit or 64-bit PE threads. You have to load such a file using ReadFile() or ...How to extract files from Windows Vista Complete PC Backup?Extract/parse resources from Portable Executable (PE) fileMore results from stackoverflow.com
  21. [21]
  22. [22]
    OS/2 Warp 4: Dedicated DOS/Windows Session - OS2World.Com Wiki
    Nov 12, 2022 · OS/2 Warp 4 provides a new dedicated DOS/Windows session, which temporarily suspends all OS/2 activity and restores the OS/2 environment when the dedicated ...
  23. [23]
    OS/2 Warp
    First the technical differences: OS/2 Warp supported an improved executable format offering much better compression (not compatible with OS/2 2.11 and earlier) ...
  24. [24]
    eXoWin3x - eXo Wiki
    ### Summary of eXoWin3x Content
  25. [25]
    Resource Hacker - angusj.com
    Mar 6, 2025 · Resource HackerTM is a resource editor for 32bit and 64bit Windows® applications. It's both a resource compiler (for *.rc files), and a ...Missing: NE | Show results with:NE
  26. [26]
    Frequently Asked Questions (FAQ) - 7-Zip
    Right-click the icon of 7-Zip File Manager, and then click Run as administrator. Then you can change file associations and some other options. Why 7z archives ...
  27. [27]
    Installing Microsoft Windows 3.1x in DOSBox-X
    This guide will give a general description of installing Windows 3.1x in DOSBox-X, in addition to addressing some common issues.Installing Microsoft Windows 3... · Video driver · DOSBox-X mouse integration...
  28. [28]
    PCem
    No information is available for this page. · Learn why
  29. [29]
    WineHQ - Run Windows applications on Linux, BSD, Solaris and ...
    The Wine development release 10.18 is now available. What's new in this release: OpenGL memory mapping using Vulkan in WoW64 mode. Synchronization barriers API.Download · About Wine · News · Wine 10.0
  30. [30]
    Font List Windows 11 - Typography - Microsoft Learn
    Jun 16, 2022 · This is a list of fonts that shipped with Windows 11. Your versions numbers may be different if you did not apply Windows updates. Expand table ...Arial font family · Segoe UI Emoji font family · Calibri font family · Cascadia Code
  31. [31]
    Where I can find .fon format specification? - Stack Overflow
    Dec 14, 2014 · Essentially what you do is create your FNT resources, then compile them as if they were a Windows Executable (you may include several FNTs in a ...
  32. [32]
    Why Legacy Malware Like Phobos Still Threaten Modern Defenses
    Jun 9, 2025 · Legacy malware strains evade defenses by reusing code, while seemingly reliable systems fail to block revamped CVEs, malware, ...