CODEWITHSUNDEEP
portable-executable
Alan
Alan

Reputation: 5189

Which of the MS-DOS header fields are mandatory/optional?

alt text

The above is the complete list of MS-DOS header fields, but I don't know which of them are mandatory and which are optional, does anyone know?

Upvotes: 2

Views: 1605

Answers (3)

Stolas
Stolas

Reputation: 289

Well back in 2006 someone wanted to create the world most tiny PE. For this he wrote a small PE Fuzzer. With the smallest codebase posible.

return 42;

He managed to get the following sizes of PE's you are too busy to read the entire page, here is a summary of the results:

  • Smallest possible PE file: 97 bytes
  • Smallest possible PE file on Windows 2000: 133 bytes
  • Smallest PE file that downloads a file over WebDAV and executes it: 133 bytes

You can check his work here: http://www.phreedom.org/research/tinype/

He also states the required header values. These are:

  • e_magic
  • e_lfanew
  • Machine
  • NumberOfSections
  • SizeOfOptionalHeader
  • Characteristics

OptionalHeader:

  • Magic
  • AddressOfEntryPoint
  • ImageBase
  • SectionAlignment
  • FileAlignment
  • MajorSubsystemVersion
  • SizeOfImage
  • SizeOfHeaders
  • Subsystem
  • SizeOfStackCommit
  • SizeOfHeapReserve

Upvotes: 3

SecurityMatt
SecurityMatt

Reputation: 6743

For MS-DOS, all of the headers are mandatory.

For Win9x and above, e_lfanew must be the offset from the start of the image to the start of the IMAGE_NT_HEADERS, and e_magic must be IMAGE_DOS_SIGNATURE ('MZ').

Upvotes: 0

JosephH
JosephH

Reputation: 8805

If you're trying to create PE Image, e_magic(Magic number) and elfanew(File address of new exe header) are the only mandatory fields that you have to fill in. elfanew should point to the PE IMAGE_NT_HEADER structure.

Upvotes: 5

Related Questions