Question

There are disassemblers like CFF explorer which display the AddressOfEntryPoint of any executable along with the offset where it is stored. I know how to find that ( IMAGE_OPTIONAL_HEADER::AddressOfEntryPoint ), but I want to be able to find the offset in the PE exe file where the AddressOfEntryPoint is stored, programmatically.

页: 1

But still can t figure it out. Help needed

Answer 1

<<<><<><>>>>>>>>>>>>>>>>>>>>>>> 预设部分的大小:sizeof (IMAGE_DOS_HEADER)+sizeof(IMAGE_FILE_HEADER>+>sizeof(WORD)+/codesize(BY)>

Answer 2

参看“JosephH”写道:更正>/em> 回答,但回答根本不正确,根本不正确。

要求出口加工公司将档案作为双亲文件(并非都需要所有档案)。

因此,假定你有<代码>未签名的果园*数据;,其中注明了双亲信息。

IMAGE_DOS_HEADER* dosHeader = (IMAGE_DOS_HEADER *)data;                       //cast it to DOS header (some calls it MZ header)
IMAGE_NT_HEADERS* peHeader = (IMAGE_NT_HEADERS *)&data[dosHeader->e_lfanew];  //find NT header (PE header)
DWORD ep = 0;
if (peHeader->Magic == 0x10b)  //32-bit executable
    ep = ((IMAGE_NT_HEADERS32 *)peHeader)->OptionalHeader.AddressOfEntryPoint;  //Get EP
else  //64-bit executable
    ep = ((IMAGE_NT_HEADERS64 *)peHeader)->OptionalHeader.AddressOfEntryPoint;  //Get EP

我认为,我的答案较好,因为作更自我解释,你也不能相信会抵消,因为结构会改变时间。如你看见IMAGE_NT_HEADERS,我使用的是x86和x64机器的不同定义。

友情链接