9
I'm trying to understand the DOS header deeply and I'm stuck with these ones. I know the only required bytes are the MZ signature and the pointer to the PE section but I have to know what these two are exactly:
USHORT e_cblp; // Bytes on last page of file
USHORT e_cp; // Pages in file
In most executables' binary code these values are 90h and 03h respectively. A page is 512 bytes of code, so there are 3 pages, but where? Where can I find them in the file? How can I identify these 90h (144) bytes in the last page of 512 bytes?
This information is only requested by DOS. The only code of a PE file, that will run in DOS, is the DOS stub and it is not 3 pages of code but merely 64 bytes. So, what is 90h and 03h has to do there? Can't I just say e_cblp=01h and e_cp=DOS header+DOS stub?