Kind of a simple question. How does a program like IDA locate the entry point of an exe? If I wanted to, could i find this with just a hex editor manually?
-
1Pe format (portable exectable)is documented exes are created in pe format. The header of pe contains a structure member called Address of Entrypoint– blabbMar 5, 2017 at 4:07
1 Answer
The entry point is defined in the PE header. The full docs for its layout can be found here https://msdn.microsoft.com/en-us/library/ms809762.aspx
The field is DWORD AddressOfEntryPoint
. So you would have to work out the offset of this value from the start of the header based on the size of the preceding fields to find it in a hex editor