This trick was discovered accidentally.
When I was trying to put format PE64 GUI at 100000000h, my daughter disturbed me, so I let there only 000000h
fdbg0017 wasn't able to put SW_BP at start !!!
this is because ImageBase is at offset 10000h and start is at 11000h
CREATE_PROCESS returns start address at 1000h so fdbg0017 tried to set breakpoint at 1000h which of course failed, it was in m$ reserved memory...

unfortunatelly, only 0 makes exe executable, values 0<value<10000h do error executing program...
but at least 0 passed on win2003 server x64 SP1...

N.B.
RAMBO -> IsDebuggerPresent fight must not be enabled before loading such file, this feature may be enabled only later after loading the file into debugger finishes, see a02.asm
