O'Reilly logo
  • Alan McBee thinks this is interesting:

the AddressOfEntryPoint field


Cover of Advanced .NET Debugging


Not always at this location. The headers are read dynamically, and the location of this field varies depending on the versions of the headers that are used. I found that modern hex editors (my favorite is Hex Editor Neo) can use the structure files from the Windows SDK to parse the PE headers. Alternately, you can use the dumpbin.exe utility in the Windows SDK (included with Visual Studio) to view the headers for a PE file.