Video: What breakpoints to set for unpacking

If you want to unpack samples with a debugger, how do you know which breakpoints I need to set?

Using debugger and breakpoints is a common way to unpack samples. Many reversers like it because it is flexible and you do not need to know every detail of how the unpacking stub works.

But there is rarely an explanation how to approach this methodically, because most reversers have learnt it the hard way: They have unpacked so many samples that they intuitively navigate with the debugger. Their gut knows what to do. So if they want to explain unpacking to others, they often lack concepts to describe it generically. They may say: "Just get your hands dirty"

But there is a way, and that's what you will see in the following video.