入口点的值的地址不同的PE Explorer和UltraEdit的

Question

我写了一个基本helloworld.exe与下用简单的线printf("helloworld!\n");

然后我用的UltraEdit查看EXE文件的字节，并还用于PE Explorer来看标题值。当涉及入口点地址时，PE资源管理器显示0x004012c0。

Magic       010Bh PE32 
Linker Version     1902h 2.25 
Size of Code     00008000h 
Size of Initialized Data  0000B000h 
Size of Uninitialized Data 00000C00h 
Address of Entry Point  004012C0h 
Base of Code     00001000h 
Base of Data     00009000h 
Image Base     00400000h

但在UltraEdit我看0x000012c0魔0x010B后，计算16个字节后。

3F 02 00 00 E0 00 07 03 0B 01 02 19 00 80 00 00 
00 B0 00 00 00 0C 00 00 C0 12 00 00 00 10 00 00 
00 90 00 00 00 00 40 00 00 10 00 00 00 02 00 00 
04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 
00 10 01 00 00 04 00 00 91 F6 00 00 03 00 00 00 
00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 
00 E0 00 00 C0 06 00 00 00 00 00 00 00 00 00 00

哪一个是正确的？

Answer 1

简单地读取关于IMAGE_OPTIONAL_HEADER结构

AddressOfEntryPoint

的指针入口点函数，相对到图像基 地址。对于可执行文件，这是起始地址。对于 设备驱动程序，这是初始化函数的地址。 入口点函数对于DLL是可选的。当没有入口点是 存在时，该成员为零。

所以绝对EntryPoint地址是AddressOfEntryPoint ? ImageBase + AddressOfEntryPoint : 0

你的情况 AddressOfEntryPoint == 12c0

和ImageBase == 400000

为EntryPoint结果绝对地址是12c0+400000==4012c0