入口點的值的地址不同的PE Explorer和UltraEdit的

Question

我寫了一個基本helloworld.exe與下用簡單的線printf("helloworld!\n");

然後我用的UltraEdit查看EXE文件的字節，並還用於PE Explorer來看標題值。當涉及入口點地址時，PE資源管理器顯示0x004012c0。

Magic       010Bh PE32 
Linker Version     1902h 2.25 
Size of Code     00008000h 
Size of Initialized Data  0000B000h 
Size of Uninitialized Data 00000C00h 
Address of Entry Point  004012C0h 
Base of Code     00001000h 
Base of Data     00009000h 
Image Base     00400000h

但在UltraEdit我看0x000012c0魔0x010B後，計算16個字節後。

3F 02 00 00 E0 00 07 03 0B 01 02 19 00 80 00 00 
00 B0 00 00 00 0C 00 00 C0 12 00 00 00 10 00 00 
00 90 00 00 00 00 40 00 00 10 00 00 00 02 00 00 
04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 
00 10 01 00 00 04 00 00 91 F6 00 00 03 00 00 00 
00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 
00 E0 00 00 C0 06 00 00 00 00 00 00 00 00 00 00

哪一個是正確的？

Answer 1

簡單地讀取關於IMAGE_OPTIONAL_HEADER結構

AddressOfEntryPoint

的指針入口點函數，相對到圖像基 地址。對於可執行文件，這是起始地址。對於 設備驅動程序，這是初始化函數的地址。 入口點函數對於DLL是可選的。當沒有入口點是 存在時，該成員爲零。

所以絕對EntryPoint地址是AddressOfEntryPoint ? ImageBase + AddressOfEntryPoint : 0

你的情況 AddressOfEntryPoint == 12c0

和ImageBase == 400000

爲EntryPoint結果絕對地址是12c0+400000==4012c0