Interpreting Executable Base Addresses

Last reviewed: October 10, 1997
Article ID: Q101187

3.10 3.50 3.51 | 4.00

WINDOWS NT     | WINDOWS

kbtool

The information in this article applies to:

Microsoft Win32 Software Development Kit (SDK), versions 3.1, 3.5, 3.51, and 4.0

LINK.EXE and DUMPBIN.EXE (from Visual C++ 32-bit edition) can be used to dump the portable executable (PE) header of an executable file. Below is a fragment of a dump:

   7300 address of entry point
   7000 base of code
   B000 base of data
        ----- new -----
   10000 image base

The "image base" value of 10000 is the address where the program begins in memory. The value associated with "base of code," "base of data," and "address of entry point" are all offsets from the image base.

Additional reference words: 3.10 3.50 4.00 95
KBCategory: kbtool
KBSubcategory: TlsMisc

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

Last reviewed: October 10, 1997
© 1998 Microsoft Corporation. All rights reserved. Terms of Use.