I'm in a situation where I have an executable file. When I start it within the debugger (x32dbg), with breakpoints set to every occasion (DLL entry, DLL load, Thread start,..), to restrict the amount of actions that get executed right after the file is ran,
in the dump I see some bytes which are different from those at the same location in the exe file.
My thought is it has something to do with dynamic linking of some sort. The values change when: the exe is saved(EVEN WITH THE EXACTLY SAME CONTENT AS BEFORE) and ran. Thus the offset where the code is placed and the specific bytes are recalculated. The only thing that loads, however, is ntdll.dll an then the first breakpoint is hit. So I guess the content of the exe is copied to the ram, that time is everything allright, then the magic part happens, where the subroutine or what knows what bytes to change and it changes them, and then the debugger gets the control.