exploit BGM Pang Tong to recover