0.Любой PE-файл начинается с маленькой программы, записанной в формате исполняемых файлов MS-DOS. Эта программа выводит на экран сообщение подобное этому: "This program cannot be run in DOS mode".
1.Подробно расписан заголовок MS-DOS в файле Windows.pas комплекта Delphi 7.0 :
---------------------------------------------------
type
PImageDosHeader = ^TImageDosHeader;
{EXTERNALSYM _IMAGE_DOS_HEADER}
_IMAGE_DOS_HEADER = packed record { DOS .EXE header }
e_magic: Word; { Magic number }+00
e_cblp: Word; { Bytes on last page of file }+02
e_cp: Word; { Pages in file }+04
e_crlc: Word; { Relocations }+06
e_cparhdr: Word; { Size of header in paragraphs }+08
e_minalloc: Word; { Minimum extra paragraphs needed }+0a
e_maxalloc: Word; { Maximum extra paragraphs needed }+0c
e_ss: Word; { Initial (relative) SS value }+0e
e_sp: Word; { Initial SP value }+10
e_csum: Word; { Checksum }+12
e_ip: Word; { Initial IP value }+14
e_cs: Word; { Initial (relative) CS value }+16
e_lfarlc: Word; { File address of relocation table }+18
e_ovno: Word; { Overlay number }+1a
e_res: array [0..3] of Word; { Reserved words }
e_oemid: Word; { OEM identifier (for e_oeminfo) }+24
e_oeminfo: Word; { OEM information; e_oemid specific}+26
e_res2: array [0..9] of Word; { Reserved words }
_lfanew: LongInt; { File address of new exe header }+3С
end;
TImageDosHeader = _IMAGE_DOS_HEADER;
{$EXTERNALSYM IMAGE_DOS_HEADER}
IMAGE_DOS_HEADER = _IMAGE_DOS_HEADER;
----------------------------------------------------
2. Из справочной программы Tech 6.0 информация о Dos заголовке:
-------------------------------------------------
ExeHeaderRec
Offset Size Contents
+0 2 wSignature 5a4dH .EXE file signature ('MZ')
+2 2 wPartPage length of partial page at end (generally ignored)
+4 2 wPageCnt length of image in 512-byte pages, incl. header
+6 2 wReloCnt number of items in relocation table
+8 2 wHdrSize size of header in 16-byte paragraphs
+0aH 2 wMinAlloc minimum RAM needed above end of prog (paragraphs)
+0cH 2 wMaxAlloc maximum RAM needed above end of prog (paragraphs)
+0eH 2 wInitSS segment offset of stack segment (for setting SS)
+10H 2 wInitSP value for SP register when started
+12H 2 wChkSum file checksum (negative sum of all words in file)
+14H 2 wInitIP value for IP register when started
+16H 2 wInitCS segment offset of code segment (for setting CS)
+18H 2 wTablOff file-offset of first relo item (often 001cH)
+1aH 2 wOverlayNo overlay number (0 for base module)
28 size of formatted portion of EXE header
-------------------------------------------------- |
| Окно программы |
4. Полезные ссылки.
This page is intended to document the format of DOS executable files
