PE FORMAT] -2- DOS MZ HEADER

PE HEADERは最初にDOS EXE Headerを拡張させたIMAGE_DOS_HEADER構造体が存在。

typedef struct _IMAGE_DOS_HEADER {

 WORD   e_magic;

.

.

.

 WORD   e_lfanew;

} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

*structure size: 40

IMAGE_DOS_HEADER (notepad.exe)

<必見member> 

e_magic : DOS signature (4D5A -> "MZ")

notepad.exe

e_lfanew : IMAGE_NT_HEADERのアドレス (offset: 00 00 00 E8 ;LittleEndian)

notepad.exe NT_HEADER