CODEWITHSUNDEEP
executabledisassembly
JoSch
JoSch

Reputation: 21

How to find out where the main function in an .exe file is?

I created a simple .exe file that just assigns a value of 3 to an integer called "x" and then prints out that value.Here is a picture of the source code:

source code

I opened the .exe file with an hex editor(named HxD) and used the disassembly function of Visual Studio 2017 to show me the opcodes of my main function. After a bit of search i found out that the main function is stored in the file at Offset 0xC10

Here is the disassembly:disassembly

And here is the file in the Hex-Editor:hexadecimal view of .exe file

I know that some values of the .exe file in the hex editor vary from what the visual studio debugger says but i know that the main starts there because i changed the value of x in the hex editor and then when i started the .exe it printed out another value instead of the 3. My question is where in the .exe file is the value that says:"At that point of the file start the opcodes of the main function."

For example in a .bmp file the 4 bytes at positions 0x0A,0x0B,0x0C and 0x0D tell you the offset of the first byte of the first pixel.

Upvotes: 1

Views: 3620

Answers (2)

zx485
zx485

Reputation: 29052

On Windows, the entry point of an executable (.exe) is set in the PE Header of the file.

WikiPedia illustrates the structure of this header like this (SVG file).

Relative to the beginning of the file, the PE Header starts at the position indicated at the address

DWORD 0x3C Pointer to PE Header

      File Header / DOS Header
     +--------------------+--------------------+
0000 |  0x5A4D  |         |                    |
0008 |                    |                    |
0010 |                    |                    |
0018 |                    |                    |
0020 |                    |                    |
0028 |                    |                    |
0030 |                    |                    |
0038 |                    | PE Header addr     |
0040 |                    |                    |
.... | .................. | .................. |

And the entry point is designated at the position (relative to the address above)

DWORD 0x28 EntryPoint

      PE Header
     +--------------------+--------------------+
0000 | Signature          | Machine | NumOfSect|
0008 | TimeDateStamp      | PtrToSymTable      |
0010 | NumOfSymTable      |SizOfOHdr| Chars    |
0018 | Magic   | MJV| MNV | SizeOfCode         |
0020 | SizeOfInitData     | SizeOfUnInitData   |
0028 | EntryPoint (RVA)   | BaseOfCode (RVA)   |
0030 | BaseOfData (RVA)   | ImageBase          |
0038 | SectionAlignment   | FileAlignment      |
0040 | ...                | ...                |

from the beginning of the PE Header. This address is a RVA (Relative Virtual Address) what means that it is relative to the Image Base address that the file is loaded to by the loader:

Relative virtual addresses (RVAs) are not to be confused with standard virtual addresses. A relative virtual address is the virtual address of an object from the file once it is loaded into memory, minus the base address of the file image.

This address is the address of the main function.

Upvotes: 2

Tyler Marshall
Tyler Marshall

Reputation: 488

A .exe is a portable executable.

Layout

Structure of a Portable Executable 32 bit A PE file consists of a number of headers and sections that tell the dynamic linker how to map the file into memory. An executable image consists of several different regions, each of which require different memory protection; so the start of each section must be aligned to a page boundary.[4] For instance, typically the .text section (which holds program code) is mapped as execute/readonly, and ...

So really it is a question of where the .text section is in the file. Exactly where depends on the headers and locations of the other sections.

Upvotes: 1

Related Questions