0

I wrote a basic helloworld.exe with C with the simple line printf("helloworld!\n");

Then I used UltraEdit to view the bytes of the EXE file and used also PE Explorer to see the header values. When it comes to Address of Entry Point, PE Explorer displays 0x004012c0.

Magic                            010Bh   PE32
Linker Version                   1902h   2.25
Size of Code                 00008000h
Size of Initialized Data     0000B000h
Size of Uninitialized Data   00000C00h
Address of Entry Point       004012C0h
Base of Code                 00001000h
Base of Data                 00009000h
Image Base                   00400000h

But in UltraEdit I see 0x000012c0 after counting 16 bytes after magic 0x010B.

3F 02 00 00 E0 00 07 03 0B 01 02 19 00 80 00 00
00 B0 00 00 00 0C 00 00 C0 12 00 00 00 10 00 00
00 90 00 00 00 00 40 00 00 10 00 00 00 02 00 00
04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00
00 10 01 00 00 04 00 00 91 F6 00 00 03 00 00 00
00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00
00 E0 00 00 C0 06 00 00 00 00 00 00 00 00 00 00

Which one is correct?

Mofi
  • 46,139
  • 17
  • 80
  • 143
BobHU
  • 402
  • 5
  • 18

1 Answers1

1

simply read about IMAGE_OPTIONAL_HEADER structure

AddressOfEntryPoint

A pointer to the entry point function, relative to the image base address. For executable files, this is the starting address. For device drivers, this is the address of the initialization function. The entry point function is optional for DLLs. When no entry point is present, this member is zero.

so absolute address of EntryPoint is AddressOfEntryPoint ? ImageBase + AddressOfEntryPoint : 0

in your case AddressOfEntryPoint == 12c0 and ImageBase == 400000

as result absolute address of EntryPoint is 12c0+400000==4012c0

RbMm
  • 31,280
  • 3
  • 35
  • 56