I got the dllbase address from PEB InMemoryOrderModuleListItem list and I am trying to access the PE dos header file of a DLL. I am new to reverse engineering and in the past, I accessed the dos header by converting the handle of the DLL to the PIMAGE_DOS_HEADER and continue from there. How can I get the dos header by the dllbase address? I tried to convert the DLL base address to the PIMAGE_DOS_HEADER but in the debugger, I get an error of unable to read memory.

2 Answers 2


The DLL base address is the address of the IMAGE_DOS_HEADER struct. If you don't find 'MZ' at the DLL base address, you probably have the wrong address.

  • I tried PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)(inMemoryOrderModuleListItem.DllBase); the inMemoryOrderModuleListItem data type is LDR_DATA_TABLE_ENTRY. In the visual studio debugger is saying unable to read memory.
    – fusu
    Apr 15, 2020 at 19:02
  • @fusu this is still the correct answer. The VS debugger could be complaining about this for various reasons. Are you perhaps attempting to parse the loaded PE file? Because IMAGE_DOS_HEADER is trivial, the headaches only start once you reach the first item where file vs. section alignment causes a divergence between on-disk and in-memory layout.
    – 0xC0000022L
    Jan 3, 2022 at 15:19

I'm not quite sure what you're asking, but I'll take a stab at it either way. You can use the following apis: CreateFile, CreateFileMapping, and MapViewOfFile to be able to get what you're looking for. Something like this will work for you:

HANDLE hFileMapping = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
LPVOID lpFileBase = MapViewOfFile(hFileMapping, FILE_MAP_READ, 0, 0, 0);
PIMAGE_DOS_HEADER DosHeader = static_cast<PIMAGE_DOS_HEADER>(lpFileBase);

There is no error checking in this code block so make sure to implement it, but lpFileBase will give you the base address of the dll you are looking for and then you can start parsing the DosHeader. Keep in mind you will only be able to read only. Change the flags if you need more than that.

Hope this helps!

  • This doesn't even address the question. For a given PE file loaded (or on-disk) the IMAGE_DOS_HEADER starts right at the base address. So here this is all about type coercion.
    – 0xC0000022L
    Jan 3, 2022 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.