COM file
| Company type | File format |
|---|---|
| Industry | Computer software |
| Founded | 1970s |
| Products | Executable files for CP/M, DOS, and derivatives |
A COM file represents a straightforward executable file format that was initially implemented on Digital Equipment Corporation (DEC) VAX operating systems during the 1970s as command scripts. It subsequently developed into a form of executable files within Digital Research's CP/M operating system. This type of executable was later adopted by DOS, where COM files remained favored due to their minimal size, even after the introduction of the more flexible .exe format.
The .COM extension bears no connection to the commercial Internet domain .com, although this resemblance has occasionally been exploited by malware creators.
DOS binary format
The COM file format originated as the binary executable standard for CP/M, including its derivatives such as SCP and MSX-DOS, as well as early DOS versions. It lacks a header (with the exception of CP/M 3), contains no embedded metadata, and merges code and data into a single segment. This design restricts the maximum file size to 65,280 bytes (256 bytes less than 64 KiB) and mandates that all program code and data reside within one continuous memory segment.
Due to the absence of relocation information, the operating system loads COM files at a fixed memory location—specifically at offset 0100h, immediately following the program segment prefix (PSP)—with execution starting from this point. While this arrangement was adequate for 8-bit systems constrained to 64 KB of memory, it became limiting on 16-bit architectures with larger address spaces, which contributed to the gradual obsolescence of this format.
On the Intel 8080 CPU utilized by CP/M, programs loaded at address 0100h fit neatly within the 64 KB addressable space minus reserved zero page areas. Early CP/M releases permitted only one active program at a time, simplifying process management.
Though sharing the same file extension, COM files for DOS and CP/M are not compatible: DOS COM files contain x86 machine instructions and invoke DOS system calls, whereas CP/M COM files consist of Intel 8080 instructions with CP/M-specific system calls.
Within DOS environments, all segment registers in a COM program are initialized to identical values, and the stack pointer (SP) is set near the top of available memory in that segment—typically at FFFEh—allowing stack operations to grow downward from this point.
Program termination methods evolved from invoking INT 20h or INT 21h Function 0 in DOS version 1.x to Microsoft’s recommendation of using INT 21h Function 4Ch starting with DOS 2.x. This newer approach simplified program exit procedures by removing the requirement for matching segment registers.
Certain COM files were constructed as fat binaries capable of running on both CP/M and DOS platforms by containing separate code segments for each operating system. The appropriate section was selected dynamically at runtime using instructions compatible with both CPUs.
In CP/M 3, a COM file beginning with byte C9h includes a 256-byte header; here, C9h corresponds to the RET instruction on Intel 8080 processors but is an invalid opcode on earlier versions, thereby preventing execution on unsupported systems. On x86 processors, C9h represents the LEAVE instruction but is seldom used as an initial opcode; consequently, some DOS variants reject such COM files to avoid system crashes.
Files bearing the .COM extension do not always adhere to this simple structure; for instance, DR DOS 6.0's COMMAND.COM follows the DOS executable format identified by the "MZ" magic number (4D 5A), named after developer Mark Zbikowski.
Large programs
Within the DOS environment, the loader or execution system does not provide memory management for COM files; instead, all available memory is directly accessible to the COM program. Upon completion of a COM file's execution, the command shell, COMMAND.COM, is reloaded. This design permits COM files to be either straightforward, utilizing a single segment, or more sophisticated with their own memory handling routines. For instance, COMMAND.COM itself is a complex application responsible for loading other COM or EXE programs. COM files can accommodate larger applications up to the limits of available memory, but the loader presumes that all code and data are contained within the initial segment, leaving any additional memory organization to the program itself. Programs that surpass memory constraints or require extensive data segments may implement dynamic linking if integrated within the COM file. The .COM format was originally favored over .EXE due to its smaller binary footprint and simplicity for assembly language development; however, as compilers and linkers advanced, these benefits diminished for more complex software.
Platform support
This format remains executable on numerous contemporary Windows NT-based systems through the MS-DOS compatibility layer known as NTVDM, which is not available in 64-bit editions. Additionally, COM files are supported by DOS emulators such as DOSBox, enabling operation across various platforms.
Use for compatibility reasons
On Windows NT-based operating systems, the .com extension persists for certain legacy commands originating from MS-DOS, even though these utilities are now implemented as .exe files. The OS identifies their .exe headers and executes them accordingly despite their .com extensions. This approach maintains backward compatibility with older DOS batch scripts that reference original filenames. Examples of such commands include CHCP, DISKCOMP, DISKCOPY, FORMAT, MODE, MORE, and TREE.
Execution preference
In DOS, when a directory contains both a COM and an EXE file sharing the same name, executing the filename without an extension defaults to launching the COM file. For example, if both foo.com and foo.exe reside in a directory included in the system path:
C:\>foo
will execute foo.com. To run foo.exe, users must explicitly specify the extension:
C:\>foo.exe
This default has been exploited by malicious actors who create viruses named like notepad.com, aiming to overshadow legitimate EXE programs such as notepad.exe. These deceptive .com files may actually be executables in .exe format.
On Windows NT and its successors (Windows 2000, Windows XP, Windows Vista, Windows 7), an environment variable governs the order of extension preference when no extension is provided with a command. By default, it continues to prioritize .com before .exe, mirroring behavior found in enhanced command line interpreters from JP Software like 4DOS, 4OS2, and 4NT.
Malicious exploitation of the .com extension
Certain malware developers take advantage of the confusion between the binary executable file extension and the .com domain suffix used on the Internet. For example, email attachments titled similarly to "www.example.com" can deceive Microsoft Windows users into executing a harmful binary file named www.example rather than navigating to the website at http://www.example.com/. This execution grants the malicious file unrestricted system access, allowing it to perform damaging operations.
It is important to note that the COM file format itself is not inherently harmful; the security risk stems from the resemblance between .com command files and .com commercial domain names.
