（注：最左边是文件头的偏移量。） IMAGE_DOS_HEADER STRUCT { +0h     WORD     e_magic        //    Magic DOS signature MZ(4Dh 5Ah)     DOS可执行文件标记 +2h     WORD     e_cblp           //    Bytes on last page of file               +4h     WORD     e_cp            //    Pages in file                     +6h     WORD     e_crlc            //    Relocations                     +8h     WORD     e_cparhdr      //    Size of header in paragraphs         +0ah    WORD     e_minalloc     //    Minimun extra paragraphs needs         +0ch    WORD     e_maxalloc     //    Maximun extra paragraphs needs     +0eh    WORD     e_ss           //    intial(relative)SS value            DOS代码的初始化堆栈SS +10h    WORD     e_sp            //    intial SP value                     DOS代码的初始化堆栈指针SP +12h    WORD     e_csum            //    Checksum +14h    WORD     e_ip            //   intial IP value               DOS代码的初始化指令入口[指针IP] +16h    WORD     e_cs            //    intial(relative)CS value            DOS代码的初始堆栈入口 +18h    WORD     e_lfarlc        //    File Address of relocation table +1ah    WORD     e_ovno         //   Overlay number +1ch    WORD     e_res[4]        //   Reserved words +24h    WORD     e_oemid        //   OEM identifier(for e_oeminfo) +26h    WORD     e_oeminfo      //   OEM information;e_oemid specific  +29h    WORD     e_res2[10]     //   Reserved words +3ch    DWORD    e_lfanew       //   Offset to start of PE header        指向PE文件头 } IMAGE_DOS_HEADER ENDS

IMAGE_NT_HEADERS STRUCT {+0h       DWORDSignature  +4h       IMAGE_FILE_HEADER FileHeader +18h      IMAGE_OPTIONAL_HEADER32OptionalHeader   } IMAGE_NT_HEADERS ENDS

typedef     struct _IMAGE_FILE_HEADER {+04h    WORD          Machine;              // 运行平台+06h    WORD          NumberOfSections;     // 文件的区块数目+08h    DWORD         TimeDateStamp;        // 文件创建日期和时间+0Ch    DWORD         PointerToSymbolTable; // 指向符号表(主要用于调试)+10h    DWORD         NumberOfSymbols;      // 符号表中符号个数(同上)+14h    WORD          SizeOfOptionalHeader; // IMAGE_OPTIONAL_HEADER32 结构大小+16h    WORD          Characteristics;      // 文件属性} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;