CODEWITHSUNDEEP
windowsportable-executable
horseyguy
horseyguy

Reputation: 29895

What does "e_lfanew" mean in the DOS header for the PE format?

In the IMAGE_DOS_HEADER for the PE (Windows executable) format there is a field e_lfanew. It serves a very important role in that it points to the PE header data.

What makes the name "e_lfanew" appropriate?

Upvotes: 10

Views: 13229

Answers (1)

CodeCaster
CodeCaster

Reputation: 151588

My interpretation would be that it's the logical file address for the New Executable header.

Mainly based on the comment in this P/Invoke C# definition of the IMAGE_DOS_HEADER struct:

public Int32 e_lfanew;      // File address of new exe header

And a comment by @Hans Passant:

The e_ prefix helped deal with old K&R compilers that did not yet keep structure members in its own symbol table.

And a later comment here by @Simon Kissane:

Inside the IMAGE_DOS_HEADER there are two fields starting with e_lfa:

  • WORD e_lfarlc; // File address of relocation table
  • LONG e_lfanew; // File address of new exe header

The "lfa" would appear to mean "logical file address", meaning the offset relative to the start of the executable file.

Upvotes: 25

Related Questions