I've been looking into the PE format using a random DLL as a test case. When I look manually at the entry point specified in the optional header (and add the image base, because RVA) it doesn't match the entry point address IDA gives in the exports list.
I know reading the entry point from the DLL isn't the problem, since if I calculate:
(AddressOfEntryPoint - [.text section virtual]) + [.text section offset]
(which should give the file offset to the entry point) you can find at the offset the same bytes that IDA says should be in the entry function.
Also I know that IDA must be calculating the entry point from this field since DLLEntryPoint
isn't in the exports list.
Am I missing something? If I do the same analysis on a normal executable everything works.
Imagebase
"? (should be right after the line "Format : Portable executable for 80386 (PE)
")0x10000000
, which is a bit off from the default0x400000
but I guess that's to save relocating.