PE文件开胃

1.DOS头

 typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header  
        WORD   e_magic;                     // Magic number  DOS签名 4D5A "MZ"
        WORD   e_cblp;                      // Bytes on last page of file  
        WORD   e_cp;                        // Pages in file  
        WORD   e_crlc;                      // Relocations  
        WORD   e_cparhdr;                   // Size of header in paragraphs  
        WORD   e_minalloc;                  // Minimum extra paragraphs needed  
        WORD   e_maxalloc;                  // Maximum extra paragraphs needed  
        WORD   e_ss;                        // Initial (relative) SS value  
        WORD   e_sp;                        // Initial SP value  
        WORD   e_csum;                      // Checksum  
        WORD   e_ip;                        // Initial IP value  
        WORD   e_cs;                        // Initial (relative) CS value  
        WORD   e_lfarlc;                    // File address of relocation table  
        WORD   e_ovno;                      // Overlay number  
        WORD   e_res[4];                    // Reserved words  
        WORD   e_oemid;                     // OEM identifier (for e_oeminfo)  
        WORD   e_oeminfo;                   // OEM information; e_oemid specific  
        WORD   e_res2[10];                  // Reserved words  
        LONG   e_lfanew;                    // File address of new exe header  指向PE头 3Ch
      } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;  

2.DOS存根(stub)在DOS头与 PE文件头之间，大小不定。有无皆可。存放DOS环境下运行的指令。
3.PE文件头(NT头)

    typedef struct _IMAGE_NT_HEADERS {  
        DWORD Signature;  50450000h,PE00
        IMAGE_FILE_HEADER FileHeader;  文件头
        IMAGE_OPTIONAL_HEADER32 OptionalHeader; 可选头  
    } IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;  

参考 ：windows环境下32位汇编语言设计 逆向工程核心原理