What are e_cblp and e_cp in the DOS header?

Question

I am trying to understand the DOS header deeply and I am stuck with these. I know that the only bytes needed are an MZ signature and a pointer to a PE section, but I must know that these two are exactly:

USHORT e_cblp; // Bytes on last page of file USHORT e_cp; // Pages in file 

In the binary code of most executable files, these values ​​are 90h and 03h, respectively. The page is 512 bytes of code, so there are 3 pages, but where? Where can I find them in a file? How can I identify these 90h (144) bytes on the last page of 512 bytes?

This information is requested only by DOS. The only PE file code that will work in DOS is the DOS stub, and these are not 3 pages of code, but only 64 bytes. So what do 90h and 03h do there? Can I just say e_cblp=01h and e_cp=DOS header+DOS stub ?

Answer 1

This is the size of the executable file of the format "whole" MZ, the whole past of the last byte on the last page is ignored. When MS-DOS loads an executable file in the MZ format, it copies everything to the file after the headers to this limit. Thus, the fact that in most PECOFF executables this field is set to a value greater than the MS-DOS stub means that the PECOFF headers and part of the PECOFF section data will be loaded into memory when the executable is launched under MS-DOS.

I don’t know why the default DOS stub used by the Microsoft linker (and the GNU linker, but not Borland or Watcom) says that its size is 1168 bytes, when in fact it is much smaller. If you use your own stub when using the Microsoft linker, it uses the size from the provided executable. Windows seems to ignore this value when loading PECOFF executables, and the DOS stub is not used by default for additional data.

Please note that using the Microsoft linker, you can create a valid PECOFF executable that is only 1024 bytes long. This requires that the executable file has only one partition and has a size of less than 512 bytes. While Windows will load and run the executable file, MS-DOS will refuse because the file size is smaller than the size 1168 specified in the MZ headers.

Answer 2

e_cblp :

Determines the number of bytes actually used on the last page, with the special case of a full page represented by a zero value (since the last page is never blank). For example, if the page size is 512 bytes, this value will be 0x0000 for a file of size 1024 bytes and 0x0001 for a file of size 1025 bytes (since it contains only one valid byte).

So, 1024 + 144 (90h) = 1168 bytes

a source