windows 关于PE在Windows中的入口点
声明:本页面是StackOverFlow热门问题的中英对照翻译,遵循CC BY-SA 4.0协议,如果您需要使用它,必须同样遵循CC BY-SA许可,注明原文地址和作者信息,同时你必须将它归于原作者(不是我):StackOverFlow
原文地址: http://stackoverflow.com/questions/3745672/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
About the entry point of PE in Windows
提问by COMer
Is it always at the lowest address of code section?
它总是在代码段的最低地址吗?
回答by Chris Schmich
No, not necessarily. The PE entry point is defined in the IMAGE_OPTIONAL_HEADERstructure, in the AddressOfEntryPoint
field:
不,不一定。PE 入口点定义在IMAGE_OPTIONAL_HEADER结构的AddressOfEntryPoint
字段中:
A pointer to the entry point function, relative to the image base address. For executable files, this is the starting address. For device drivers, this is the address of the initialization function. The entry point function is optional for DLLs. When no entry point is present, this member is zero.
指向入口点函数的指针,相对于图像基地址。对于可执行文件,这是起始地址。对于设备驱动程序,这是初始化函数的地址。入口点函数对于 DLL 是可选的。当不存在入口点时,该成员为零。
A linker can set this to be whatever it wants to be, as long as its a valid relative virtual offset into the PE. Some compilers and linkers might have the convention of putting the entry point at the beginning of the text/code section, but there's no OS or PE format requirement for it.
链接器可以将其设置为任何它想要的值,只要它是 PE 中的有效相对虚拟偏移量即可。一些编译器和链接器可能习惯于将入口点放在文本/代码部分的开头,但没有 OS 或 PE 格式要求。