How to find start of .text section?

Question

i made a random console application and loaded into IDA. The start of .text section shown is 00BA1000. Then i loaded the application into CFF explorer. The address of entry point was 000110AA. Is it the offset to the function? If yes, is it the raw offset (in the exe file) or virtual offset (after the exe is loaded in memory) ? Then i saw there was a key named 'base of code'. Why isnt addressofentrypoint the same as base of code? I mean, they are start of the text section too right? With IDA , i can know the start of .text section is 00BA1000. But, how can i know it with CFF explorer? With CFF, i can know the virtual address of text section is 00011000. So when the program is loaded into memory, the start of the text section should be imagebase + 00011000 right? With ollydbg i can know its wrong. The calculated address isnt the correct one, but the one shown in IDA is. These questions messed me up. Hope you can help me !!!

CFF explorer (basically helps you look into PE header) : https://ntcore.com/?page_id=388

Screenshots: https://imgur.com/affLCHY

https://imgur.com/1wTQAlX

https://imgur.com/5X3QWSO

Thanks a lot for reading!

Answer 1

Base of code is where the code starts
Address of Entrypoint is Where the executable starts executing (the main function's first instruction)

they both can be same or different

here is an example where they both are same

:\>dumpbin /headers funadd.exe | grep -iE "base of code|entry point"
            1000 entry point (00401000) _WinMain@16
            1000 base of code

that is becasue the main function does not refer any other function

suppose you have code like this

int main (void) { printf ( "%x\n" , dosomecrap() ); }   

then when compiling the main function needs to refer to the dosomecrap() function so the compiler will compile the dosomecrap() first and put the code from base of code

in this case main () comes later in the code section
so they both wont be same

Address of Entry Point will point to main()
Base of code may point to start of dosomecrap()

in normal compiled executables main is not the first code that is exceuted

it is cruntime init code like maincrtstartup() or WinMainCrtStartup()

that is executed first

import section can be merged into text section

in that case the resolved imports start at base of code

you can write code like this and merge data section into .text section in this case the embedded bytes would be the first bytes at base of code

#include <windows.h>

int p[] = { '\x90\x90\x90\x90' };

int funAdd() {
    int myvar = 2; 
    return myvar + p[0];
}

int CALLBACK  WinMain(_In_ HINSTANCE,_In_opt_ HINSTANCE,_In_ LPSTR,_In_ int) {
    funAdd();
}

if you compile this with

cl /Zi /W4 /analyze /EHsc /Od /nologo funadd.cpp /link /release /subsystem:windows /entry:WinMain /nologo /merge:.data=.text

and check you can see bith base of code an address of entry point differ

Address of entry point has been shifted 16 bytes or 0x10 bytes (alignment requirement says code should be aligned to 16 byte boundary )

:\>dumpbin /headers funadd.exe | grep -iE "base of code|entry point"
            1010 entry point (00401010) _WinMain@16
            1000 base of code

you can see the 0x90 as below

:\>dumpbin /disasm /range:0x401000,0x401016  funadd.exe
Microsoft (R) COFF/PE Dumper Version 14.14.26430.0
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file funadd.exe

File Type: EXECUTABLE IMAGE

?p@@3PAHA:
  00401000: 90 90 90 90                                      ....
  00401004: 00 00 00 00 00 00 00 00 00 00 00 00              ............
_WinMain@16:
  00401010: 55                 push        ebp
  00401011: 8B EC              mov         ebp,esp
  00401013: E8 08 00 00 00     call        ?funAdd@@YAHXZ

  Summary

        1000 .text