for me, it is sometimes difficult to decide if I have hit the OEP when I try to manuelly unpack it. Especially in cases, when it does not begin with the standard function prologue.
For example: I have found a following sample which starts with a PUSHAD instruction. I step through the content of code until I reach POPAD. After few lines, I have seen a JMP intruction which leads to a CALL instruction and a function is called. After stepping over that function, in the next line, there is another JMP instruction which ends up here:
PUSH 58 PUSH unbr002.014A22F8 CALL unbr002.013CBD40# XOR ESI, ESI MOV DWORD PTR SS:[EBP-4], ESI LEA EAX, DWORD PTR SS:[EBP-68] PUSH EAX CALL DWORD PTR DS:[141409C] kernel32.GetStartupInfoA .... .... .... .... POP ECX CALL DWORD PTR DS: kernel32.GetCommandLineA ....
So, I have read somewhere that "GetCommandLineA – indicating you’ve hit the entrypoint of a program compiled with visual studio 6"
and I asked myself if there is a list of indicators to know if one has hit the OEP.