How to find a (PE)Executable entry point in RAW memory?
<p>I'm working on a ASM project amd I want to know a portable executable program's entry point in raw memory. By raw memory I mean static memory like if I was editing the raw .exe file with a hex editor. From the program's PE table I can look for the entry called "EntryPoint:" but that entry contains the program's entry point once its loaded in memory! I need to find where the program is going to look for the first instructions in raw memory, in the disk. Some programs start their execution at the first address of the .text section, it is very usual but not always happens, thats why I want to know the entry point.</p>

<p>For working with that, I'm using the function MapViewOfFile from the windows API and loading an example.exe program in memory, then looking for its raw content.</p>

<p>I'm currently working with MASM using Radasm</p>

<p>thanks !</p>