Initial Register values

[gigaman]

In my opinion - since the initial register values are "random", an application cannot rely on them. So, if you "define" the initial values for your tracer somehow (e.g. as zero), it should work - i.e. no application should see any difference from the real system.

As for the values in Olly - you can check other debuggers if the values will be the same (I'd guess not). Or, other operating systems...

I think it's OK that something is already pushed on stack. I believe it's done by the OS loader - either because of the way it works (how it passes the control from to loader to the real process code), or such that the process termination is handled easily (I mean - I know that there's an implicit return address to TerminateThread, together with the arguments, pushed by CreateThread to the newly created thread's stack; maybe CreateProcess, or the code below, does something similar for the process itself).