1

Suppose I'm disassembling helloworld.exe (a program that outputs the string "hello world") and want to see the user code or code section for the file in IDA Pro. In what address would the user code be available?

When I mean user code I mean the .code section below

HelloWorld db "Hello, world!",0
msgTitle db "Hello world program",0

.code
Start:
         push    offset msgTitle
         push    offset HelloWorld
         push    0
         call    MessageBoxA

         push 0
         call ExitProcess
ends
end Start

Bonus Question: When not using IDA Pro how can I determine the address of the user code of a Portable Executable?

1
  • What if the programmer also wrote the "library code"? Anyway, most decompilers start decompiling at the program's Initial Code Point (taken from the PE Header), which typically is a very small wrapper that locates arguments, environment, and so on and then simply calls main.
    – Jongware
    Aug 23, 2015 at 0:10

1 Answer 1

2

If You use IDA: When You open Your binary in IDA, navigate to drop-box in up-right corner and choose Entry points. You will see red point, which indicates the address of entry point:

enter image description here

Without IDA: If You need to see Entry point of your binary without IDA, you need to parse PE and examine AddressOfEntryPoint value, which is RVA from base to the beginning of user-code [usually]

2
  • So without IDA I go to the Optional Header Section which shows the executable information and look at the AddressOfEntryPoint value. From there I just just find the address of the first line in the disabemly window and add the RVA of the AddressOfEntryPoint value? Aug 23, 2015 at 15:49
  • When You got AddressOfEntryPoint RVA value, You load binary in debugger, see base address, add RVA, like: base: 400000 + RVA 1CAA = address of user code should be 401CAA. Set breakpoint here and press Go. Or, in various debuggers, you can run directly to entry point. Aug 24, 2015 at 4:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.