DOS头结构
typedef struct _IMAGE_DOS_HEADER {                 // DOS .EXE header
   +0h WORD   e_magic;                          // *****DOS可执行文件标记*****
   +2h WORD   e_cblp;                      // Bytes on last page of file
   +4h WORD   e_cp;                        // Pages in file
   +6h WORD   e_crlc;                      // Relocations
   +8h WORD   e_cparhdr;                   // Size of header in paragraphs
  +0ah WORD   e_minalloc;                  // Minimum extra paragraphs needed
  +0ch WORD   e_maxalloc;                  // Maximum extra paragraphs needed
  +0eh WORD   e_ss;                        // DOS代码的初始化堆栈SS
  +10h WORD   e_sp;                        // DOS代码初始化堆栈指针SP
  +12h WORD   e_csum;                      // Checksum
  +14h WORD   e_ip;                        // DOS代码初始化指令入口[指针IP]
  +16h WORD   e_cs;                        // DOS代码的初始化堆栈入口
  +18h WORD   e_lfarlc;                    // File address of relocation table
  +1ah WORD   e_ovno;                                             // Overlay number
  +1ch WORD   e_res[4];                    // Reserved words
  +24h WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
  +26h WORD   e_oeminfo;                   // OEM information; e_oemid specific
  +29h WORD   e_res2[10];                  // Reserved words
  +3ch LONG   e_lfanew;                    // *****指向PE文件头*****
  } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

DOS头结构