title: How to get PE file signature offset?
body: <p>I am trying to parse PE file, I load it into memory and I set WinNT structures pointer to appopriate addresses. However, I'm not able to do stupid checking for PE\0\0 signature, because I have wrong offset from DOS header (one byte too much). So when I check IMAGE_NT_HEADERS.Signature I receive 4 bytes starting from 'E'.</p>
  
  <pre><code>#define SHOW_VAR(x)  std::cout &lt;&lt; #x &lt;&lt; " = " &lt;&lt; x &lt;&lt; std::endl
  #define SHOW_HEX(x)  std::cout &lt;&lt; std::showbase &lt;&lt; std::hex &lt;&lt; #x &lt;&lt; " = " &lt;&lt; x &lt;&lt; std::endl; std::cout &lt;&lt; std::dec
  
  uintmax_t fileSize = boost::filesystem::file_size(m_filePath);
  m_image.reset(new char[fileSize]);
  
  boost::filesystem::ifstream file;
  file.open(m_filePath, std::ios::in);
  file.read(m_image.get(), fileSize);
  file.close();
  
  m_DOSHeader = reinterpret_cast&lt;PIMAGE_DOS_HEADER&gt;(m_image.get());
  // --m_DOSHeader-&gt;e_lfanew; &lt;---- THIS SOLVES THE PROBLEM BUT WHY?
  m_NTHeaders = reinterpret_cast&lt;PIMAGE_NT_HEADERS&gt;(m_image.get() + m_DOSHeader-&gt;e_lfanew);
  
  // DEBUG
  SHOW_HEX(m_DOSHeader-&gt;e_lfanew);
  for(int i = m_DOSHeader-&gt;e_lfanew - 5; i &lt; m_DOSHeader-&gt;e_lfanew + 5; ++i)
  {
      if(i == m_DOSHeader-&gt;e_lfanew)
          std::cout &lt;&lt; "---&gt; ";
      SHOW_HEX(m_image[i]);
  }
  
  // check if MZ
  if(m_DOSHeader-&gt;e_magic != IMAGE_DOS_SIGNATURE)
      throw std::runtime_error("[PEFile] MZ signature not found");
  
  // check if PE00
  SHOW_VAR((char)m_NTHeaders-&gt;Signature);
  if(m_NTHeaders-&gt;Signature != IMAGE_NT_SIGNATURE)
      throw std::runtime_error("[PEFile] PE00 signature not found");
  </code></pre>
  
  <p>The result of DEBUG snippet is:</p>
  
  <pre><code>m_DOSHeader-&gt;e_lfanew = 0xf0
  m_image[i] =  
  m_image[i] =  
  m_image[i] =  
  m_image[i] =  
  m_image[i] = P
  ---&gt; m_image[i] = E
  m_image[i] =  
  m_image[i] =  
  m_image[i] = L
  m_image[i] = 
  (char)m_NTHeaders-&gt;Signature = E
  [ERROR] [PEFile] PE00 signature not found
  </code></pre>
  
  <p>I checked it with pedump.me and m_DOSHeader->e_lfanew = 0xf0 is OK. What do I do wrong that I have to decrement this offset to get actually correct signature?</p>
  
  <p>I'm using VS2013 RC on 64-bit Windows 8.1, but I checked that I have set _WIN32 define. And this error occures for both 32 and 64 bit exe files.</p>