About the entry point of PE in Windows

windows portable-executable entry-point
COMer picture COMer · Sep 19, 2010 · Viewed 10.5k times · Source

Is it always at the lowest address of code section?

Answer

Chris Schmich picture Chris Schmich · Sep 19, 2010

No, not necessarily. The PE entry point is defined in the IMAGE_OPTIONAL_HEADER structure, in the AddressOfEntryPoint field:

A pointer to the entry point function, relative to the image base address. For executable files, this is the starting address. For device drivers, this is the address of the initialization function. The entry point function is optional for DLLs. When no entry point is present, this member is zero.

A linker can set this to be whatever it wants to be, as long as its a valid relative virtual offset into the PE. Some compilers and linkers might have the convention of putting the entry point at the beginning of the text/code section, but there's no OS or PE format requirement for it.

Related questions

Windows: Command line to read version info of an executable file?

Does Windows have an executable that I can run in the command shell which returns the version number of an executable (.exe) file? I see a lot of questions that show how to do it from different languages, and references …

Read More
EXE or DLL Image base address

Is there a way in C++/windows to get the exe/DLL image base address? thanks :)

Read More
What's the difference between .rdata and .idata segments?

I noticed in IDA that the PE file which I analyze has not only the .rdata section but also .idata. What's the difference?

Read More