windowsportable-executable

What does "e_lfanew" mean in the DOS header for the PE format?

In the IMAGE_DOS_HEADER for the PE (Windows executable) format there is a field e_lfanew. It serves a very important role in that it points to the PE header data.

What makes the name "e_lfanew" appropriate?

Solution

  • My interpretation would be that it's the logical file address for the New Executable header.

    Mainly based on the comment in this P/Invoke C# definition of the IMAGE_DOS_HEADER struct:

    public Int32 e_lfanew;      // File address of new exe header

    And a comment by @Hans Passant:

    The e_ prefix helped deal with old K&R compilers that did not yet keep structure members in its own symbol table.

    And a later comment here by @Simon Kissane:

    Inside the IMAGE_DOS_HEADER there are two fields starting with e_lfa:

    • WORD e_lfarlc; // File address of relocation table
    • LONG e_lfanew; // File address of new exe header

    The "lfa" would appear to mean "logical file address", meaning the offset relative to the start of the executable file.