Search code examples
assemblystackdos

"MZ" header in a DOS executable and its effects on the stack


The first 2 bytes of a DOS executable are 0x4d and 0x5a. If these are executed, 0x4d implies 'dec ebp' and 0x5a is 'pop edx'.

'dec ebp' decrements the base pointer by 1 and 'pop edx' increments the value of esp by 4 (x86 assembly). My question is that won't these operations leave the stack in an inconsistent state? And since the command line arguments (if any) are stored relative to ebp, won't these operations make the command line arguments inaccessible?

I may be missing something obvious, if so please humour me...


Solution

  • Unlike COM-type executables - where execution starts at the first byte of the program image - EXE-type executables are no supposed to start with executable code. At the beginning of an EXE file there is a header block instead, and this contains the address of the actual program entry point, among other things.

    Hence the bytes 'MZ' (or - supposedly equally valid - 'ZM') do not represent instructions. They are simply markers for identifying the format.

    There is a good overview in the wikipedia article DOS MZ executable.

    Note: the DOS parts of executables are implicitly 16-bit real mode and should be disassembled as such, not as 32-bit code.