IDA Strange exception before code is executed

Question

I am trying to reverse a PE executable (challenge tutorial). I am putting a breakpoint on the first instruction of the program, at the entry point. There is nothing executed before.

I get a software breakpoint exception when I run the program. I think this is a debugger detection system. But I do not know where is the code that throws this exception, because I have not reach my program entry point.

The exception throws from ntdll.dll I want to understand how can code from ntdll.dll can be executed BEFORE the entry point of my binary

Thanks

Answer 1

One thing that runs before the entrypoint is TLS callbacks, so check if your binary has them.

Answer 2

no offense intended but this question demonstrates some basic lack of understanding of how windows loads user-mode processes, how how user-mode code and executables are built.

I'll list a few missing pieces:

1. As Igor mentioned, TLS callbacks are often called before the entry point is executed and are used to setup tasks before any code is executed (global object constructors is one example). TLS callbacks are occasionally used by the compiler for certain tasks as well as in a set of anti-debugging techniques.
2. When a usermode process starts, its first executed instruction is NOT the executable's entry point. There's a decent amount of loader code executed in the context of the created process (initializing the default heap, setting up parts of the TEB and PEB, etc).
3. Normally, an executable's entry point is not your int main(int argc, char* argv[]). The compiler has a wrapper function that is where the PE's entrypoint points to, and main is only called by it.

I would suggest you read the Peering Inside the PE, as it describes those processes really in-depth.