{"record":{"id":"2650b31f8dd77857","repo":"QL-Win/QuickLook","slug":"dos-header-not-found","errorCode":null,"errorMessage":"DOS header not found.","messagePattern":"DOS header not found\\.","errorType":"exception","errorClass":"PEImageParseException","httpStatus":null,"severity":"error","filePath":"QuickLook.Plugin/QuickLook.Plugin.PEViewer/PEImageParser/PEImage.cs","lineNumber":52,"sourceCode":"    /// <summary>\n    /// Gets the optional header of this PE image file.\n    /// </summary>\n    public ImageOptionalHeader OptionalHeader { get; private set; }\n\n    /// <summary>\n    /// Gets the collection of section headers and data of this PE image file.\n    /// </summary>\n    public ImageSection[] Sections { get; private set; }\n\n    private PEImage(byte[] originalImage)\n    {\n        OriginalImage = originalImage;\n\n        using BinaryReader reader = new(new MemoryStream(OriginalImage));\n\n        // MZ\n        if (reader.BaseStream.Length < 2) throw new PEImageParseException(0, \"DOS signature not found.\");\n        if (reader.ReadUInt16() != 0x5a4d) throw new PEImageParseException(0, \"DOS header not found.\");\n\n        // DOS Header\n        if (reader.BaseStream.Length - reader.BaseStream.Position < 64) throw new PEImageParseException((int)reader.BaseStream.Position, \"DOS header incomplete.\");\n\n        DosHeader = new()\n        {\n            LastPageSize = reader.ReadUInt16(),\n            PageCount = reader.ReadUInt16(),\n            RelocationCount = reader.ReadUInt16(),\n            HeaderSize = reader.ReadUInt16(),\n            MinAlloc = reader.ReadUInt16(),\n            MaxAlloc = reader.ReadUInt16(),\n            InitialSS = reader.ReadUInt16(),\n            InitialSP = reader.ReadUInt16(),\n            Checksum = reader.ReadUInt16(),\n            InitialIP = reader.ReadUInt16(),\n            InitialCS = reader.ReadUInt16(),\n            RelocationOffset = reader.ReadUInt16(),","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/QL-Win/QuickLook/blob/cb5d9c429c81d9796fac469da2a68efb5626946d/QuickLook.Plugin/QuickLook.Plugin.PEViewer/PEImageParser/PEImage.cs#L34-L70","documentation":"Thrown after reading the first UInt16 when it is not 0x5a4d (little-endian 'MZ'). Every DOS/PE executable begins with the 'MZ' mark, so a mismatch means the file is not a Microsoft executable despite being at least 2 bytes. PEImageParseException(0, ...) records the error at offset 0.","triggerScenarios":"Constructing PEImage from a byte array whose first two bytes are not 0x4D 0x5A — e.g. an ELF Mach-O, a text/script file, a .NET assembly's raw IL dump, or arbitrary data misnamed .exe.","commonSituations":"Previewing a non-PE file whose extension routed it to PEViewer; an installer stub that is actually an SFX container with a non-standard preamble; cross-platform binaries (ELF/Mach-O) opened on Windows.","solutions":["Sniff the first 2 bytes for 'MZ' (0x5A4D) before constructing PEImage.","Use TryCanHandle-style detection so non-PE files never reach the parser.","Catch PEImageParseException and show 'not a valid PE/EXE' instead of crashing.","Route ELF/Mach-O files to the correct viewer."],"exampleFix":"// before\nif (reader.ReadUInt16() != 0x5a4d) throw new PEImageParseException(0, \"DOS header not found.\");\n\n// after — caller-side magic check\nusing var fs = File.OpenRead(path);\nvar b0 = fs.ReadByte(); var b1 = fs.ReadByte();\nif (b0 != 0x4D || b1 != 0x5A) return null; // not 'MZ'","handlingStrategy":"validation","validationCode":"using var fs = File.OpenRead(path);\nint b0 = fs.ReadByte(), b1 = fs.ReadByte();\nif (b0 != 0x4D || b1 != 0x5A) return; // not 'MZ'","typeGuard":"static bool HasMzMagic(byte[] head) => head.Length >= 2 && head[0]==0x4D && head[1]==0x5A;","tryCatchPattern":"try { var img = PEImage.FromFile(path); }\ncatch (PEImageParseException ex) when (ex.Message.Contains(\"DOS header not found\")) { /* not an executable */ }","preventionTips":["Sniff the 'MZ' magic before PE parsing.","Route ELF/Mach-O and non-PE files elsewhere.","Use TryCanHandle-style detection so mismatches never reach the parser."],"tags":["pe","exe","signature","dos","binary-parsing"],"backgroundTag":null,"analyzedSha":"cb5d9c429c81d9796fac469da2a68efb5626946d","analyzedAt":"2026-08-13T11:51:01.370Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}