Record of one PECompact 2.x-& amp; gt; Jeremy Collake shell Removal

A small software:

Show YesPECompact 2.x-> Jeremy CollakeI found an article on the internet saying thatESPThe law is shelled, so I tried it myself.

ODLoad:

F8One step:Push dword ptr fs: [0]HourESPChange0012FFC0

Right-click->Right-click the data window->Breakpoint->Hardware access-> DWORDNext hardware access breakpoint

F9Run:

Cancel hardware breakpoint, F8One step:

At this time, the jump is not implemented: Right-click--->Follow:

Then:F4ToPUSH EDIJump:

In this caseESPIs:0012FFC0 F8Single Step

InLea ebx, dword ptr ds: [EAX + 100012]Run the command again.ESPRecorded:

One stepJMP EAXAnd reachableOEP

UseODBuilt-in plug-ins can be shelled.