Restoring the stack is usually quicker to do than the previous two techniques, but it is much less reliable. The idea here is that some packers keep the stack in order and transfer control to the unpacked sample when it has the same stack level that they started with. What that means is that it will access the value located at the address that was originally pointed by the frame pointer register (ebp/rbp), minus one value of a size of the address length for the selected architecture (for example, a 4-byte DWORD for a 32-bit platform) just before transferring control to the unpacked code, even when using the jmp instruction.
In this case, it is possible to set a breakpoint on access to the [ebp-4] value while staying at the entry point of the sample and then executing it so that the breakpoint will hopefully trigger just before transferring control to the unpacked code. Often, this happens when the packer restores the registers to the original...
