Hands-pecompact 2.x-> Jeremy collake

Manual -- pecompact 2.x-> Jeremy collake
Peid: pecompact 2.x-> Jeremy collake
The shell removal tool has a dedicated shell removal tool, which is used as a trainer here.
Od load and shell program.
Entry Point: --- this is strange. If you leave F8, it will fly when you reach 00401016.
1. Ignore all exceptions first.
2. Line F8 in two steps. The ESP law can be used here.
00401000> B8 dc2b4100 mov eax, rcrawler.00412bdc
00401005 50 push eax
00401006 64: ff35 0000000> push dword ptr fs: [0]
0040100d 64: 8925 0000000> mov dword ptr fs: [0], ESP
00401014 33c0 XOR eax, eax
00401016 8908 mov dword ptr ds: [eax], ECx
00401018 50 push eax
00401019 45 Inc EBP
0040101a 43 Inc EBX
0040101b 6f outs dx, dword ptr es: [EDI]; I/O command
0040101c 6D ins dword ptr es: [EDI], DX; I/O command
0040101d 70 61 Jo short adler32c. 00401080

After the ESP Law -- cancel the breakpoint -- it's here
7c968f86 3b45 F8 CMP eax, dword ptr ss: [EBP-8]
7c968f89 72 05 JB short ntdll.7c968f90
7c968f8b 3b45 F4 CMP eax, dword ptr ss: [EBP-C]
7c968f8e 72 64 JB short ntdll.7c968ff4
7c968f90 50 push eax
7c968f91 E8 fdfdffff call ntdll.7c968d93
7c968f96 84c0 test Al, Al
7c968f98 74 5A je short ntdll.7c968ff4
7c968f9a f605 fab6997c 8> test byte ptr ds: [7c99b6fa], 80
7c968fa1 ^ 0f85 7 afdffff jnz ntdll.7c968d21

Alt + m to memory find the lower part of the code segment and then F9
Here>
00412bf1 c602 E9 mov byte ptr ds: [edX], 0e9
00412bf4 83c2 05 add edX, 5
00412bf7 2bca sub ECx, EDX
00412bf9 894a FC mov dword ptr ds: [EDX-4], ECx
00412bfc 33c0 XOR eax, eax
00412bfe C3 retn

A few f8.> here we can use the ESP law.
7c923f17 64: 8b25 0000000> mov ESP, dword ptr fs: [0]
7c923f1e 64: 8f05 0000000> pop dword ptr fs: [0]
7c923f25 8be5 mov ESP, EBP
7c923f27 5d pop EBP
7c923f28 C2 1400 retn 14

Click Here> cancel the breakpoint> the OEP entry point is displayed below.
00412c0f 53 push EBX
00412c10 51 push ECx
00412c11 57 push EDI
00412c12 56 push ESI
00412c13 52 push edX
00412c14 8d98 57120010 Lea EBX, dword ptr ds: [eax + 10001257]
00412c1a 8b53 18 mov edX, dword ptr ds: [EBX + 18]
00412c1d 52 push edX
00412c1e 8be8 mov EBP, eax
00412c20 6a 40 push 40
00412c22 68 00100000 push 1000
00412c27 ff73 04 push dword ptr ds: [EBX + 4]
00412c2a 6a 00 push 0
00412c2c 8b4b 10 mov ECx, dword ptr ds: [EBX + 10]
00412c2f 03ca add ECx, EDX
00412c31 8b01 mov eax, dword ptr ds: [ECx]
00412c33 ffd0 call eax
00412c35 5A pop edX
00412c36 8bf8 mov EDI, eax
00412c38 50 push eax
00412c39 52 push edX
00412c3a 8b33 mov ESI, dword ptr ds: [EBX]
00412c3c 8b43 20 mov eax, dword ptr ds: [EBX + 20]
00412c3f 03c2 add eax, EDX
00412c41 8b08 mov ECx, dword ptr ds: [eax]
00412c43 894b 20 mov dword ptr ds: [EBX + 20], ECx
00412c46 8b43 1C mov eax, dword ptr ds: [EBX + 1C]
00412c49 03c2 add eax, EDX
00412c4b 8b08 mov ECx, dword ptr ds: [eax]
00412c4d 894b 1C mov dword ptr ds: [EBX + 1C], ECx
00412c50 03f2 add ESI, EDX
00412c52 8b4b 0C mov ECx, dword ptr ds: [EBX + C]
00412c55 03ca add ECx, EDX
00412c57 8d43 1C Lea eax, dword ptr ds: [EBX + 1C]
00412c5a 50 push eax
00412c5b 57 push EDI
00412c5c 56 push ESI
00412c5d ffd1 call ECx
00412c5f 5A pop edX
004126058 pop eax
00412c61 0343 08 add eax, dword ptr ds: [EBX + 8]
00412c64 8bf8 mov EDI, eax
00412c66 52 push edX
00412c67 8bf0 mov ESI, eax
00412c69 8b46 FC mov eax, dword ptr ds: [ESI-4]
00412c6c 83c0 04 add eax, 4
00412c6f 2bf0 sub ESI, eax
00412c71 8956 08 mov dword ptr ds: [ESI + 8], EDX
00412c74 8b4b 0C mov ECx, dword ptr ds: [EBX + C]
00412c77 894e 14 mov dword ptr ds: [ESI + 14], ECx
00412c7a ffd7 call EDI
00412c7c 8985 3f130010 mov dword ptr ss: [EBP + 1000133f], eax
00412c82 8bf0 mov ESI, eax
00412c84 8b4b 14 mov ECx, dword ptr ds: [EBX + 14]
00412c87 5A pop edX
00412c88 EB 0C JMP short rcrawler.00412c96
00412c8a 03ca add ECx, EDX
00412c8c 68 00800000 push 8000
00412c91 6a 00 push 0
00412c93 57 push EDI
00412c94 ff11 call dword ptr ds: [ECx]
00412c96 8bc6 mov eax, ESI
00412c98 5A pop edX
00412c99 5E pop ESI
00412c9a 5f pop EDI
00412c9b 59 pop ECx
00412c9c 5B pop EBX
00412c9d 5d pop EBP
00412c9e ffe0 JMP eax

When you see this address, you can jump to> OEP portal F8
Okay, this is OEP. -- dump it out.
00408bc8 55 push EBP
00408bc9 8bec mov EBP, ESP
00408bcb 83c4 F0 add ESP,-10
00408bce 53 push EBX
00408bcf B8 708b4000 mov eax, rcrawler.00408b70
00408bd4 E8 8fb9ffff call rcrawler.00404568

Friendly reminder: An invalid pointer will be generated after shell removal using this method. The function name for fixing invalid pointers is getprocaddress module: kernel32.dll.

1 00010000e0 kernel32.dll 00f1 freelibrary
0 0001_e4? 0000 003a0148 // the pointer is invalid here
1 00010000e8 kernel32.dll 01df getversionexa