title: How do get the (relocated) entry point of an executable participating in ASLR on Windows?
body: <blockquote>
    <p>How do get the (relocated) entry point of an executable participating in ASLR on Windows?</p>
  </blockquote>
  
  <p>Suppose the executable has been loaded and that it participates in ASLR.</p>
  
  <p>The PE header gives the executable's entry point when loaded without ASLR. However, ASLR should be "random", so the header cannot tell anything about the new entry point?</p>
  
  <p>How would I locate my ASLR executable in memory, so that, e.g., I can inspect it and (possible) modify it.</p>