Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
There are disassemblers like CFF explorer which display the AddressOfEntryPoint of any executable along with the offset where it is stored. I know how to find that ( IMAGE_OPTIONAL_HEADER::AddressOfEntryPoint ), but I want to be able to find the offset in the PE exe file where the AddressOfEntryPoint is stored, programmatically.
I’ve read a lot about PE files here
But still can’t figure it out. Help needed
The offset of
AddressOfEntryPointwould be the sum of the size of the sections that precede it:sizeof(IMAGE_DOS_HEADER)+sizeof(DWORD)+sizeof(IMAGE_FILE_HEADER)+sizeof(WORD)+sizeof(BYTE)+sizeof(BYTE)+sizeof(DWORD)+sizeof(DWORD)+sizeof(DWORD)