I am trying to reverse a PE executable (challenge tutorial). I am putting a breakpoint on the first instruction of the program, at the entry point. There is nothing executed before. I get a software breakpoint exception when I run the program. I think this is a debugger detection system. But I do not know where is the code that throws this exception, because I have not reach my program entry point. The exception throws from ntdll.dll I want to understand how can code from ntdll.dll can be executed BEFORE the entry point of my binaryThanks
IDA Strange exception before code is executed
ida;pe
One thing that runs before the entrypoint is TLS callbacks, so check if your binary has them.