How to get the entry point of a child process?

Question

I created a child process from within my process with CreateProcess() (in C++) I then continue on using ReadProcessMemory to read through the memory and search for a specific something.

I would like to start my search from the entry point of that process , since the process is loaded into it's own virtual space I have no idea at this point how to find out the entry point for the code itself(I dont care about other sections of the PE file), I am aware of the 'AddressOfEntryPoint' field of the PE format and I already have it but since I have no idea at what address that process would be loaded how can I calculate the entry point itself?

to demonstrate what I want , if you open a process with OllyDbg for example you immediately reach the entry point for the code , I want to have that address

remember that this is a child process that I created if it helps

let me mention that I do not want to inject any code or DLL into that application the find out that address

Answer 1

I don't know exactly BUT...As far as i know can you finde the EntryPoint Address in the PE header of the .exe/.dll

or .... it is a fixed one

that's all i remenber

Answer 2

AddressOfEntryPoint is relative to image base address (ImageBase member of same IMAGE_OPTIONAL_HEADER struct). For executables image base is almost always whatever is set in PE header, since every executable has its own virtual address space.

In fact exes with stripped relocation sections can be loaded only at base that is in PE.

I'm not sure if there are exceptions and if it is possible to retrieve image base of running process...

Answer 3

Use PSAPI's GetModuleInformation with an HMODULE of NULL. This will give you executable's entry point as well as total size in memory (unfortunately, the base address is not set.)

Note that the entry point isn't necessarily the main() function - it is probably the CRT's entry point which in turn calls your main().

You can also use EnumProcessModules to get all modules in the process and their base addresses.