[PE format Analysis] 3. IMAGE_NT_HEADER, imagedosheader

[PE format Analysis] 3. IMAGE_NT_HEADER, imagedosheader

The source code is as follows:

Typedef struct _ IMAGE_NT_HEADERS {+ 00 h DWORD Signature; // fixed to 0x00004550 based on small-end storage: "PE .. "+ 04 h IMAGE_FILE_HEADER FileHeader; + 18 h IMAGE_OPTIONAL_HEADER32 OptionalHeader;} IMAGE_NT_HEADERS32, * PIMAGE_NT_HEADERS32;

Signature Field

In a valid PE file, the Signature field is set to 0x00004550, And the ASCII character is "PE00 ". Indicates the beginning of the PE file header.

The PE00 string is the start of the PE file header. The e_lfanew field in the DOS header points to this.

As shown in:

Another example: