Question

Once Windows has loaded an executable in memory and transfert execution to the entry point, do values in registers and stack are meaningful? If so, where can I find more informations about it?

Answer 1

Officially, the registers at the entry point of PE file do not have defined values. You’re supposed to use APIs, such as GetCommandLine to retrieve the information you need. However, since the kernel function that eventually transfers control to the entry point did not change much from the old days, some PE packers and malware started to rely on its peculiarities. The two more or less reliable registers are:

• EAX points to the entry point of the application (because the kernel function uses call eax to jump to it)

• EBX points to the Process Environment Block (PEB).