I am trying to reverse a PE executable (challenge tutorial). I am putting a breakpoint on the first instruction of the program, at the entry point. There is nothing executed before.
I get a software breakpoint exception when I run the program. I think this is a debugger detection system. But I do not know where is the code that throws this exception, because I have not reach my program entry point.
The exception throws from ntdll.dll
I want to understand how can code from ntdll.dll
can be executed BEFORE the entry point of my binary
Thanks