Kind of a simple question. How does a program like IDA locate the entry point of an exe? If I wanted to, could i find this with just a hex editor manually?
1 Answer
The entry point is defined in the PE header. The full docs for its layout can be found here https://msdn.microsoft.com/en-us/library/ms809762.aspx
The field is DWORD AddressOfEntryPoint
. So you would have to work out the offset of this value from the start of the header based on the size of the preceding fields to find it in a hex editor