(注:最左边是文件头的偏移量。)
IMAGE_DOS_HEADER STRUCT
{
+0hWORDe_magic //Magic DOS signature MZ(4Dh 5Ah) DOS可执行文件标记
+2h WORD e_cblp //Bytes on last page of file
+4hWORD e_cp //Pages in file
+6hWORD e_crlc //Relocations
+8hWORD e_cparhdr //Size of header in paragraphs
+0ahWORD e_minalloc //Minimun extra paragraphs needs
+0chWORD e_maxalloc //Maximun extra paragraphs needs
+0ehWORD e_ss //intial(relative)SS value DOS代码的初始化堆栈SS
+10hWORD e_sp //intial SP value DOS代码的初始化堆栈指针SP
+12hWORD e_csum //Checksum
+14hWORD e_ip // intial IP value DOS代码的初始化指令入口[指针IP]
+16hWORD e_cs //intial(relative)CS value DOS代码的初始堆栈入口
+18hWORD e_lfarlc //File Address of relocation table
+1ahWORD e_ovno // Overlay number
+1chWORD e_res[4] //Reserved words
+24hWORD e_oemid // OEM identifier(for e_oeminfo)
+26hWORD e_oeminfo // OEM information;e_oemid specific
+29hWORD e_res2[10] // Reserved words
+3chDWORD e_lfanew //Offset to start of PE header 指向PE文件头
} IMAGE_DOS_HEADER ENDS