Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Strange Value in EXE header

I've seen a strange value placed in EXE header

00000000 :4D 5A 90 00 03 00 00 00 - 04 00 00 00 FF FF 00 00
00000010 :B8 00 00 00 00 00 00 00 - 40 00 00 00 00 00 00 00
00000020 :00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
00000030 :00 00 00 00 00 00 00 00 - 00 00 00 00 A8 00 00 00
00000030 :00 00 00 00 00 00 00 00 - 00 00 00 00 A8 00 00 00 <-

I don't know what is A8 doing there but if I replace it with zeros my program doesn't execute.

In one word: what is that?

Also, could you give me also link to the full MS DOS header?

like image 630
oneat Avatar asked Dec 30 '22 03:12

oneat


1 Answers

The first part of a PE is the MSDOS stub; at 0x3C (where your "A8" is) there's the offset to the PE file signature. If you zero it, the loader won't be able to find the PE signature, and will refuse to load it (or load it as just an MS-DOS executable, I didn't try). For more information, see the PE format specifications.

like image 146
Matteo Italia Avatar answered Jan 13 '23 15:01

Matteo Italia