{"id":105770,"date":"2021-10-06T07:00:00","date_gmt":"2021-10-06T14:00:00","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/oldnewthing\/?p=105770"},"modified":"2021-10-06T06:43:40","modified_gmt":"2021-10-06T13:43:40","slug":"20211006-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20211006-00\/?p=105770","title":{"rendered":"Why is the main()<\/CODE> function always at address 0x00401000 in a simple program?"},"content":{"rendered":"

If you compile a simple C or C++ program, and then load it into the debugger as a dump file (or if you execute the program with ASLR<\/a> disabled), you’ll find that the main<\/code> function is at offset 0x00401000<\/code>. What is so special about this address?<\/p>\n

It’s the result of multiple technical decisions that add together, literally.<\/p>\n

Your simple C or C++ program has only one function: main<\/code>. It is therefore the function at the start of your code section, and the address of the main<\/code> function is the address of the code section.<\/p>\n

Traditionally, the code section is the first section of a Windows Portable Executable file. There’s no technical reason for it, but somebody<\/i> has to go first, and code seems to be the natural choice since it’s almost always the most important part of the module. (“Primary reason for existence” in most cases.)<\/p>\n

Sections are page-aligned because each section specifies its protection, and memory protection is applied at the page level. Therefore, the offset of the code section must be a multiple of the page size, which for x86 is 4KB<\/a>.<\/p>\n

The page at offset zero contains the module header information.<\/p>\n

Therefore the first page available for the code section is the page at offset 0x1000<\/code>.<\/p>\n

The last piece of the puzzle is that 0x00400000<\/code> is the default base address for executables<\/a> on x86.<\/p>\n

Put all of these decisions together (some technical, some arbitrary), and you find that the address of the main()<\/code> function in a simple program is always 0x00401000<\/code>.<\/p>\n","protected":false},"excerpt":{"rendered":"

When multiple technical decision add up, literally.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[2],"class_list":["post-105770","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-history"],"acf":[],"blog_post_summary":"

When multiple technical decision add up, literally.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/105770","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=105770"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/105770\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=105770"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=105770"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=105770"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}