I know that the specifications of the Microsoft PE/DLL/DOS-MZ files states that the two first bytes of a PE/DLL/DOS-MZ file is MZ (0x4d,0x5a) orZM(0x5a,0x4d`).The problem with such a small signature is that a lot of other files may match the same specification and a test based only on this two first bytes quickly tends to be inconclusive.So, my question is simple, after testing that the two first bytes are MZ (or ZM), what other, more reliable, test can be performed to check that the file is a PE/DLL/DOS-MZ?
How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?
pe;dll;file format;dos exe
That would be e_lfanew in the MZ header itself. For simple (16 bit) MSDOS software, this ought to be 0, and for any extended format it should point right to one of the specific LE, PE, or NE headers' identifiers (which all are exactly those two characters). As in all of these cases the header itself is a mere stub, e_cp (the total size of this executable in pages) should not be larger than the offset of e_lfanew. (Plus or minus that infernal e_cblp, the bytes on last page of file  I always forget which one it is.)See Peering inside the PE, an article that despite its age still is very useful.