I am currently looking at a packed binary that modifies the .text and other sections on startup. The sections in question are empty when stored on disk (only a non-zero virtual size).

Interestingly, the application seems to unpack itself at a very early point of execution. I've set all possible breakpoints in the OllyDBG menu (thread create, TLS callbacks, DLL entry, etc.), and the first BP that hits when running the application is a thread entry. At that point the instructions in .text are already present.

My question is where the unpacking could happen before all of the above-mentioned steps, and how I could find the location of the code that is responsible for the unpacking?

1 Answer 1


Have you tried setting a hardware watchpoint on the address of the section being unpacked ? The debugger will stop when this address is being accessed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.