Strange Value in EXE header

Question

I've seen a strange value placed in EXE header

00000000 :4D 5A 90 00 03 00 00 00 - 04 00 00 00 FF FF 00 00
00000010 :B8 00 00 00 00 00 00 00 - 40 00 00 00 00 00 00 00
00000020 :00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
00000030 :00 00 00 00 00 00 00 00 - 00 00 00 00 A8 00 00 00
00000030 :00 00 00 00 00 00 00 00 - 00 00 00 00 A8 00 00 00 <-

I don't know what is A8 doing there but if I replace it with zeros my program doesn't execute.

In one word: what is that?

Also, could you give me also link to the full MS DOS header?

Why are you mucking around with program headers? It might help if we understood why you care what's in there. Also what platform is this? — Alex Brown, Feb 02 '10 at 11:10
Here's a document that may help you: http://www.thehackerslibrary.com/?p=377 — Alex Brown, Feb 02 '10 at 11:24

score 4 · Answer 1 · answered Feb 02 '10 at 11:24

The first part of a PE is the MSDOS stub; at 0x3C (where your "A8" is) there's the offset to the PE file signature. If you zero it, the loader won't be able to find the PE signature, and will refuse to load it (or load it as just an MS-DOS executable, I didn't try). For more information, see the PE format specifications.

score 3 · Accepted Answer · answered Feb 02 '10 at 11:22

3

DWORD at offset 0x3c is the offset of the new EXE header, aka IMAGE_NT_HEADERS. So if you change the value there, the PE loader cannot find the new EXE header.

answered Feb 02 '10 at 11:22

Atempcode

397
1
4

I think Matteo Italia gave the link in his answer: http://www.microsoft.com/whdc/system/platform/firmware/PECOFFdwn.mspx. – Atempcode Feb 02 '10 at 11:32

score 3 · Answer 3 · edited Mar 10 '18 at 16:57

I suspect that it is the offset to the new PE header, the first 30 odd bytes are the MS-DOS header, that offset into the file where 'A8' resides in corresponds to the field in the structure _IMAGE_DOS_HEADER called LONG e_lfanew; // File address of new exe header; It is that value 'A8' would be part of the new IMAGE_NT_HEADER which contains this information

DWORD Signature;
_IMAGE_FILE_HEADER FileHeader;
_IMAGE_OPTIONAL_HEADER OptionalHeader;

The very first two bytes are the original MS-DOS header into the executable as shown by this constant: WORD IMAGE_DOS_SIGNATURE = 0x5A4D; // MZ; The IMAGE_NT_HEADER has this signature to identify that it is an executable for NT platforms DWORD IMAGE_NT_SIGNATURE = 0x00004550; // PE00;

You will find all this information in a header file called pe.h.

What happened there is you wiped out the value 'A8', the loader could not find the IMAGE_NT_HEADER and hence failed.

Strange Value in EXE header

3 Answers3