1

So I am trying to open my test app EXE file in ollydbg to study the assembly, the stack, registers and all that stuff for educational purposes and it gives me this message saying that the entry point is outside the code. Indeed it is, I can see the value in the Optional Header.AddressOfEntryPoint field which clearly exceeds the file size.

My question is why is this happening?

This is the C code. Very simple.


#include<studio.h>

int main()
{
   printf("THIS IS OUR TEST APP!");

   return 0;
}

The file on disk ends at an offset of 95ffh.

The entry point is 11334h.

I am new to reverse Engineering so please be kind.

I am using Visual studio 2017 community edition, PEBear and OllyDbg for my studies on Windows 10. I am using C to write simple programs for study.

5
  • Hello and welcome to re.se. Please also post compilation flags, a link to sample binary and source you use to compile.
    – sudhackar
    Apr 17 at 14:13
  • I have updated the question. I hope that is sufficient information. @sudhackar
    – EmexNatera
    Apr 17 at 14:21
  • Please post a link to sample binary as well. Are you able to run the file well?
    – sudhackar
    Apr 17 at 19:11
  • Have you considered that the entry point of the loaded executable at run-time is changed by ASLR?
    – Robert
    Apr 17 at 20:05
  • Also keep in mind that the CRT wants a chance to run before main, so the compiler will mark MainCRTStartup() the entry point (see stackoverflow.com/a/22935162/858968)
    – josh poley
    Apr 18 at 13:20

1 Answer 1

1

Because the entrypoint in a PE file refers to an offset within the memory image of the file after being loaded by the operating system loader. The entrypoint, like all so-called "relative virtual addresses" (RVAs) referenced in the PE header, does not refer to a physical offset within the PE file. Any particular bytes within the PE file (after the initial MZ and PE headers) probably will not have the same file offset and relative virtual address. Look into the difference between "section alignment" versus "file alignment", and the concept of a "section" within a PE file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.