Welcome to reverse engineering, best-looking.
So now we are going to run our our target and inject the diam and then analyze it.
Reverse engineering, we actually begin and see how it works internally.
So let us first start our target for Petrushka.
So this is what we see now.
We are going to inject our name.
So we use Process Hacker Select the target for who correctly.
And then before we inject these differing ideas, let's first attach our excuse for the big three.
So open your 64 bit version of actually big.
And then testing by clicking Fire Attach.
Select your target for pressure cooker.
And then click on Run.
Now, let's go to the scene, both Ted and I previously put two break points, they may remove those
first.
So let's go to the scene both TED and look for the message box API from the user 32 deal so you can
hear this typing message box and you will find if you hit your first one is the one we want.
So double click on this and you will see this the message box API.
Notice the instruction here.
Now we are going to attach our inject now.
Yeah.
So let's go to process hacker.
Right click on Target for picture.
Click on Miscellaneous and then get yellow.
And select our special car and then see what happens to our instruction in the debug.
You come back here now directly on this to refresh, so go through this, analyze and then analyze for
you and you see the instructions you change.
So this is the patch, the memory patch.
So this memory patch you can't use coming from your pressure cooker, which is down here when you write
processor memory.
So what you're doing here is copy your patch over to the original address for the message box.
So the best, actually?
The tax base at Greenify, as you can see here, the demonstration is unify and then followed by foreign
allies over here one two three four four base one two three four.
After that, you follow it and buy a device of the -- address, which is three zero one one three
two zero zero zero zero zero zero zero zero zero.
So these are a base of addresses.
Just ignore the instructions here.
This is the biggest attempt to interpret this and nonwhites.
So these are not actually striking this i the address of the modify function.
OK.
You can also analyze this correctly in following done the senator address.
And you can see down here the instruction jam is I and you fire so you can go back and come back here
after you have the effect unified her final base.
Then you have your address, this address of your modified message box, so you can see here is the
same as this on modified message boxes at three two one one three zero three two one one three zero.
So this is a base here.
One, two, three, four, five, six seven in base.
This one is six by the Germans, Russians.
This is aided by the hulking address for our modified message box.
So this whole line here is 14 by.
From here to here is actually why we created using a memory copy.
We have copy to buy here and then followed by for no advice.
Then it seeks advice.
Yes.
Well, we put plastics has offset.
So by six here we take you to the East Bank.
So for the remaining advice we put in the address and the cooking function which you receive recall
who in batch silver we call who invest.
We remember we passed the modified message box address, which is this one.
So that is what this is pointing to.
All right.
So now you can put a breakpoint here.
Double Breakpoint and then run.
So now we come back here and you click, OK, here, hit our breakpoint.
And then now he is going to jump to our modified message box.
So let's follow it by clicking.
Step over.
So now let's jump to our modified modified message possible inside our modified message box functioning
over here.
So if you can run, run, run, give, you can put a breakpoint here actually help make it easier.
So now he's hit our breakpoint and game, right?
Establish he will modify a message box and then that's going to show a message here.
So let's step over.
And come back here, you see a new message has been showing on message box pop up on screen.
And that is because in our modified message box function, you are printing this line.
And that's why you're hearing this and is coming from this court and the parametres just now.
Here second message was.
Modified message box, this is a barometer.
All right.
So now if we run again, you hit our message box.
Bitcoin the second time, it means he's going to call our injected quote second time, our second time
because it is going trying to show the message box.
So if you know we jump by stepping away, you jump again to our modified version.
And if you hit your right, you have a call here, which is going to show our message again.
This message is going to show this again.
And you can see the perimeter here is where.
Well, if I misspoke, archnemesis supposed pop up on screen, so we steroids, he's going to show this
message.
And then you see in the console the true enough, his day.
OK, so you can run all the way.
We can also do some additional experiments from over here.
One, if you want to restore the original base.
So we just have an uncommon design.
Once you restore the advice, we can now call the original message box by using the the function point
there, which we say earlier over here.
So this is a fashion point containing the address of the original message box, so you can actually
call it here after you restore the base that we copy from here.
Oh, here we actually copy some of the original advice to this location in a buffer.
So now we can restore it by writing they go with him.
He buy two here and here.
He can then call the original function going to follow message box.
So let's compile this and see what happens.
So this company can run it on by first.
All right.
So now you can run it, we run our target first and then you attach our inject our DNA.
Right click on this miscellaneous inject our game.
All right.
So not in the air has to be injected.
Maybe, maybe.
Click on this.
OK.
He's going to show our message box.
Why?
Because this year thought the original instructions by copying back the device, which we copy here
earlier, we say here now we are copying back to the original address, and then we are calling the
audio function point to the original function point of the message box.
That's why you're seeing this.
After that, you can hook you back.
If you want to get a case showing it, it takes a message.
You click, OK.
So this is how we can restore that whenever we have copied and allows us to recall the original function.
And then if you want to recall, you just have too many slang and you re hoping in.
OK, so that's all for the reverse engineering of inline patching.
Thank you for watching.