DOS header for PE notes

Image_dos_header struct

{

+ 0 h word e_magic // magic dos signature MZ (4dh 5ah) DoS Executable File tag

+ 2 H word e_cblp // bytes on last page of File

+ 4 h word e_cp // pages in file

+ 6 h word e_crlc // relocations

+ 8 h word e_cparhdr // size of header in paragraphs

+ 0ah word e_minalloc // minimun extra paragraphs needs

+ 0ch word e_maxalloc // maximun extra paragraphs needs

+ 0eh word e_ss // intial (relative) SS value dos code initialization stack SS

+ 10 h word e_sp // intial sp value dos code initialization Stack pointer sp

+ 12 h word e_csum // checksum

+ 14 h word e_ip // intial IP value dos code initialization command entry [pointer IP]

+ 16 h word e_cs // intial (relative) Cs value dos code initial stack entry

+ 18 h word e_lfarlc // file address of relocation table

+ 1ah word e_ovno // overlay number

+ 1ch word e_res [4] // Reserved Words

+ 24 h word e_oemid // OEM identifier (for e_oeminfo)

+ 26 h word e_oeminfo // OEM information; e_oemid specific

+ 29 H word e_res2 [10] // Reserved Words

+ 3ch DWORD e_lfanew // offset to start of PE Header points to PE File Header // http://www.cnblogs.com/zheh/p/4013184.html

} Image_dos_header ends

 

• The dos header is used to be compatible with the MS-DOS operating system to prompt a piece of text when the file is running on the MS-DOS, in most cases: This program cannot be run in DOS mode. another purpose is to specify the position of the NT header in the file (NT header Note: http://www.cnblogs.com/zheh/p/4013184.html ).

DOS header for PE notes