Kind of a simple question. How does a program like IDA locate the entry point of an exe? If I wanted to, could i find this with just a hex editor manually?
1
-
1Pe format (portable exectable)is documented exes are created in pe format. The header of pe contains a structure member called Address of Entrypoint– blabbMar 5, 2017 at 4:07
Add a comment
|
1 Answer
The entry point is defined in the PE header. The full docs for its layout can be found here https://msdn.microsoft.com/en-us/library/ms809762.aspx
The field is DWORD AddressOfEntryPoint. So you would have to work out the offset of this value from the start of the header based on the size of the preceding fields to find it in a hex editor
