I was playing around with tutorials/white papers concerning unpacking, specifically UPX. As Olly 2.01 is my debugger of choice, I attempted to unpack an UPX-packed exe with it and to my surprise, it looks as though it fails to break where it should.
With Olly 1.10, the execution will stop twice:
1) First in ntdll
2) Then the well known PUSHAD instruction in the actual module:
The JMP visible above will jump to the unpacked code:
This is the kind of behavior I'd expect. However, Olly 2.01 with the same settings (break at "Entry point of main module") will stop at this jump instead:
Which, if followed, will immediately bring us to the unpacked code:
Additionally, the bytes preceding the JMP in both cases seem to differ, as do the addresses, suggesting this is actually a different piece of code.
What is happening? Is Olly 2.01 actually "smarter", recognizing the packer and stopping at the unpacked OEP? Also, why are the JMPs to unpacked code different (as stated above, different instructions before them and different addresses)?