> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/malware-essentials/malware/dos-stub.md).

# DOS stub

The DOS stub is only used when the PE file is executed under MS-DOS, which simply prints the message. "This program cannot be run in DOS mode". This stub doesn't have an official pre-defined size, so the modern Windows loader uses the offset in ***e\_lfwane*** to skip over this stub and go directly to NT headers (described below).

<figure><img src="https://lwfiles.mycourse.app/66e95234fe489daea7060790-public/76235c546519432579bb83ce1949806e.png" alt=""><figcaption></figcaption></figure>