Manual unpacking ESP hardware breakpoint

[Michel]

Very often procedures are started by this patern :

PUSH EBP
MOV EBP,ESP
............

This is done in order to have the possibility to index the arguments (sample : MOVE EAX,[EBP-4]) even if ESP is moving.

So, when you break on EBP, you have some chance to go near the beginning of some procedure.

But if you break on ESP as you says, I think you go directly into hell... try it