The DOS Header (Legacy but Load-Bearing)

Historical: lets DOS run the file and print a message. Two fields still matter.

• e_magic: the first two bytes, the letters M Z (0x5A4D). A valid PE always starts with MZ. Named after Mark Zbikowski.
• e_lfanew: 4-byte offset (at file offset 0x3C) pointing to the start of the NT Headers.

The DOS stub follows: a tiny DOS program that usually prints

``This program cannot be run in DOS mode.''

Analyst note

To find the real PE headers you do NOT assume a fixed offset — you

read e_lfanew and jump there. Malware sometimes hides data in the

stub gap between the DOS header and the NT headers.