16 shells that can be detached from the ESP Law

Source: Internet
Author: User

First, let's talk about what is the ESP law-that is, to load the program and then run the first changed ESP value in a single step after F8, right-click the register, ESP follows in the transfer memory, select the first four in the memory address, right-click, breakpoint, hardware access, word F9, interrupt ,.....
(D 12ffc0 selects four hardware writes to dword) My other note

1. Aspcak method:
ESP + 6175 (Sb) POPAD JMP
2. UPX method:
S 0000 The First JMP
ESP + S (60E9)
0040EA0E 60 PUSHAD
0040EA0F-E9 B826FFFF JMP chap702.004010CC

3. PECompact 1.68-1.84
Or note that the first push xxxx + base address (400000) = EOP
4. The EZIP 1.0 method:
5. JDPack 1.x/JDProtect 0.9
ESP + S (6150)
0040E3F8 894424 1C mov dword ptr ss: [ESP + 1C], EAX
0040E3FC 61 POPAD
0040E3FD 50 PUSH EAX
0040E3FE C3 RETN
0040E3FF 23E8 and ebp, EAX
6. PE Package 1.0
ESP + S (61ff)
0040D26F 61 POPAD
0040D270 FFE0 JMP EAX
7. WWPack32 1.x
8. PEDiminisher 0.1
ESP + S (FFE0) or S (jmp eax)
0034708d 5D POP EBP
0034708e 5F POP EDI
0034708f 5E POP ESI
00417090 5A POP EDX
00417091 59 POP ECX
00417092 5B POP EBX
00417093-FFE0 JMP EAX
9. DxPACK V0.86
ESP + S (jmp eax or 61ffe0)
0040D163 61 POPAD
0040D164-FFE0 JMP EAX
10. PKLITE32 1.1
F8 5 times to EOP
11. 32 Lite 0.03a
Locate ESP
50c3 or PUSH EAX
003780F4 50 PUSH EAX
003780F5 C3 RETN
0041C53C FF96 84B50100 call dword ptr ds: [ESI + 1B584]
0041C542 61 POPAD
0041C543-E9 0848 ffff jmp qeditor.0020.d50
Note: first use LoadPE to store the shell file loaded by Olldbg, exit, run the shell file, and RecImport to fix the file crawled to DUMP by EOP.

12. VGCrypt PE Encryptor V0.75
ESP security 9 (starting from the breakpoint), address-1 = EOP

13. PC Shrinker 0.71
00142BA8 BA CC104000 mov edx, 4010CC
14. Petite2.2
1. D 12ffa0
3 F9
To EOP = address-1
2. ESP: Same as above
15. EXE Stealth2.72
ESP + S ()
0040D49F 8B9D B62F4000 mov ebx, dword ptr ss: [EBP + 402FB6]
0040D4A5 039D BA2F4000 add ebx, dword ptr ss: [EBP + 402FBA]
10 CC + 400000 = 4010cc in the stack to get the Oep of the notepad. oep of the shelling software.
0040D4AB C1CB 07 ror ebx, 7

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.