Search code examples
exeportable-executableentry-point

How to find offset of Dword where Address Of entry point of an executable is stored

There are disassemblers like CFF explorer which display the AddressOfEntryPoint of any executable along with the offset where it is stored. I know how to find that ( IMAGE_OPTIONAL_HEADER::AddressOfEntryPoint ), but I want to be able to find the offset in the PE exe file where the AddressOfEntryPoint is stored, programmatically.

I've read a lot about PE files here

But still can't figure it out. Help needed

Solution

  • The offset of AddressOfEntryPoint would be the sum of the size of the sections that precede it: sizeof(IMAGE_DOS_HEADER)+sizeof(DWORD)+sizeof(IMAGE_FILE_HEADER)+sizeof(WORD)+sizeof(BYTE)+sizeof(BYTE)+sizeof(DWORD)+sizeof(DWORD)+sizeof(DWORD)