In many computer operating systems, a COM file is a type of executable file; the name is derived from the file name extension .COM. Originally, the term stood for "Command file", a text file containing commands to be issued to the operating system (similar to a DOS batch file), on many of the Digital Equipment Corporation mini and mainframe operating systems going back to the 1970s.

With the introduction of microcomputers, the type of files commonly associated with the extension .com changed; in 8-bit CP/M, and later in MS-DOS and compatible DOSes, they are binary executable files by convention. However, executables in the COM file format do not have to have the file name extension .COM in any but CP/M and very early versions of MS-DOS.

The .COM file name extension has no relation to the .com (for "commercial") top-level Internet domain name. However, this similarity in name has been exploited by malicious computer virus writers.

MS-DOS binary format

The COM format is the original binary executable format used in CP/M and MS-DOS. It is very simple; it has no header, and contains no metadata, only code and data. Its simplicity exacts a price, however: the binary has a maximum size of 65,280 (0xFF00) bytes (64 KiB) and stores all its code and data in one segment.

Since it lacks relocation information, it is loaded by the operating system at a pre-set address, at offset 0x0100, where it is executed. This was not an issue on early 8-bit machines because of how the segmentation model works, but it is the main reason why the format fell into disuse soon after the introduction of 16- and then 32-bit processors with their much larger, segmented memories.

In Intel 8080 CPU architecture, only 65,536 bytes of memory could be addressed (address range 0x0000 to 0xFFFF). Under CP/M, the first page of this memory, from 0x0000 to 0x00FF was reserved for system use, and any user program had to be loaded at exactly 0x0100 to be executed. COM files fit this model perfectly. Note that there was no possibility of running more than one program or command at a time: the program loaded at 0x0100 was run, and no other.

Although the file format is the same in MS-DOS and CP/M, this does not mean that CP/M programs can be directly executed under MS-DOS or vice versa; MS-DOS COM files contain x86 instructions, while CP/M COM files contain 8080, 8085 or Z80 instructions. Additionally, MS-DOS COM files often depend on operating system traps supplied exclusively by MS-DOS via interrupt 21h. It is possible to construct a fat COM file which both processor families can execute.

Under CP/M 3, if the first byte of a COM file is 0xC9 then this indicates the presence of a 256-byte header; since 0xC9 corresponds to the 8080 instruction RET, this means that the COM file will immediately terminate if run on an earlier version of CP/M that does not support this extension.

Files may have names ending in .COM, but not be in the simple format described above; this is indicated by a magic number at the start of the file. For example, the COMMAND.COM file in DR-DOS 6 is actually in DOS executable format, indicated by the first two bytes being MZ (0x4D 0x5A), the initials of Mark Zbikowski.

Large Programs

In MS-DOS and compatible DOSes, there is no memory management provided for COM files by the loader or execution environment. All memory is simply available to the COM file. After execution, the operating system command shell, COMMAND.COM, is reloaded. This leaves the possibilities that the COM file can either be very simple, using a single segment, or arbitrarily complex, providing its own memory management system. An example of a complex program would be COMMAND.COM, the MS-DOS shell, which provided a loader to load other COM or EXE programs. In the .COM system, larger programs (up to the available memory size) can be loaded and run, but the system loader assumes that all code and data is in the first segment, and it is up to the .COM program to provide any further organisation. Programs larger than available memory, or large data segments, can be handled by dynamic linking, if the necessary code is included in the .COM program. The advantage of using a .COM rather than a .EXE format is that the binary image is usually smaller and easier to program using an assembler. Once compilers and linkers of sufficient power became available it was no longer advantageous to use the .COM format for complex programs.

Execution preference

In MS-DOS, if a directory contains both a COM file and an EXE file with same name (not including extension), the COM file is preferred. For example, if a directory in the system path contains two files named foo.com and foo.exe, the following would execute foo.com:

C:>foo

If the user wishes to run foo.exe, they can explicitly use the complete filename:

C:>foo.exe

Taking advantage of this default behaviour, virus writers and other malicious programmers sometimes use names like notepad.com for their creations, hoping that if it is placed in the directory of the corresponding EXE file, a run command or batch file may accidentally trigger their program instead of the ubiquitous notepad.exe text editor.

On Windows NT and derivatives (Windows 2000, Windows XP, and Windows Vista), the PATHEXT variable is used to determine the order of preference (and acceptable extensions) for calling files without specifying the extension from the command line. The default value still places .com files before .exe files.

Platform support

The format is still executable on many modern Windows-based platforms, but it is run in an MS-DOS-emulating subsystem, NTVDM, which is not present in 64-bit variants. COM files can also be executed on DOS emulators such as DOSBox, on any platform supported by these emulators.

Malicious usage of the .com extension

Some computer virus writers have hoped to take advantage of modern computer users' likely lack of knowledge of the .com file extension and associated binary format, along with their more likely familiarity with the .com Internet domain name. E-mail has been sent with attachment names similar to "www.example.com". Unwary Microsoft Windows users clicking on such an attachment would expect to begin browsing a site named http://www.example.com/, but instead would run the attached binary command file named www.example, giving it full permission to do to their machine whatever its author had in mind.

Note that there is nothing malicious about the COM file format itself; this is an exploitation of the coincidental name collision between .com command files and .com commercial web sites.

References