Hello and welcome to the lesson on exploration of the function and API used in line networking.
So again, download this project number 14 Dash in nine special game and zip it and put it in this manner
to hold it.
Along with this file, you should also download another file, which contains some useful links as references
that accompany this lesson.
Inside this folder, you will find three files.
The Compile script, which will be used to compile the batch --, as well as key target for Petracca.
Let's first openly target for special care.
Public trust us and it is the same file we used previously.
All he does is bring a message to the console to inform the user and their target for the -- is
starting, and he will then show three message box consecutively.
If these messages and finally, he will show a console message targeted for who could be sitting at
the end of the program.
Now let us study the pressure cooker itself.
Opening the Note 10 plus plus.
And in here, you will find the the main starts here.
This is the guy army and he has got the attach case.
So once the guy is attached to the target, he will call this new function called hook and fetch.
So who can patch is over here?
So over here, when he accepts one parameter, the modified message box, in this case, you are also
trying to modify trying to intercept the API call message box and try to set our own modified Mrs. Box.
So over here, you need to pass the address of the function called modified message box.
Modified message box is the same function we used previously over here.
So inside you see the same court, be U.S. and then so once you've passed this modified message box
addressed to the hugging patch function.
He will he will call that function here.
This is where being defined.
So the first thing is you save the address of the original address of the message box API.
So it is it is referring to this step here where you save the original address of the target function.
The second thing is he will copy the he will copy the original instruction base to a safe and another
location in memory so that he's referring to this third step, said Susan.
Bites of original function.
And the paparazzi that stay, the paparazzi does these two things so that later on, if you want to,
you can optionally revert revert back to the original function so that you can continue resuming the
function originally that you was originally intended to do.
So that's why we're doing this to serve you.
So in order to save the original instructions, we use a new API we have never seen before.
It is called repossess memory and repossess memory.
You can refer to the MSDN.
It accepts all of these parameters.
And the first barometer is to get the current process because it is trying to modify the address of
the writing process and then the.
Second parameter is the IP address, where the original message box API is found.
Referring to this?
And then the third one barometer is the buffer where you are going to install the instructions to again
the last per hour, then an experiment after that he uses science, the science or the original instruction.
So he says the instruction is a constant.
Which is you up here?
It is constantly floating by.
So your administration will be 14 bytes?
And then the last barometer.
That US painter is the vice.
So the last part is not important.
So after you've copied this, he has said to use location, you have a copy of the Oregon instructions.
The next step is to prepare the the back.
You are going to fetch the device that you're going to use to patch the is running in memory.
So you prepare a string of character 14 base long because the instruction that they're going to use
is 14 bytes long.
So we use memory copy and copy the first device F and you need five in Hex, which means jam instruction.
So jam instruction is effective and you fight four by four for now.
Now, now bytes, that follows it.
So this is a demonstration.
And then after that, from the 7th to the from the from the eight byte until the 16 byte, we are going
to copy the address of our modified message box, which here is referred to as hooking function.
So this function is what is being passed to this function over here, and that refers to our modified
message.
So modified message is going to replace the original function.
So after you finish the instruction and you do, we have a string of byte ready to be to be used to
replace the original instruction.
And that is what you are doing in a next instruction online video right?
By calling the right process memory.
So the rewrite process memory, you can refer to it over here, you know, accepts five parameters.
He sets five parameters.
The first barometer is again to get the current process ID.
And then the second priority is to address the base address where you are going to overwrite.
And then the next one is his site is the patch itself, which you created up here.
So this is a new function.
The new instruction which you are injecting here there is going to jump to your cooking function.
And so your function is actually consisting of the demonstration, followed by the address you are jumping
to.
So this is what you are injecting.
This is what you're going to use here to patch this address and then the size.
And finally, how many bikes have been there have been used.
Finally, you print the message box has been hooked to the console and also the modified message box
address, as well as the original base address over here.
So this is how he works.
So once he has done the patching, you have to accomplish this step in four.
So now the function is ready.
Whenever a target calls this function, you will use your function reshef for the used to replace the
original one.
So he's going to run your function instead of the original message box function.
And then optionally, you can also replace back all these bytes you here copied here.
Appear here.
The original instruction.
So you can do that by using these two instruction here.
So insane, your wife, Mrs. Parks, you actually perform your modified function and then after you
restore whatever was previously copied by using the right process memory.
So represents memory here is used to to copy back the original advice into the address for the message
box.
Again, here is is used to show your return message box.
And here he calls it who back again to reset your message box.
Your modified message was okay, so this is how you can.
You can use this great process memory to restore original function.
So that's all for the examination on the court.
Use of of the API and function used in this inline batch method.
So in next lesson, you are going to need some practical walkthrough song for this lesson.
Thank you for watching.