|
ghm. just place CC there, and when debugger stops- take a look at the stack - if there is a kernel32 or ntdll addresses then it is seems to be entrypoint. you also can refer to the PE file format. Moreover i've heard that in dll for example exists "Static objects" that creaed before execution reaches entrypoint, so you can try to dig this way.
|