this is my first post on this forum even though im reading alot here.
Im trying to get into reversing and Low-Level stuff in general lately, and im a bit stuck right here.
I did read alot about the PE-File Format and how virtual memory and loading exes into the memory works. Right now im just reversing/debugging a simple HelloWorld written in C++ to understand whats going on.
Im just looking at it with radare2 and dont really understand what radare does when it opens a file. I thought its like a hexeditor with additional functionality like disassembly and detecting functions and more. But when im going to address 0x0 in radare2 it doesnt match 0x0 when i look at the file in my hexeditor. More precicly radare2 does seem to set everything apart from a certain area around entry0 to be 0xff.
So my guess is that radare2 is trying to show how the file would look like if its loaded in memory with resolved tables for imported functions and stuff.
The thing is im not really sure what im supposed to google to verify this. Thats why im asking here.
If someone could give me a little bit of insight on what is going on there would make my day. ;)
Thanks in advance.