Search code examples
winapilinkerbinaryfilesportable-executable

Why is the entry point address of a 64 bit portable executable only 32 bits?


According to the definitions of _IMAGE_OPTIONAL_HEADER and _IMAGE_OPTIONAL_HEADER64, the AddressOfEntryPoint is a 32 bit DWORD for both PE32 and PE64 file formats.

Why is the AddressOfEntryPoint for a PE64 file only 32 bits? Shouldn't it be 64 bits to cover the entire virtual address space?


Solution

  • The documentation to which you link says:

    A pointer to the entry point function, relative to the image base address.

    Being relative to the base address, this means that the image can be located anywhere in the address space.

    This does indirectly imply that the entry point cannot have an offset from the base address of more than 4GB, but that is no limitation. A PE image cannot be larger than 4GB in size for other reasons. For instance, SizeOfImage is a DWORD which implies a limit on image size of 4GB.