ESP law remove UPX 0.89.6-1.02/1.05-1.24-& amp;

Shell Detection

 

Load OD

 

00406BE0> $60 pushad; F8

00406BE1. BE 00604000 mov esi, 5-1upx.00406000; ESP

00406BE6. 8DBE 00B0FFFF lea edi, dword ptr ds: [esi-0x5000]

00406BEC. 57 push edi

00406BED. 83CD FF or ebp,-0x1

00406BF0. EB 10 jmp short 5-1upx.00406C02

 

ESP data window follow

 

Disconnection

 

Run F9

 

00406D38-E9 A3A4FFFF jmp 5-1upx.004011E0; disconnected here

 

F8 directly to OEP

 

Shell removal, storage, and shell check

 

You can see that there is no shell. Run it and check it out.

 

Haha, It's very harmonious, and even repair is free!