1

I have found problem with finding file offset which actually is program entry point.

In case I experience problem, value of AddressOfEntryPoint is 0x1018. Here is a section which maps this address.

Section header

I assume entry point should be 0x28 = 0x10 + 0x1018 - 0x1000 (PointerToRawData + AddressOfEntryPoint - VirtualAddress)

However tools says it is 0x18 instead. I'm not sure why, made some experiments and came up with another formula.

0x18 = (0x10 / 0x200) * 0x200 + 0x1018 - 0x1000 ((PointerToRawData / FileAlignment) * FileAlignment + AddressOfEntryPoint - VirtualAddress)

I use FileAlignment from OptionalHeader and it works great, however I don't know if it is a coincidence or somewhere documented, so asking here for confirmation.


Also, probably not important, but file is packed with UPack(0.399), packer signature BE****AD50FF7634EB7C4801.

  • I don't really understand what you are trying to calculate, if you already have the (virtual) address of the entry point, you should just add the base image. – Dillinur Mar 16 '15 at 13:34
  • @Dillinur I want to calculate file offset for EP. – ST3 Mar 16 '15 at 15:02
4

From https://code.google.com/p/corkami/wiki/PE#PointerToRawData --

if a section's physical start is lower than 200h (the lower limit for standard alignment), it is rounded down to 0.

Thus, the entry point's physical offset would be: 0x00000018 = 0x00000000 + 0x00001018 - 0x00001000 (PointerToRawData_rounded_down + AddressOfEntryPoint - VirtualAddress)

  • Well it should be 0x18 because IDA and DIE says so, also I know packer signature and it is at 0x18, not 0x28. So I think there should be something related to FileAlignment and PointerToRawData values, because msdn says PointerToRawData should be multiple of FileAlignment, however it is not. – ST3 Mar 16 '15 at 15:06
  • After reading code.google.com/p/corkami/wiki/PE#PointerToRawData, I learned something new and updated my answer above :) – Jason Geffner Mar 16 '15 at 15:46
  • The section start had to be non-zero in order to be loaded. I don't remember why we chose 0x10. Perhaps because that's where the PE signature was, so it looked nice. – peter ferrie Mar 16 '15 at 16:28
  • Great, thanks. All I did was rounding down, but I needed verification if it is not a coincidence. – ST3 Mar 17 '15 at 7:45
  • @peterferrie You don't remember why?? Of topic question, but are you one of those who designed UPack? If so is there any information for unpacking script? I could reverse it, but that info could save some time. – ST3 Mar 17 '15 at 7:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.