Questions about the PE file format

[AeroASM]

1. Where can I find proper documented information on all the elements of IMAGE_DOS_HEADER?
2. In particular, where is the offset of the DOS stub stored?
3. Must the section table immediately follow the IMAGE_NT_HEADERS?

Thanks to all.

[hutch--]

Aero,

Microsoft Portable Executable and Common Object File Format Specification.

Do a google search for a WORD doc format file PECOFF.DOC. Its on the Microsoft site somewhere.

The DOS or MZ header is at the beginning of a PE file and the last element of the structure has the offset of the PE header that follows.

[thomasantony]

Hi Aero,
    The PE file has a DOS stub that is basically a small DOS proggy that displays the message "This program needs MS Windows" etc. The offset of the PE Header is stored at offset 3Ch. THat DOS header  should be atleast 64 bytes long.(40h)

Thomas :U

[Vortex]

Hi Aero,

Did you check Iczelion's PE tutorials?

Overview of PE File Format
Detecting a Valid PE File
File Header
Optional Header
Section Table
Import Table
Export Table 

http://spiff.tripnet.se/~iczelion/pe-tut1.html

[pbrennick]

Hi Aero,
Take a look at the MSDN online database.  I found http://msdn.microsoft.com/msdnmag/issues/02/02/pe/default.aspx and some other interesting stuff.

hth:
Paul

[Tedd]

http://www.wotsit.org/download.asp?f=winf10

[QvasiModo]

http://www.windowsitlibrary.com/Content/356/11/toc.html

[AeroASM]

Thanks everybody, but I had already found similar information myself. I was looking for answers to my specific questions.

[Jibz]

1. You'd need to dig up some DOS exe format specification to get those, if you have any specific questions, try asking
2. The DOS stub is the first thing in a PE executable, so it always starts at offset 0.
3. Yes. You find the section table by adding SizeOfOptionalHeaders to the offset of the optional header in IMAGE_NT_HEADERS.

[AeroASM]

2. The DOS stub is the first thing in a PE executable, so it always starts at offset 0.

I meant, the executable code. I couldn't find anywhere in the DOS header where the offset of the DOS code is stored.

[Jibz]

The image comes right after the header, so that's at e_cparhdr*16, where e_cparhdr is the 'header size in paragraphs' member of the DOS exe header.

[thomasantony]

*Usually* the DOS stub code starts at offset 20h and continues till 3Ch for the smallest stub. But MS's stub continues after that till 60h or something.

Thomas