2

I have found problem with finding file offset which actually is program entry point.

In case I experience problem, value of AddressOfEntryPoint is 0x1018. Here is a section which maps this address.

Section header

I assume entry point should be 0x28 = 0x10 + 0x1018 - 0x1000 (PointerToRawData + AddressOfEntryPoint - VirtualAddress)

However tools says it is 0x18 instead. I'm not sure why, made some experiments and came up with another formula. 

0x18 = (0x10 / 0x200) * 0x200 + 0x1018 - 0x1000 ((PointerToRawData / FileAlignment) * FileAlignment + AddressOfEntryPoint - VirtualAddress)

I use FileAlignment from OptionalHeader and it works great, however I don't know if it is a coincidence or somewhere documented, so asking here for confirmation.

Also, probably not important, but file is packed with UPack(0.399), packer signature BE****AD50FF7634EB7C4801.

Improve this question
2
  • I don't really understand what you are trying to calculate, if you already have the (virtual) address of the entry point, you should just add the base image.
    – user2823000
    Mar 16, 2015 at 13:34
  • @Dillinur I want to calculate file offset for EP.
    – ST3
    Mar 16, 2015 at 15:02

1 Answer 1

Reset to default
4

From https://code.google.com/p/corkami/wiki/PE#PointerToRawData --

if a section's physical start is lower than 200h (the lower limit for standard alignment), it is rounded down to 0.

Thus, the entry point's physical offset would be: 0x00000018 = 0x00000000 + 0x00001018 - 0x00001000 (PointerToRawData_rounded_down + AddressOfEntryPoint - VirtualAddress)

Improve this answer
6
  • Well it should be 0x18 because IDA and DIE says so, also I know packer signature and it is at 0x18, not 0x28. So I think there should be something related to FileAlignment and PointerToRawData values, because msdn says PointerToRawData should be multiple of FileAlignment, however it is not.
    – ST3
    Mar 16, 2015 at 15:06
  • After reading code.google.com/p/corkami/wiki/PE#PointerToRawData, I learned something new and updated my answer above :)
    – Jason Geffner
    Mar 16, 2015 at 15:46
  • The section start had to be non-zero in order to be loaded. I don't remember why we chose 0x10. Perhaps because that's where the PE signature was, so it looked nice.
    – peter ferrie
    Mar 16, 2015 at 16:28
  • Great, thanks. All I did was rounding down, but I needed verification if it is not a coincidence.
    – ST3
    Mar 17, 2015 at 7:45
  • @peterferrie You don't remember why?? Of topic question, but are you one of those who designed UPack? If so is there any information for unpacking script? I could reverse it, but that info could save some time.
    – ST3
    Mar 17, 2015 at 7:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.