Note:writing flower instructions,refer to the following pairs of instructions,can be arbitrary free combination. [Free to kill]()effect. push ebp pop ebp push eax pop eax push esp pop esp push 0 push 0 push 1 0 -------which numbers can be arbitrary,note the following correspondence push -10 nop-----------can be arbitrarily in the middle of the Add With the IT equivalent of: mov EDI,EDI add esp,1 -------which numbers can be arbitrary,take note of the following face should be add esp,-1 add esp,1 --------which numbers can be arbitrary,take note of the following face should be sub esp,1 inc ecx dec ecx sub eax, -2 ----------where the number can be arbitrary,and the dec number of the corresponding dec eax dec eax add eax -2 ----------where the number can be arbitrary,and inc The number of the corresponding inc eax inc eax jmp next jmp address jmp next address push ebp mov ebp,esp-------can be used as flower instructions at the beginning of the sentence jmp entry address------jump to the program entry address And it works the same there(the following three): push entry address retn jb entry address jnb entry address mov eax,entry address jmp eax ************************************************ With the compass after compression----then VMProtect encrypted,over the Swiss Star surface 1. POP 0 POP 0 2. PUSH ebp pop ebp 3. nop----generally inserted in the middle 4. jmp about jmp address jmp ... 5. add esp,1 ----numbers can be changed sub esp,1 6\. add esp,1 add esp,-1 7. sub esp,1 sub esp,-1 8. push esi push edi 9. inc ecx dec ecx 1 0 sub eax,-2 dec eax dec eax 1 1. (The[free to kill]()flower instructions classic,compression can be run,free card bar) push ebp mov ebp,esp pop esp jmp to the original entry point address- jmp XXXXXX is equivalent to: PUSH XXXXXX RETN 1 2\. [Free to kill]()carbachol flower instructions: push ebx push ebx push ebx pop ebx pop ebx pop ebx jmp jump to the next address add esp,1 add esp,-1 push entry point address retn ************* 1 2. (Ibid.) push ebp push esp pop ebp pop esp jmp to the original entry point address 1 3. The latest period of universal[free kill]()the flowers instructions: push ebp push esp pop ebp add esp,-0C add esp,0C push eax jmp entrance 1 4. [Free to kill]()flower instructions push ebp mov ebp,esp add esp,-0C add esp,0C push eax mov eax,entry address jmp eax nop 1 5. jmp changed:Jg(greater than),JL(less than) Or changed to:jb(less than transfer),jnb(greater than or equal to the transfer) 1 6. Written over the card bar spend instruction of the jump do not directly use jmp to jump,otherwise,to be directly killed jmp ---directly killed Changed jb jnb Or changed to: push entry address retn Or changed to: mov eax,entry address jmp eax 1 7. A period of[free to kill]()carbachol flower instructions: push ebx push ebx pop ebx pop ebx add esp,1 add esp,-1 push entry address retn ***************************************************************** [Free to kill]()experience: 1. Plus area,plus the flowers,re-encryption,can be relatively easy through the card bar----as encryption tools vmprotect The shelling over the Trojans---added spend instructions,or the addition area plus flower---encryption---pressure compression shell---plus area plus spend means Make 2. Just add[free kill]()flower instruction has not been agonistic,be sure to fit extra free flowers in the pressurized compression of the housing,in order to play to[free to kill]()carbachol effects. vmprotect encryption----plus spend-----can through the card bar: 3. Add Double flower instructions[free kill]()method----free card BA 4. Encryption---0 0 7 memory free----pressing ---free card BA or memory. 5. Double encryption(maskpE)---pressurized----can through the card bar. 6. maskpe encryption---asppack the packers ---modified entry point 1---through the card bar 7. Encryption maskpe----add flowers or extra area plus a flower(with a tool)----- pressure compression shell---free card bar 8. Compass on black anti-Pigeon pressurizable secondary,and then pressed the other compression shell. In order to achieve[free kill](). 9. Canada over the compass housing,to pull the fuck off the mouse 5 0 many times,there is a section of the empty[code](),you can add flowers,transfer. 1 0. Go to the head of the transfer entry point---add flowers----encryption(vmprotect)---- pressurized compression==all antivirus 1 1. Deal with Kappa,add the[free to kill]()flower instruction. Flower instructions for Swiss stars face killing in General invalid,generally the pressurized compression of the housing. 1 2. Against the Swiss Star surface: some black soft,add area,add flowers after the Swiss Star surface kill,can be such:the first pressing over the Swiss Star surface,and then added[free kill]()flowers instructions,over the card bar. 1 3. Through the Swiss stars face killing method: 1. Added Compass memory[free kill]()compression of the housing 2. Canada over the Swiss Star surface dedicated encryption tool. 3. With maskPE encryption tool encryption 1. POP 0 POP 0 2. PUSH ebp pop ebp 3. nop----generally inserted in the middle 4. jmp about jmp address jmp ... 5. add esp,1 ----numbers can be changed sub esp,1 6\. add esp,1 add esp,-1 7. sub esp,1 sub esp,-1 8. push esi push edi 9. inc ecx dec ecx 1 0 sub eax,-2 dec eax dec eax 1 1. (The[free to kill]()flower instructions classic,compression can be run,free card bar) push ebp mov ebp,esp pop esp jmp to the original entry point address- jmp XXXXXX is equivalent to: PUSH XXXXXX RETN 1 2\. [Free to kill]()carbachol flower instructions: push ebx push ebx push ebx pop ebx pop ebx pop ebx jmp jump to the next address add esp,1 add esp,-1 push entry point address retn ************* 1 2. (Ibid.) push ebppush esp pop ebp pop esp jmp to the original entry point address 1 3. The latest period of universal[free kill]()the flowers instructions: push ebp push esp pop ebp add esp,-0C add esp,0C push eax jmp entrance 1 4. [Free to kill]()flower instructions push ebp mov ebp,esp add esp,-0C add esp,0C push eax mov eax,entry address jmp eax nop 1 5. jmp changed:Jg(greater than),JL(less than) Or changed to:jb(less than transfer),jnb(greater than or equal to the transfer) 1 6. Written over the card bar spend instruction of the jump do not directly use jmp to jump,otherwise,to be directly killed jmp ---directly killed Changed jb jnb Or changed to: push entry address retn Or changed to: mov eax,entry address jmp eax 1 7. A period of[free to kill]()carbachol flower instructions: push ebx push ebx pop ebx pop ebx add esp,1 add esp,-1 push entry address retn ***************************************************************** [Free to kill]()experience: 1. Plus area,plus the flowers,re-encryption,can be relatively easy through the card bar----as encryption tools vmprotect The shelling over the Trojans---added spend instructions,or the addition area plus flower---encryption---pressure compression shell---plus area plus spend means Make 2. Just add[free kill]()flower instruction has not been agonistic,be sure to fit extra free flowers in the pressurized compression of the housing,in order to play to[free to kill]()carbachol effects. vmprotect encryption----plus spend-----can through the card bar: 3. Add Double flower instructions[free kill]()method----free card BA 4. Encryption---0 0 7 memory free----pressing ---free card BA or memory. 5. Double encryption(maskpE)---pressurized----can through the card bar. 6. maskpe encryption---asppack the packers ---modified entry point 1---through the card bar 7. Encryption maskpe----add flowers or extra area plus a flower(with a tool)----- pressure compression shell---free card bar 8. Compass on black anti-Pigeon pressurizable secondary,and then pressed the other compression shell. In order to achieve[free kill](). 9. Canada over the compass housing,to pull the fuck off the mouse 5 0 many times,there is a section of the empty[code](),you can add flowers,transfer. 1 0. Go to the head of the transfer entry point---add flowers----encryption(vmprotect)---- pressurized compression==all antivirus 1 1. Deal with Kappa,add the[free to kill]()flower instruction. Flower instructions for Swiss stars face killing in General invalid,generally the pressurized compression of the housing. 1 2. Against the Swiss Star surface: some black soft,add area,add flowers after the Swiss Star surface kill,can be such:the first pressing over the Swiss Star surface,and then added[free kill]()flowers instructions,over the card bar. 1 3. Through the Swiss stars face killing method: 1. Added Compass memory[free kill]()compression of the housing 2. Canada over the Swiss Star surface dedicated encryption tool. 3. With maskPE encryption tool encryption. 1. POP 0 POP 0 2. PUSH ebp pop ebp 3. nop----generally inserted in the middle 4. jmp about jmp address jmp ... 5. add esp,1 ----numbers can be changed sub esp,1 6\. add esp,1 add esp,-1 7. sub esp,1 sub esp,-1 8. push esi push edi 9. inc ecx dec ecx 1 0 sub eax,-2 dec eax dec eax 1 1. (The[free to kill]()flower instructions classic,compression can be run,free card bar) push ebp mov ebp,esp pop esp jmp to the original entry point address- jmp XXXXXX is equivalent to: PUSH XXXXXX RETN 1 2\. [Free to kill]()carbachol flower instructions: push ebx push ebx push ebx pop ebx pop ebx pop ebx jmp jump to the next address add esp,1 add esp,-1 push entry point address retn ************* 1 2. (Ibid.) push ebp push esp pop ebp pop esp jmp to the original entry point address 1 3. The latest period of universal[free kill]()the flowers instructions: push ebp push esp pop ebp add esp,-0C add esp,0C push eax jmp entrance 1 4. [Free to kill]()flower instructions push ebp mov ebp,esp add esp,-0C add esp,0C push eax mov eax,entry address jmp eax nop 1 5. jmp changed:Jg(greater than),JL(less than) Or changed to:jb(less than transfer),jnb(greater than or equal to the transfer) 1 6. Written over the card bar spend instruction of the jump do not directly use jmp to jump,otherwise,to be directly killed jmp ---directly killed Changed jb jnb Or changed to: push entry address retn Or changed to: mov eax,entry address jmp eax 1 7. A period of[free to kill]()carbachol flower instructions: push ebx push ebx pop ebx pop ebx add esp,1 add esp,-1 push entry address retn ***************************************************************** [Free to kill]()experience: 1. Plus area,plus the flowers,re-encryption,can be relatively easy through the card bar----as encryption tools vmprotect The shelling over the Trojans---added spend instructions,or the addition area plus flower---encryption---pressure compression shell---plus area plus spend means Make 2. Just add[free kill]()flower instruction has not been agonistic,be sure to fit extra free flowers in the pressurized compression of the housing,in order to play to[free to kill]()carbachol effects. vmprotect encryption----plus spend-----can through the card bar: 3. Add Double flower instructions[free kill]()method----free card BA 4. Encryption---0 0 7 memory free----pressing ---free card BA or memory. 5. Double encryption(maskpE)---pressurized----can through the card bar. 6. maskpe encryption---asppack the packers ---modified entry point 1---through the card bar 7. Encryption maskpe----add flowers or extra area plus a flower(with a tool)----- pressure compression shell---free card bar 8. Compass on black anti-Pigeon pressurizable secondary,and then pressed the other compression shell. In order to achieve[free kill]().9. Canada over the compass housing,to pull the fuck off the mouse 5 0 many times,there is a section of the empty[code](),you can add flowers,transfer. 1 0. Go to the head of the transfer entry point---add flowers----encryption(vmprotect)---- pressurized compression==all antivirus 1 1. Deal with Kappa,add the[free to kill]()flower instruction. Flower instructions for Swiss stars face killing in General invalid,generally the pressurized compression of the housing. 1 2. Against the Swiss Star surface: some black soft,add area,add flowers after the Swiss Star surface kill,can be such:the first pressing over the Swiss Star surface,and then added[free kill]()flowers instructions,over the card bar. 1 3. Through the Swiss stars face killing method: 1. Added Compass memory[free kill]()compression of the housing 2. Canada over the Swiss Star surface dedicated encryption tool. 3. With maskPE encryption tool encryption.