16 shells that can be detached from the ESP Law

First, let's talk about what is the ESP law-that is, to load the program and then run the first changed ESP value in a single step after F8, right-click the register, ESP follows in the transfer memory, select the first four in the memory address, right-click, breakpoint, hardware access, word F9, interrupt ,.....
(D 12ffc0 selects four hardware writes to dword) My other note

1. Aspcak method:
ESP + 6175 (Sb) POPAD JMP
2. UPX method:
S 0000 The First JMP
Variant
ESP + S (60E9)
0040EA0E 60 PUSHAD
0040EA0F-E9 B826FFFF JMP chap702.004010CC

3. PECompact 1.68-1.84
ESP
Or note that the first push xxxx + base address (400000) = EOP
4. The EZIP 1.0 method:
ESP
5. JDPack 1.x/JDProtect 0.9
ESP + S (6150)
0040E3F8 894424 1C mov dword ptr ss: [ESP + 1C], EAX
0040E3FC 61 POPAD
0040E3FD 50 PUSH EAX
0040E3FE C3 RETN
0040E3FF 23E8 and ebp, EAX
6. PE Package 1.0
ESP + S (61ff)
0040D26F 61 POPAD
0040D270 FFE0 JMP EAX
7. WWPack32 1.x
ESP
8. PEDiminisher 0.1
ESP + S (FFE0) or S (jmp eax)
0034708d 5D POP EBP
0034708e 5F POP EDI
0034708f 5E POP ESI
00417090 5A POP EDX
00417091 59 POP ECX
00417092 5B POP EBX
00417093-FFE0 JMP EAX
9. DxPACK V0.86
ESP + S (jmp eax or 61ffe0)
0040D163 61 POPAD
0040D164-FFE0 JMP EAX
10. PKLITE32 1.1
F8 5 times to EOP
11. 32 Lite 0.03a
Locate ESP
PUSH EAX
50c3 or PUSH EAX
003780F4 50 PUSH EAX
003780F5 C3 RETN
Coming
0041C53C FF96 84B50100 call dword ptr ds: [ESI + 1B584]
0041C542 61 POPAD
0041C543-E9 0848 ffff jmp qeditor.0020.d50
Note: first use LoadPE to store the shell file loaded by Olldbg, exit, run the shell file, and RecImport to fix the file crawled to DUMP by EOP.

12. VGCrypt PE Encryptor V0.75
ESP security 9 (starting from the breakpoint), address-1 = EOP

13. PC Shrinker 0.71
ESP
00142BA8 BA CC104000 mov edx, 4010CC
00142BAD FFE2 JMP EDX
14. Petite2.2
1. D 12ffa0
3 F9
To EOP = address-1
2. ESP: Same as above
15. EXE Stealth2.72
ESP + S ()
0040D49F 8B9D B62F4000 mov ebx, dword ptr ss: [EBP + 402FB6]
0040D4A5 039D BA2F4000 add ebx, dword ptr ss: [EBP + 402FBA]
10 CC + 400000 = 4010cc in the stack to get the Oep of the notepad. oep of the shelling software.
0040D4AB C1CB 07 ror ebx, 7