7

Is it always at the lowest address of code section?

Andreas Rejbrand
  • 105,602
  • 8
  • 282
  • 384
COMer
  • 1,117
  • 4
  • 14
  • 24

1 Answers1

12

No, not necessarily. The PE entry point is defined in the IMAGE_OPTIONAL_HEADER structure, in the AddressOfEntryPoint field:

A pointer to the entry point function, relative to the image base address. For executable files, this is the starting address. For device drivers, this is the address of the initialization function. The entry point function is optional for DLLs. When no entry point is present, this member is zero.

A linker can set this to be whatever it wants to be, as long as its a valid relative virtual offset into the PE. Some compilers and linkers might have the convention of putting the entry point at the beginning of the text/code section, but there's no OS or PE format requirement for it.

Chris Schmich
  • 29,128
  • 5
  • 77
  • 94
  • 1
    I have found that I was not able to set the `AddressOfEntryPoint` arbitrarily when using Windows 7. I'm generating small executables without data directories or section tables. From trial and error, I found that the entry may point directly after the PE header, but not at a small additional offset. – Lars Brinkhoff Oct 10 '14 at 11:34