I am trying to reverse a PE executable (challenge tutorial). I am putting a breakpoint on the first instruction of the program, at the entry point. There is nothing executed before.
I get a software breakpoint exception when I run the program. I think this is a debugger detection system. But I do not know where is the code that throws this exception, because I have not reach my program entry point.
The exception throws from
ntdll.dll I want to understand how can code from
ntdll.dll can be executed BEFORE the entry point of my binary