Home/ Questions/Q 9108821
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-17T02:53:42+00:00

I have been scouring the web trying to find an answer to this question,

  • 0

I have been scouring the web trying to find an answer to this question, but it seems to be eluding me. I have consulting the following sources before asking this question.

I understand the PE format (or at least I think I do). Using the command-line debugger (cdb), I would like to be able to disassemble the address where the RVA is to see what the first call is. For a native application (like Notepad), I would expect to see notepad!WinMainCRTStartup, and for a .NET application, I would expect to see a jmp command to the CLR.

Using Notepad as an example, I executed dumpbin /headers on it, and got a value of 3570 for the entry point. When I execute cdb notepad and perform this command – u [base address in memory]+0x3570 – I do not get the WinMainCRTStartup call.

Am I misinterpreting the PE output from dumpbin? How can I know exactly where to look in memory for the starting function of an application?

Edit (1/7/13): I forgot to mention that I am running this on 64-bit Windows 7. If I try to use cdb in Windows XP Mode (to get results from a 32-bit OS), disassembling the AddressOfEntryPoint that I get from an analysis of the PE file gets me the call to WinMainCRTStartup as I would expect. In other words, the exact address I am told to look at contains what I think it should in a 32-bit OS. Does running the application on a 64-bit machine truly make that much of a difference?

Just to add complexity, if I do a !dh on the ImageBaseAddress in the 64-bit OS in cdb, I get the EXACT AddressOfEntryPoint that I need to use.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Use the Microsoft Symbol Server to obtain symbol debugging information. http://support.microsoft.com/kb/311503/en-us

    0:001> !dh -a notepad
    ....
    3689 address of entry point
    ...
    00ac0000 image base
    ...
0:001> u ac3689 
notepad!WinMainCRTStartup:

    Edit: add dumpbin output (entry point the same offset, image base may be different because ASLR works when image loads in memory):

    Microsoft (R) COFF/PE Dumper Version 11.00.50727.1
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file c:\windows\notepad.exe

PE signature found

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
             14C machine (x86)
               4 number of sections
        4A5BC60F time date stamp Tue Jul 14 03:41:03 2009
               0 file pointer to symbol table
               0 number of symbols
              E0 size of optional header
             102 characteristics
                   Executable
                   32 bit word machine

OPTIONAL HEADER VALUES
             10B magic # (PE32)
            9.00 linker version
            A800 size of code
           22400 size of initialized data
               0 size of uninitialized data
            3689 entry point (01003689) _WinMainCRTStartup

    Edit 2 add output for x64

    dumpbin:

    Microsoft (R) COFF/PE Dumper Version 10.00.30319.01
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file c:\windows\notepad.exe

PE signature found

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
            8664 machine (x64)
               6 number of sections
        4A5BC9B3 time date stamp Tue Jul 14 03:56:35 2009
               0 file pointer to symbol table
               0 number of symbols
              F0 size of optional header
              22 characteristics
                   Executable
                   Application can handle large (>2GB) addresses

OPTIONAL HEADER VALUES
             20B magic # (PE32+)
            9.00 linker version
            A800 size of code
           25800 size of initialized data
               0 size of uninitialized data
            3570 entry point (0000000100003570) WinMainCRTStartup

    windbg:

        0:000> !dh -a notepad

    File Type: EXECUTABLE IMAGE
    FILE HEADER VALUES
        8664 machine (X64)
        ...
        1000 base of code
             ----- new -----
    00000000ff0c0000 image base
    ...
0:000> u ff0c0000+3570
notepad!WinMainCRTStartup:
    • 0