[hosiminh]

Hello

I have noticed that in many tutorials about MUP with OllyDbg (Manual unpacking) people use this method : press F7 until you see that ESP register has changed (become red) and then you right click on ESP and choose the Follow in Dump ->then you select some bytes and put
Breakpoint -> Hardware, on Access -> Word then press F9 (x times) and you are at OEP (original entry point)
This technique can be used with y0da's Crypter 1.x , Aspack 2.xx ,Virogen Crypt ... but not with Asprotect ,Armadillo ,SVKP .


I am asking i anyone know why put bp here on ESP (i know that means "Extended Stack Pointer") ; what exactly happen by putting bp on ESP ?