I am currently looking at a packed binary that modifies the .text and other sections on startup. The sections in question are empty when stored on disk (only a non-zero virtual size).
Interestingly, the application seems to unpack itself at a very early point of execution. I've set all possible breakpoints in the OllyDBG menu (thread create, TLS callbacks, DLL entry, etc.), and the first BP that hits when running the application is a thread entry. At that point the instructions in .text are already present.
My question is where the unpacking could happen before all of the above-mentioned steps, and how I could find the location of the code that is responsible for the unpacking?
