Extract Process EntryPoint

//http://waleedassar.blogspot.com/   (@waleedassar)
//The undocumented ProcessImageInformation 0x25 of the "ZwQueryInformationProcess" function.

#pragma comment(linker,"/FIXED:NO")
#pragma comment(lib,"ntdll.lib")

struct PROCESS_IMAGE_INFORMATION
{
   unsigned long EntryPoint; //after relocation
   unsigned long unk1;
   unsigned long SizeOfStackReserve;
   unsigned long SizeOfStackCommit;

   unsigned short subsystem;
   unsigned short unk2;
   unsigned short MinorSubSystemVersion;
   unsigned short MajorSubsystemVersion;
   unsigned long unk3;
   unsigned short characteristics;
   unsigned short dll_characteristics;

   unsigned short machine;
   unsigned short flags;  //0x0400--->FLAG_IMAGE_RELOCATED 0x1---->???
   unsigned long LoaderFlags;
   unsigned long FileSize;  //on disk
   unsigned long Checksum;
};

extern "C"
{
    int __stdcall ZwQueryInformationProcess(HANDLE,int,PROCESS_IMAGE_INFORMATION*,unsigned long,int*);
}

int main(void)
{
    PROCESS_IMAGE_INFORMATION Q={0};
    ZwQueryInformationProcess(GetCurrentProcess(),0x25,&Q,sizeof(Q),0);
    printf("My Entrypoint is %X\r\n",Q.EntryPoint);
    return 0;
}