PE header - Reserved Words at IMAGE_DOS_HEADER

Posted on 2007-10-06
Last Modified: 2008-01-09
In working on some related code, I noticed that kernel32.dll wasn't identical between various processes executing on my system. Naturally, I was curious why - perhaps some spyware that patched kernel32.dll in some processes but not others? I wrote a quick program to compare the memory of kernel32.dll between all processes on my system and found that a few (5 to be exact) had modifications in the PE header. Doesn't appear to be an important difference, but I am curious why five instances of my kernel32.dll are different than the rest - very odd.

In most of my processes, the IMAGE_DOS_HEADER->e_res =
  44 65 74 6F 75 72 73 21 00 00 00 00 00 00 00 .... [zeros] ...

However, in the five 'modified' versions, IMAGE_DOS_HEADER->e_res =
 00 00 00 00 00 00 00 ..... [zeros] ...

Does anyone happen to know what the 'reserved words' are used for in the IMAGE_DOS_HEADER, and why they would be zeroed in five cases?


typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
    WORD   e_magic;                     // Magic number
    WORD   e_cblp;                      // Bytes on last page of file
    WORD   e_cp;                        // Pages in file
    WORD   e_crlc;                      // Relocations
    WORD   e_cparhdr;                   // Size of header in paragraphs
    WORD   e_minalloc;                  // Minimum extra paragraphs needed
    WORD   e_maxalloc;                  // Maximum extra paragraphs needed
    WORD   e_ss;                        // Initial (relative) SS value
    WORD   e_sp;                        // Initial SP value
    WORD   e_csum;                      // Checksum
    WORD   e_ip;                        // Initial IP value
    WORD   e_cs;                        // Initial (relative) CS value
    WORD   e_lfarlc;                    // File address of relocation table
    WORD   e_ovno;                      // Overlay number
    WORD   e_res[4];                    // Reserved words
    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
    WORD   e_oeminfo;                   // OEM information; e_oemid specific
    WORD   e_res2[10];                  // Reserved words
    LONG   e_lfanew;                    // File address of new exe header
Question by:jimstar
    LVL 86

    Accepted Solution

    Look at the ASCII representation of "44 65 74 6F 75 72 73 21" - it reads "Detours":
    LVL 4

    Author Comment

    Clever - thanks.

    Featured Post

    What Security Threats Are You Missing?

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    Join & Write a Comment

    Have you thought about creating an iPhone application (app), but didn't even know where to get started? Here's how: ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Important pre-programming comments: I’ve never tri…
    Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
    The goal of this video is to provide viewers with basic examples to understand how to create, access, and change arrays in the C programming language.
    The viewer will learn how to use the return statement in functions in C++. The video will also teach the user how to pass data to a function and have the function return data back for further processing.

    732 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now