typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header WORD   e_magic;                     // Magic number WORD   e_cblp;                      // Bytes on last page of file WORD   e_cp;                        // Pages in file WORD   e_crlc;                      // Relocations WORD   e_cparhdr;                   // Size of header in paragraphs WORD   e_minalloc;                  // Minimum extra paragraphs needed WORD   e_maxalloc;                  // Maximum extra paragraphs needed WORD   e_ss;                        // Initial (relative) SS value WORD   e_sp;                        // Initial SP value WORD   e_csum;                      // Checksum WORD   e_ip;                        // Initial IP value WORD   e_cs;                        // Initial (relative) CS value WORD   e_lfarlc;                    // File address of relocation table WORD   e_ovno;                      // Overlay number WORD   e_res[4];                    // Reserved words WORD   e_oemid;                     // OEM identifier (for e_oeminfo) WORD   e_oeminfo;                   // OEM information; e_oemid specific WORD   e_res2[10];                  // Reserved words LONG   e_lfanew;                    // File address of new exe header } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER; 

#include "windows.h"
#include "stdio.h" int main(int argc, char* argv[])
{ FILE *p; IMAGE_DOS_HEADER mydosheader; unsigned long sig; p = fopen("test1.exe","r+b"); if(p == NULL)return -1; fread(&mydosheader,sizeof(mydosheader),1,p); fseek(p,mydosheader.e_lfanew,SEEK_SET); fread(&sig,4,1,p); fclose(p); printf("IMAGE_DOS_HEADER dump:/n"); printf("e_magic　: %04x/n",mydosheader.e_magic); printf("e_cblp　　: %04x/n",mydosheader.e_cblp); printf("e_cp　　　: %04x/n",mydosheader.e_cp); printf("e_crlc　　: %04x/n",mydosheader.e_crlc); printf("e_cparhdr : %04x/n",mydosheader.e_cparhdr); printf("e_minalloc: %04x/n",mydosheader.e_minalloc); printf("e_maxalloc: %04x/n",mydosheader.e_maxalloc); printf("e_ss　　　: %04x/n",mydosheader.e_ss); printf("e_sp　　　: %04x/n",mydosheader.e_sp); printf("e_csum　　: %04x/n",mydosheader.e_csum); printf("e_ip　　　: %04x/n",mydosheader.e_ip); printf("e_cs　　　: %04x/n",mydosheader.e_cs); printf("e_lfarlc　: %04x/n",mydosheader.e_lfarlc); printf("e_ovno　　: %04x/n",mydosheader.e_ovno); printf("e_res[0]　: %04x/n",mydosheader.e_res[0]); printf("e_oemid　: %04x/n",mydosheader.e_oemid); printf("e_oeminfo : %04x/n",mydosheader.e_oeminfo); printf("res2[0]　: %04x/n",mydosheader.e_res2[0]); printf("lfanew　　: %08x/n",mydosheader.e_lfanew); if((mydosheader.e_magic ==IMAGE_DOS_SIGNATURE) && (sig == IMAGE_NT_SIGNATURE)) printf("有效的PE文件/n"); else printf("无效的PE文件/n"); return 0;
}