typedef struct _IMAGE_DOS_HEADER { // DOS .EXE header
0 WORD e_magic; // Magic number
2 WORD e_cblp; // Bytes on last page of file
4 WORD e_cp; // Pages in file
WORD e_crlc; // Relocations
WORD e_cparhdr; // Size of header in paragraphs
WORD e_minalloc; // Minimum extra paragraphs needed
WORD e_maxalloc; // Maximum extra paragraphs needed
WORD e_ss; // Initial (relative) SS value
WORD e_sp; // Initial SP value
WORD e_csum; // Checksum
WORD e_ip; // Initial IP value
WORD e_cs; // Initial (relative) CS value
WORD e_lfarlc; // File address of relocation table
WORD e_ovno; // Overlay number
WORD e_res[4]; // Reserved words
24 WORD e_oemid; // OEM identifier (for e_oeminfo)
26 WORD e_oeminfo; // OEM information; e_oemid specific
28 WORD e_res2[10]; // Reserved words
3c LONG e_lfanew; // File address of new exe header //文件头偏移0x3c处，每个程序都是这个偏移
} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
最初由 kanxue 发布 typedef struct _IMAGE_DOS_HEADER { // DOS .EXE header 0 WORD e_magic; // Magic number 2 WORD e_cblp; // Bytes on last page of file 4 WORD e_cp; // Pages in file WORD e_crlc; // Relocations ........
