原文出自:www.fishc.com
(注:最左邊是文件頭的偏移量。)
IMAGE_DOS_HEADER STRUCT
{
+0hWORDe_magic //Magic
DOS signature MZ(4Dh 5Ah) DOS可執行文件標記
+2h WORDe_cblp//Bytes
on last page of file
+4hWORDe_cp//Pages
in file
+6hWORD e_crlc//Relocations
+8hWORDe_cparhdr
//Size of header in paragraphs
+0ahWORD e_minalloc
//Minimun extra paragraphs needs
+0chWORDe_maxalloc
//Maximun extra paragraphs needs
+0ehWORDe_ss
//intial(relative)SS value DOS代碼的初始化堆棧SS
+10hWORDe_sp
//intial SP value DOS代碼的初始化堆棧指針SP
+12hWORDe_csum
//Checksum
+14hWORDe_ip
// intial IP value DOS代碼的初始化指令入口[指針IP]
+16hWORDe_cs
//intial(relative)CS value DOS代碼的初始堆棧入口
+18hWORDe_lfarlc
//File Address of relocation table
+1ahWORDe_ovno
// Overlay number
+1chWORDe_res[4]
//Reserved words
+24hWORDe_oemid
// OEM identifier(for e_oeminfo)
+26hWORD
e_oeminfo // OEM information;e_oemid specific
+29hWORDe_res2[10]
// Reserved words
+3chDWORD
e_lfanew //Offset to start of PE header 指向PE文件頭
} IMAGE_DOS_HEADER
ENDS