• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 792
  • Last Modified:

PE header - Reserved Words at IMAGE_DOS_HEADER

In working on some related code, I noticed that kernel32.dll wasn't identical between various processes executing on my system. Naturally, I was curious why - perhaps some spyware that patched kernel32.dll in some processes but not others? I wrote a quick program to compare the memory of kernel32.dll between all processes on my system and found that a few (5 to be exact) had modifications in the PE header. Doesn't appear to be an important difference, but I am curious why five instances of my kernel32.dll are different than the rest - very odd.

In most of my processes, the IMAGE_DOS_HEADER->e_res =
  44 65 74 6F 75 72 73 21 00 00 00 00 00 00 00 .... [zeros] ...

However, in the five 'modified' versions, IMAGE_DOS_HEADER->e_res =
 00 00 00 00 00 00 00 ..... [zeros] ...

Does anyone happen to know what the 'reserved words' are used for in the IMAGE_DOS_HEADER, and why they would be zeroed in five cases?


typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
    WORD   e_magic;                     // Magic number
    WORD   e_cblp;                      // Bytes on last page of file
    WORD   e_cp;                        // Pages in file
    WORD   e_crlc;                      // Relocations
    WORD   e_cparhdr;                   // Size of header in paragraphs
    WORD   e_minalloc;                  // Minimum extra paragraphs needed
    WORD   e_maxalloc;                  // Maximum extra paragraphs needed
    WORD   e_ss;                        // Initial (relative) SS value
    WORD   e_sp;                        // Initial SP value
    WORD   e_csum;                      // Checksum
    WORD   e_ip;                        // Initial IP value
    WORD   e_cs;                        // Initial (relative) CS value
    WORD   e_lfarlc;                    // File address of relocation table
    WORD   e_ovno;                      // Overlay number
    WORD   e_res[4];                    // Reserved words
    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
    WORD   e_oeminfo;                   // OEM information; e_oemid specific
    WORD   e_res2[10];                  // Reserved words
    LONG   e_lfanew;                    // File address of new exe header
1 Solution
Look at the ASCII representation of "44 65 74 6F 75 72 73 21" - it reads "Detours": http://research.microsoft.com/sn/detours/
jimstarAuthor Commented:
Clever - thanks.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now