Small turtle here for everyone to do a detailed comment, lest everyone confused, in addition can be combined with the small turtle "encryption Series"-System chapter-PE structure of the video tutorial learning ~ If there are flaws in the place also hope that everyone is not hesitate to correct. (Video tutorial: http://fishc.com/a/shipin/jiemixilie/)(Note: The leftmost is the offset of the file header.) )
Image_dos_header STRUCT
{ +0h WORD e_magic//Magic DOS signature MZ (4Dh 5Ah) DOS executable tag+2h WORD E_CBLP//Bytes on last page of file+4h WORD E_CP//Pages in file+6h WORD E_CRLC//Relocations+8h WORD E_CPARHDR//Size of header in paragraphs+0ah WORD e_minalloc//Minimun extra paragraphs needs+0ch WORD e_maxalloc//Maximun extra paragraphs needs+0eh WORD e_ss//intial (relative) SS value DOS code initialization stack SS+10h WORD e_sp//intial SP value DOS code initialization stack pointer SP+12h WORD e_csum//Checksum+14h WORD e_ip//intial IP value DOS code initialization instruction entry [pointer IP]+16h WORD e_cs//intial (relative) CS value DOS code initial stack entry+18h WORD E_LFARLC//File Address of relocation table+1ah WORD e_ovno//Overlay number+1ch WORD e_res[4]//Reserved words+24h WORD e_oemid//OEM identifier (for e_oeminfo)+26h WORD e_oeminfo//OEM Information;e_oemid specific+29h WORD e_res2[10]//Reserved words+3ch DWORD e_lfanew//Offset to start of PE header point to PE file header} image_dos_header ENDS
PE detailed IMAGE_DOS_HEADER structure definition is the function of each property (PE detailed 01)