Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As we know, exe files generally start with 4D5A or 'MZ' in ASCII. How would I change the header whilst still allowing the file to work as normal?

Right now i'm looking at ccleaner's exe file. Unfortunately i've not got 10 rep so I cannot post a screenshot of it.But the ASCII on the right says the program cannot be run in ASCII, therefore rendering the 4D5A useless? So technically, could I change the 4D5A to something else and it would still work?

If any old-school guys are on here, as much info on the 'DOS MZ' would be very much appreciated.

This is the image I was looking at:

CCleaner Hex View

share|improve this question
up vote 3 down vote accepted

How would I change the header whilst still allowing the file to work as normal?

You can't!

There's a reason the MZ string (16-bits representing 0x5A4D) is referred to as a "magic" number, and indeed, is required as per the EXE/PE specification (with roots all the way back to DOS-format executables). The layout of all modern portable executables appears as follows (ref):

enter image description here

In this MSDN article regarding the Portable Executable format, the MS-DOS header is detailed:

The MS-DOS Header

Every PE file begins with a small MS-DOS® executable. The need for this stub executable arose in the early days of Windows, before a significant number of consumers were running it. When executed on a machine without Windows, the program could at least print out a message saying that Windows was required to run the executable.

The first bytes of a PE file begin with the traditional MS-DOS header, called an IMAGE_DOS_HEADER. The only two values of any importance are e_magic and e_lfanew. The e_lfanew field contains the file offset of the PE header.

The e_magic field (a WORD [NB: 16-bits]) needs to be set to the value 0x5A4D. There's a #define for this value, named IMAGE_DOS_SIGNATURE. In ASCII representation, 0x5A4D is MZ, the initials of Mark Zbikowski, one of the original architects of MS-DOS.

For further information regarding the Windows PE/.EXE format, I highly recommend taking a look at the Windows Executable Files section of the x86 Disassembly Wikibook. It contains an extensive array of low-level information regarding the format.

share|improve this answer
Thanks for the answer. The x86 book looks fantastic. Will be giving it a thorough read. – BubbleMonster Aug 2 '13 at 18:53
@BubbleMonster I agree, that x86 Disassembly book is very useful and informative. You might also find the x86 Assembly Wikibook another great resource, which complements the x86 Disassembly Wikibook quite nicely. – Breakthrough Aug 2 '13 at 18:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .