Microsoft KB Archive/101187

From BetaArchive Wiki

Interpreting Executable Base Addresses

Q101187



The information in this article applies to:


  • Microsoft Win32 Software Development Kit (SDK), versions 3.1, 3.5, 3.51, 4.0





SUMMARY

LINK.EXE and DUMPBIN.EXE (from Visual C++ 32-bit edition) can be used to dump the portable executable (PE) header of an executable file. Below is a fragment of a dump:

   7300 address of entry point
   7000 base of code
   B000 base of data

        ----- new -----

   10000 image base 

The "image base" value of 10000 is the address where the program begins in memory. The value associated with "base of code," "base of data," and "address of entry point" are all offsets from the image base.

Additional query words: 3.10 3.50 4.00 95

Keywords :
Issue type :
Technology : kbWin32SDKSearch kbAudDeveloper kbSDKSearch kbWin32sSearch kbWin32SDK400 kbWin32SDK310 kbWin32SDK350 kbWin32SDK351


Last Reviewed: January 16, 2000
© 2001 Microsoft Corporation. All rights reserved. Terms of Use.