I have found problem with finding file offset which actually is program entry point.In case I experience problem, value of AddressOfEntryPoint is 0x1018. Here is a section which maps this address.I assume entry point should be 0x28 = 0x10 + 0x1018 - 0x1000 (PointerToRawData + AddressOfEntryPoint - VirtualAddress)However tools says it is 0x18 instead. I'm not sure why, made some experiments and came up with another formula. 0x18 = (0x10 / 0x200) * 0x200 + 0x1018 - 0x1000 ((PointerToRawData / FileAlignment) * FileAlignment + AddressOfEntryPoint - VirtualAddress)I use FileAlignment from OptionalHeader and it works great, however I don't know if it is a coincidence or somewhere documented, so asking here for confirmation.Also, probably not important, but file is packed with UPack(0.399), packer signature BE****AD50FF7634EB7C4801.
Problem with entry point detection as a file offset
pe;entry point
From https://code.google.com/p/corkami/wiki/PE#PointerToRawData --if a section's physical start is lower than 200h (the lower limit for  standard alignment), it is rounded down to 0.Thus, the entry point's physical offset would be:0x00000018 = 0x00000000 + 0x00001018 - 0x00001000 (PointerToRawData_rounded_down + AddressOfEntryPoint - VirtualAddress)