Hello, and I can now be having dog racket.
We need to find out which by we are going hook.
So in order to help us find out what API Deborah Craig uses for the entering the password, we need
to use another tool.
So you can use a tool in flare.
So open flair.
Head over to the utilities and we have API monitor since this is a 64 bit program.
We used a 64 bit version of API Monitor.
So just open the EPA monitor.
Yes.
OK.
Now that EPA monitor started, you can see here in the top left all the APIs that we can hook.
So are many of them.
And then on the bottom left are all of the processes which are running in memory.
And one of it is where actually the one we want to target and then here will be monitored processes
and then wherever you select here to monitor it will appear here in this list.
And then here will be all the results of the monitoring, and a barometer will show you the details
and even more details of each of the barometers.
So now we have to select the criteria before that, we need to choose what API we want to monitor.
If you're not sure, do not use or try to narrow it down because you will choose all you, there would
be too many to fill it out later.
So if you're not sure you're a good one to start these Windows API development so you can select this.
And another one wishes good for trying to ease and unity.
This one, right?
But let us try these first Windows API application development.
So now you say like this, you want to hook all the API functions use by that actually makes next used
to select that actually correctly and then start monitoring.
So immediately, you see the rhetoric now appears in a monitored process list, and it is already starting
to monitor all the API calls that got us.
That is coming from in the application UI development.
Now you start to open the Arctic, you are going to mount it, so select the this and the fact that
you are in demand and then click Mount.
And here, keen, he passed it on display pass with Saleh Shah five on to a key in your password?
Yes.
Pass what?
This is a it.
All right.
So click OK.
All right.
So now he has mounted.
So now you can stop the monitoring process going on here and rightly and stop monitoring.
We don't need that appeal anymore, so you can dismount and exit.
So no insight and this API calls.
That would be the password that you keen.
So you have to find out which API call has got the password as a parameter.
So to do that, we can search.
Click on this search here this find here and find before you do that and be sure you click on the first
API.
Call analysts the first one here.
And then click on Find and here again, the string that you're going to find, that's possibly yeah.
All right.
Did a device down any findings?
So you research all the API calls, which we have this string as a parameter, and he has fun following
it over here.
This one?
Take finesse.
No more damages, only one when he.
Came closest now, so now we know this API call right chart to Matthew Buy has got this possibly as
a barometer, as you can see here.
So you go down to the time the least, you can see the details of all the parameters used by this function.
You can refer to MSDN here by charting Marty by to see more details about the parameters of the function.
And this is the media reference, right, Jonathan Martin by function.
Syria has got all these parameters.
So this is all the parameters that we are actually seeing inside here.
This.
We know when you pull it out and you can see the details here.
All these parameters here, the one we're interested in is this.
This parameter.
The fish barometer, the barometer also has got the password that we're interested in the fisherman.
So the purpose of this function is to convert the string from one format into another.
If you read the documentation, it would become clearer to you.
So according to this.
The fifth barometer.
Contains the convicted string.
So that is what we want to hook.
We can be on the hook and disappear and then retrieve this parameter.
So you can scroll down and look at the barometer.
Help motivate string.
You can see here this is in.
And here is how.
This is in the tech barometer.
That's part of it.
So the end is what the user input and it is in the role for me, Unicode.
And then here you can to convert it into multi by the fifth parameter.
Yeah.
Pointer to this is our barometer pointer to buffer the risks of Congo to extreme.
So once you receive just come with this stream, you can save it to a fallen disk, a log file of sorts.
So this is our strategy.
So here's how this is how useful this API Hook API monitor program is.
So before you start to write any kind of Trojan for targeting a particular software, this is what you
would do.
You install the software in your own computer and then via API monitor and investigate.
Where is the password using in the SoC?
So the only way you can find out is to hook the API calls made by that particular software.
And then once you sign up next year, you can start writing your Trojan.
There we have a deal.
They can hook this API call.
And then once you develop the Trojan, you can deploy it to your target machine.
So this is the strategy.
So now they've you know, they've you're supposed to hook this white charger, you can start to right
our Drugeon so we can just say this word, just copy this regulating copy paste and then fire your back.
And basically there.
We don't have money to pay.
B.C..
OK, so this is your.
Are actually.
And yet you and copy here.
So they are.
Copy and NBC.
Now here, so we can use this as a reference later.
All right, so now we're ready.
You can close this and you can proceed to the next lesson.
That's how I speak to you, the program that we are going to write in order to capture to hook this
API call.
So that's all, thank you for watching.
See you next time.