> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/malware-essentials/malware/dos-header.md).

# DOS header

The DOS header is a fixed 64-byte structure, called IMAGE\_DOS\_HEADER, that exist at the start of every PE file. Most of the members are not used anymore, but the two important ones are:

* **e\_magic**
  * This is the first member and is a 2-byte WORD. This value is always 4D 5A, or MZ in ASCII. it's simply that marks the beginning of the PE, named after Mark Zbikowski- one of the developers of MS-DOS.
* **e\_lfanew**
  * This is the last member and is a 4-byte LONG. It contians an offset to the PE signature at the start of the NT headers. Because it's the last member, it is always located at an offset of 3C (60 in decimal) from the start of the PE file.

<figure><img src="https://lwfiles.mycourse.app/66e95234fe489daea7060790-public/4e18d4b8509739b640864584af443287.png" alt=""><figcaption></figcaption></figure>