.I was unpacking UPX with Olly and searched for POPAD instruction with ctrl+f. There is two POPADs in the code and I get different result depending on whether I check the "search entire block" or not. It seems that to find the correct POPAD after which the program jumps to OEP one must leave "search entire block" unchecked. What is actually the logig behind "search entire block", how does Olly perform search with different options?
![[+] expand](/imagery/files/soysauce_blueprint.gif){kind=link}