How does a PE file get mapped into memory?
问题 So I have been reasearching the PE format for the last couple days, and I still have a couple of questions Does the data section get mapped into the process' memory, or does the program read it from the disk? If it does get mapped into its memory, how can the process aqquire the offset of the section? ( And other sections ) Is there any way the get the entry point of a process that has already been mapped into the memory, without touching the file on disk? 回答1: Does the data section get