Why is Visual Studio compiling my EXE file with an entry point that is not in the file?

Question

So I am trying to open my test app EXE file in ollydbg to study the assembly, the stack, registers and all that stuff for educational purposes and it gives me this message saying that the entry point is outside the code. Indeed it is, I can see the value in the Optional Header.AddressOfEntryPoint field which clearly exceeds the file size.

My question is why is this happening?

This is the C code. Very simple.

---

#include<studio.h>

int main()
{
   printf("THIS IS OUR TEST APP!");

   return 0;
}

---

The file on disk ends at an offset of 95ffh.

The entry point is 11334h.

I am new to reverse Engineering so please be kind.

I am using Visual studio 2017 community edition, PEBear and OllyDbg for my studies on Windows 10. I am using C to write simple programs for study.

Answer 1

Because the entrypoint in a PE file refers to an offset within the memory image of the file after being loaded by the operating system loader. The entrypoint, like all so-called "relative virtual addresses" (RVAs) referenced in the PE header, does not refer to a physical offset within the PE file. Any particular bytes within the PE file (after the initial MZ and PE headers) probably will not have the same file offset and relative virtual address. Look into the difference between "section alignment" versus "file alignment", and the concept of a "section" within a PE file.