1

this is not a serious problem but I am curious why DOS signature is 0x5A4D not 0x4D5A

DOS Header's first member is MZ which is DOS signature named by Mark Zbikowski.

Below code is the part of DOS header.

typedef struct _IMAGE_DOS_HEADER {
  WORD e_magic;    // DOS signature : 4D5A ("MZ")
}

If Mark Zbikowski wants to write his name at the first of PE File, why didn't he write the code 0x4D5A but 0x5A4D ?? Following the principle of Little Endian, that is ZM not MZ.

Do I have wrong concept?

Abdelsalam Shahlol
  • 1,621
  • 1
  • 20
  • 31
TyeolRik
  • 466
  • 2
  • 25
  • ![Imgur](http://i.imgur.com/jLUiqk4.png) I open notepad.exe with Hex Editor to see DOS Header. – TyeolRik Mar 16 '17 at 02:53
  • Following the principle of Little Endian if you have word e.g.: 0x1234 it is stored as 0x34 0x12. In source code you may see 0x5a4d, once you store it in memory then it looks like 0x4d 0x5a. – Pyjong Mar 17 '17 at 14:29
  • Ah, OK. You mean that 0x5A4D is right. In my reversing books, writer said " DOS signature is 4D5A which is "MZ" " So, I was confused. Thanks! – TyeolRik Mar 22 '17 at 00:14

0 Answers0