PE DOS stub content not commands

Question

Does anyone know why the PE DOS stub often includes repetitive looking data that does not seem to be valid 16bit commands?

Answer 1

This is the so-called "Rich header", added by Microsoft's link.exe (you can see the text "Rich" at the end of the mysterious block). It contains information about the versions of compilers and other tools which participated in producing the code of the executable. Some references:

• Finding the Needle: A Study of the PE32 Rich Header and Respective Malware Triage
• Microsoft's Rich Signature (undocumented)

• My parser based on code from this article (more references at the bottom)

  Typical output:

  PRODID   name            build count
        1   Import0             0   141
       95   Utc1310_C        4035     1
      110   Utc1400_CPP     50727    45
      125   Masm800         50727    17
      109   Utc1400_C       50727   105
      120   Linker800       50727     1
       93   Implib710        4035    19
      124   Cvtres800       50727     1
  Checksum valid