ホーム › System.SystemServices › IMAGE_DOS_HEADER
IMAGE_DOS_HEADER
構造体サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。
フィールド
| フィールド | 型 | サイズ | x64 | x86 | 説明 |
|---|---|---|---|---|---|
| e_magic | WORD | 2 | +0 | +0 | DOSヘッダーのマジック値。'MZ'(0x5A4D)を示す。 |
| e_cblp | WORD | 2 | +2 | +2 | 最終ページのバイト数。 |
| e_cp | WORD | 2 | +4 | +4 | ファイル内のページ数。 |
| e_crlc | WORD | 2 | +6 | +6 | リロケーションエントリ数。 |
| e_cparhdr | WORD | 2 | +8 | +8 | ヘッダーのサイズ(パラグラフ単位)。 |
| e_minalloc | WORD | 2 | +10 | +10 | 必要な最小追加パラグラフ数。 |
| e_maxalloc | WORD | 2 | +12 | +12 | 必要な最大追加パラグラフ数。 |
| e_ss | WORD | 2 | +14 | +14 | 初期SS(スタックセグメント)相対値。 |
| e_sp | WORD | 2 | +16 | +16 | 初期SP(スタックポインタ)値。 |
| e_csum | WORD | 2 | +18 | +18 | チェックサム。 |
| e_ip | WORD | 2 | +20 | +20 | 初期IP(命令ポインタ)値。 |
| e_cs | WORD | 2 | +22 | +22 | 初期CS(コードセグメント)相対値。 |
| e_lfarlc | WORD | 2 | +24 | +24 | リロケーションテーブルのファイルアドレス。 |
| e_ovno | WORD | 2 | +26 | +26 | オーバーレイ番号。 |
| e_res | WORD | 8 | +28 | +28 | 予約ワード配列。 |
| e_oemid | WORD | 2 | +36 | +36 | OEM識別子。 |
| e_oeminfo | WORD | 2 | +38 | +38 | OEM固有情報。 |
| e_res2 | WORD | 20 | +40 | +40 | 予約ワード配列(その2)。 |
| e_lfanew | INT | 4 | +60 | +60 | PE(NT)ヘッダーへのファイルオフセット。 |
各言語での定義
#include <windows.h>
// IMAGE_DOS_HEADER (x64 64 / x86 64 バイト)
#pragma pack(push, 2)
typedef struct IMAGE_DOS_HEADER {
WORD e_magic;
WORD e_cblp;
WORD e_cp;
WORD e_crlc;
WORD e_cparhdr;
WORD e_minalloc;
WORD e_maxalloc;
WORD e_ss;
WORD e_sp;
WORD e_csum;
WORD e_ip;
WORD e_cs;
WORD e_lfarlc;
WORD e_ovno;
WORD e_res[4];
WORD e_oemid;
WORD e_oeminfo;
WORD e_res2[10];
INT e_lfanew;
} IMAGE_DOS_HEADER;
#pragma pack(pop)using System;
using System.Runtime.InteropServices;
[StructLayout(LayoutKind.Sequential, Pack = 2, CharSet = CharSet.Unicode)]
public struct IMAGE_DOS_HEADER
{
public ushort e_magic;
public ushort e_cblp;
public ushort e_cp;
public ushort e_crlc;
public ushort e_cparhdr;
public ushort e_minalloc;
public ushort e_maxalloc;
public ushort e_ss;
public ushort e_sp;
public ushort e_csum;
public ushort e_ip;
public ushort e_cs;
public ushort e_lfarlc;
public ushort e_ovno;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)] public ushort[] e_res;
public ushort e_oemid;
public ushort e_oeminfo;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)] public ushort[] e_res2;
public int e_lfanew;
}Imports System.Runtime.InteropServices
<StructLayout(LayoutKind.Sequential, Pack:=2, CharSet:=CharSet.Unicode)>
Public Structure IMAGE_DOS_HEADER
Public e_magic As UShort
Public e_cblp As UShort
Public e_cp As UShort
Public e_crlc As UShort
Public e_cparhdr As UShort
Public e_minalloc As UShort
Public e_maxalloc As UShort
Public e_ss As UShort
Public e_sp As UShort
Public e_csum As UShort
Public e_ip As UShort
Public e_cs As UShort
Public e_lfarlc As UShort
Public e_ovno As UShort
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=4)> Public e_res() As UShort
Public e_oemid As UShort
Public e_oeminfo As UShort
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=10)> Public e_res2() As UShort
Public e_lfanew As Integer
End Structureimport ctypes
from ctypes import wintypes
class IMAGE_DOS_HEADER(ctypes.Structure):
_pack_ = 2
_fields_ = [
("e_magic", ctypes.c_ushort),
("e_cblp", ctypes.c_ushort),
("e_cp", ctypes.c_ushort),
("e_crlc", ctypes.c_ushort),
("e_cparhdr", ctypes.c_ushort),
("e_minalloc", ctypes.c_ushort),
("e_maxalloc", ctypes.c_ushort),
("e_ss", ctypes.c_ushort),
("e_sp", ctypes.c_ushort),
("e_csum", ctypes.c_ushort),
("e_ip", ctypes.c_ushort),
("e_cs", ctypes.c_ushort),
("e_lfarlc", ctypes.c_ushort),
("e_ovno", ctypes.c_ushort),
("e_res", ctypes.c_ushort * 4),
("e_oemid", ctypes.c_ushort),
("e_oeminfo", ctypes.c_ushort),
("e_res2", ctypes.c_ushort * 10),
("e_lfanew", ctypes.c_int),
]#[repr(C, packed(2))]
pub struct IMAGE_DOS_HEADER {
pub e_magic: u16,
pub e_cblp: u16,
pub e_cp: u16,
pub e_crlc: u16,
pub e_cparhdr: u16,
pub e_minalloc: u16,
pub e_maxalloc: u16,
pub e_ss: u16,
pub e_sp: u16,
pub e_csum: u16,
pub e_ip: u16,
pub e_cs: u16,
pub e_lfarlc: u16,
pub e_ovno: u16,
pub e_res: [u16; 4],
pub e_oemid: u16,
pub e_oeminfo: u16,
pub e_res2: [u16; 10],
pub e_lfanew: i32,
}import "golang.org/x/sys/windows"
type IMAGE_DOS_HEADER struct {
e_magic uint16
e_cblp uint16
e_cp uint16
e_crlc uint16
e_cparhdr uint16
e_minalloc uint16
e_maxalloc uint16
e_ss uint16
e_sp uint16
e_csum uint16
e_ip uint16
e_cs uint16
e_lfarlc uint16
e_ovno uint16
e_res [4]uint16
e_oemid uint16
e_oeminfo uint16
e_res2 [10]uint16
e_lfanew int32
}type
IMAGE_DOS_HEADER = packed record
e_magic: Word;
e_cblp: Word;
e_cp: Word;
e_crlc: Word;
e_cparhdr: Word;
e_minalloc: Word;
e_maxalloc: Word;
e_ss: Word;
e_sp: Word;
e_csum: Word;
e_ip: Word;
e_cs: Word;
e_lfarlc: Word;
e_ovno: Word;
e_res: array[0..3] of Word;
e_oemid: Word;
e_oeminfo: Word;
e_res2: array[0..9] of Word;
e_lfanew: Integer;
end;const IMAGE_DOS_HEADER = extern struct {
e_magic: u16,
e_cblp: u16,
e_cp: u16,
e_crlc: u16,
e_cparhdr: u16,
e_minalloc: u16,
e_maxalloc: u16,
e_ss: u16,
e_sp: u16,
e_csum: u16,
e_ip: u16,
e_cs: u16,
e_lfarlc: u16,
e_ovno: u16,
e_res: [4]u16,
e_oemid: u16,
e_oeminfo: u16,
e_res2: [10]u16,
e_lfanew: i32,
};type
IMAGE_DOS_HEADER {.packed.} = object
e_magic: uint16
e_cblp: uint16
e_cp: uint16
e_crlc: uint16
e_cparhdr: uint16
e_minalloc: uint16
e_maxalloc: uint16
e_ss: uint16
e_sp: uint16
e_csum: uint16
e_ip: uint16
e_cs: uint16
e_lfarlc: uint16
e_ovno: uint16
e_res: array[4, uint16]
e_oemid: uint16
e_oeminfo: uint16
e_res2: array[10, uint16]
e_lfanew: int32align(2)
struct IMAGE_DOS_HEADER
{
ushort e_magic;
ushort e_cblp;
ushort e_cp;
ushort e_crlc;
ushort e_cparhdr;
ushort e_minalloc;
ushort e_maxalloc;
ushort e_ss;
ushort e_sp;
ushort e_csum;
ushort e_ip;
ushort e_cs;
ushort e_lfarlc;
ushort e_ovno;
ushort[4] e_res;
ushort e_oemid;
ushort e_oeminfo;
ushort[10] e_res2;
int e_lfanew;
}HSP用 定義
HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; IMAGE_DOS_HEADER サイズ: 64 バイト(x64)
dim st, 16 ; 4byte整数×16(構造体サイズ 64 / 4 切り上げ)
; e_magic : WORD (+0, 2byte) wpoke st,0,値 / 値 = wpeek(st,0)
; e_cblp : WORD (+2, 2byte) wpoke st,2,値 / 値 = wpeek(st,2)
; e_cp : WORD (+4, 2byte) wpoke st,4,値 / 値 = wpeek(st,4)
; e_crlc : WORD (+6, 2byte) wpoke st,6,値 / 値 = wpeek(st,6)
; e_cparhdr : WORD (+8, 2byte) wpoke st,8,値 / 値 = wpeek(st,8)
; e_minalloc : WORD (+10, 2byte) wpoke st,10,値 / 値 = wpeek(st,10)
; e_maxalloc : WORD (+12, 2byte) wpoke st,12,値 / 値 = wpeek(st,12)
; e_ss : WORD (+14, 2byte) wpoke st,14,値 / 値 = wpeek(st,14)
; e_sp : WORD (+16, 2byte) wpoke st,16,値 / 値 = wpeek(st,16)
; e_csum : WORD (+18, 2byte) wpoke st,18,値 / 値 = wpeek(st,18)
; e_ip : WORD (+20, 2byte) wpoke st,20,値 / 値 = wpeek(st,20)
; e_cs : WORD (+22, 2byte) wpoke st,22,値 / 値 = wpeek(st,22)
; e_lfarlc : WORD (+24, 2byte) wpoke st,24,値 / 値 = wpeek(st,24)
; e_ovno : WORD (+26, 2byte) wpoke st,26,値 / 値 = wpeek(st,26)
; e_res : WORD (+28, 8byte) varptr(st)+28 を基点に操作(8byte:入れ子/配列)
; e_oemid : WORD (+36, 2byte) wpoke st,36,値 / 値 = wpeek(st,36)
; e_oeminfo : WORD (+38, 2byte) wpoke st,38,値 / 値 = wpeek(st,38)
; e_res2 : WORD (+40, 20byte) varptr(st)+40 を基点に操作(20byte:入れ子/配列)
; e_lfanew : INT (+60, 4byte) st.15 = 値 / 値 = st.15 (lpoke/lpeek も可)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
#defstruct global IMAGE_DOS_HEADER, pack=2
#field short e_magic
#field short e_cblp
#field short e_cp
#field short e_crlc
#field short e_cparhdr
#field short e_minalloc
#field short e_maxalloc
#field short e_ss
#field short e_sp
#field short e_csum
#field short e_ip
#field short e_cs
#field short e_lfarlc
#field short e_ovno
#field short e_res 4
#field short e_oemid
#field short e_oeminfo
#field short e_res2 10
#field int e_lfanew
#endstruct
stdim st, IMAGE_DOS_HEADER ; NSTRUCT 変数を確保
st->e_magic = 100
mes "e_magic=" + st->e_magic