9

Kind of a simple question. How does a program like IDA locate the entry point of an exe? If I wanted to, could i find this with just a hex editor manually?

1
  • 1
    Pe format (portable exectable)is documented exes are created in pe format. The header of pe contains a structure member called Address of Entrypoint
    – blabb
    Mar 5, 2017 at 4:07

1 Answer 1

7

The entry point is defined in the PE header. The full docs for its layout can be found here https://msdn.microsoft.com/en-us/library/ms809762.aspx

The field is DWORD AddressOfEntryPoint. So you would have to work out the offset of this value from the start of the header based on the size of the preceding fields to find it in a hex editor

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.