Summary
Open almost any Windows EXE in a hex editor, and you’ll likely see MZ as the first two characters. Go ahead—try it. It doesn’t matter whether the software was compiled this year or shipped decades ago; the same two letters keep showing up. You’ll find them at the front of countless DLLs too.those They don’t stand for Microsoft, machine code, or some forgotten executable instruction. They’re the initials of a programmer named Mark Zbikowski, preserved at the very start of Windows software long after the computers that first needed them disappeared. Your EXE starts in the 1980s Those first two bytes have been there for decades A file extension gives Windows a decent hint about what it’s looking at, which is one reason showing file extensions in Windows is such a useful security setting. But if you look past the filename and dive into the actual data, you’ll find many file formats also have recognizable patterns built in. For a standard Windows application file (known as a Portable Executable or PE), the very first two bytes of data are usually 4D 5A in hexadecimal code. If you translate that computer code into regular text, it spells out MZ. or magic number. It lets software identify a file by what’s actually inside it, instead of blindly trusting whatever extension somebody slapped on the filename. MZ actually predates the PE format. It comes from the old DOS EXE header, where the value was used as the executable signature. Zbikowski was one of the original architects of MS-DOS, and his initials ended up baked into that format. It’s another example of Windows file extensions still carrying baggage from 1980s computing. Windows reads past the autograph MZ is the front door, PE is the house A modern 64-bit app doesn’t need DOS to do its job. Today’s Windows software uses the Portable Executable (PE) format, which is the family of structures behind EXE files, DLLs, and several other kinds of Windows programs. You can see this if you keep reading past those first two bytes. Inside the DOS header is a field called e_lfanew , which stores an offset that tells software where the PE header begins later in the file. If you follow that pointer, you’ll run right into a second signature: PE\0\0 . These four bytes are the official stamp that tells your computer, “You’ve officially reached the modern Windows program.” So the basic layout looks roughly like this: DOS header ⇒ DOS stub ⇒ PE signature ⇒ PE headers ⇒ sections Those sections hold much of what makes up the actual Windows program: executable code, ordinary data, import tables, resources such as icons, relocation information, and other structures the loader and application may need. Because DLL files use the same basic PE structure, you’ll see this layout over and over again if you poke around your computer’s System32 folder. Sandwiched between the DOS header and PE header is another relic called the DOS stub. Microsoft’s linker normally puts a tiny DOS program there that prints a brutally blunt message if someone tries to run the executable under DOS: “This program cannot be run in DOS mode.” If you open up enough application files in a hex editor, you’ll occasionally spot that exact sentence sitting there in plain English among all the binary cruft. It’s a neat little relic from an era most people haven’t booted into for decades, still tucked inside software built for today’s Windows. Replacing it would solve very little File formats become contracts once enough software depends on them This leaves one obvious question: if Windows doesn’t need DOS to launch apps anymore, why keep dragging this old structure along? The answer isn’t simply backward compatibility with DOS software. Windows has dropped plenty of old behavior over the years, and some aging programs already need compatibility settings just to run on newer versions of Windows. The bigger reason is that this old header isn’t merely decorative anymore. It’s part of the PE format Windows and its software ecosystem expect. Removing the whole structure would therefore mean changing the executable format itself or teaching Windows and its tools another layout, all to reclaim a tiny amount of historical baggage. Microsoft has mostly taken the easier route and extended PE instead of replacing it. When Windows moved to 64-bit, PE32+ changed the fields that needed to grow for 64-bit images while keeping the rest of the format recognizable. Matt Pietrek’s technical description of PE32+ notes that relatively few structural changes were needed for the 64-bit version. A programmer’s smallest legacy can last the longest Most programmers don’t get to choose which part of their career sticks around. Maybe it’s a major product, an algorithm, or some tiny decision made while building software for hardware that now belongs behind glass. For Mark Zbikowski, it ended up being two letters. They’re easy to miss and almost boring once you know what they mean, which is probably why I like the story so much. Those initials have outlived the DOS era they came from and are still sitting at the front of modern Windows executables decades later. That’s a pretty good legacy for a programmer, and Windows keeps renewing it every time it loads another EXE.