Welcome to the new session.
So we're going to do a practical walkthrough on the important descriptor and I'd table.
So going download this project here to I.E.D. and put it in day to food.
And you say here you find a I and he'd have fun.
If you open really far, you can see your location where you can get it from.
And also the location for kill.
Yes.
So let us open in.
Been in TV.
You can us plus.
And then we look for in this descriptor by searching for it.
Click on Search, find in time in point on this car descriptor.
Oh yes, he name he has found it here.
And then we'll open the location for calculator, which is following this path.
So the eBay.
And you can file look, be and go straight to see windows.
System32 and then count hack to open.
Yesterday.
So now we'll put her in for the script.
Side by side with, he'll be there.
Hear what the options are here to hear and scroll down and and these fill in Project three exactly on
this.
Follow we're up here.
So now in this hour, we're here, you can see the the all of these structures for this important descriptor.
Yeah, quite a few here.
So let's see.
Click on imports here.
The first one is about B to the ale, and if you say offset the one here.
The UAE.
It's bites here, so this for base here is for Hammarby and.
It stretches all the way.
And do the next one, which is the two four zero.
Here.
This is the stunt, the next structure issue for second of three to zero two four for the two fold and
then a nation will be DFAC, so.
The foresee so.
Which starts here.
Need for Cecil.
This is the structure.
So you have many structures altogether, think you can count the number of structures here?
If you come from here, you can see in one two three four five six seven eight.
Nine, 10, 11 to 13, 14 year, 14 in police descriptor here, want to get it?
So let's study the first one and not be a business there.
Do you want year?
So we start to hear stretches here continues until.
Until you hear the next one is zero two four zero, which is going to 32 secretary to structure assessment
here.
So from here to here is a structure for MLP.
So the first for base refers to the original first tank or union system.
The one he is here and then the next four bites he's deemed it's 10, which is on f's.
The next member will be forward a chain which is here again on this.
And then the next member of the Anene, which is here in the wonderful new wonderful, you must really
reverse order.
So this deal, and therefore, if you go now reckoning for follow, you should be able to see the name
and not be here.
Hello, PDA is a street name for the PDA, is a friendly name for this deal.
Messing with me and then the next member will be your first time.
So your first tongue will be this one.
So this last member.
Hear, hear.
So the first time is a pointer to the important address table.
So you progress table, he's telling here.
So at the moment, you can see the progress table contains 10 injuries and there are 10 functions in
Araby 32 there.
If you click country to even look 182 is important.
It is stable, containing all the functions there that can protect for currently get jittery to.
Usually two into so.
OK, let's go back to our people.
So about be here and you come down to the boat, then you will see our what has got all these entries?
You have higher than 10 important functions.
And over here is your first one.
And this is a hint.
So everyone on this commission has got corresponding numbers.
This is just like an old eagle number.
And then here if you click on this and follow.
You can see the name here, the hidden plastic, and you see they do so in east, he is the saying,
I'll do the no and then the rest is a string name which that you read security is.
If you went to the second one Fallujah area, you will see the hill to CC to Mississippi, followed
by a string name rank query value.
Hicks rank very, very nice.
If you can afford it, that one, by clicking this, you will come to the hill, to Tracy, to Tracy,
followed by your friendly name for this function, which is recreate key W, create key NBA.
So this is how the thing works, and this is how we can analyze all these important address stable.
So one thing important to remember is the first term is a pointer to the start of your off your deal.
So for example, if we go next year.
So you are in your first term.
Is this one?
Here and then when you first see he doesn't have a address for each one on this function, but he will
look up using the heat and eventually the builder will populate your boat address table, which is this
one for them if all the addresses for this.
So this is how you will see how the resolve, how the invoice table is being designed.
OK, so now we can try to take a look at using a debugger.
Take a look here, here and look that.
So the following options Click on Options Preferences and here.
Click on the outlook and system here because you want to see how the item is outstanding for the functions,
the addresses of all the functions.
And it's only we check for breakpoint.
So now we open your.
Calculator or the system to select Calculator AC to Cuban.
And then over here, we go to memory.
And noticed that we needed to least know that all the R&D ers have not been hit because if you put a
brake fine on the air, you can see at the bottom left it is passed and is a break point in the air.
So here we go to the next session and you scroll down and see the costs noticed.
This these countries function is unknown because this has not been resolved here into the import address
table.
So we can follow this.
Click on this first come down here.
And in following down this address in stable has not been resolved here.
So now you have only the functional look up, so now you really see what happens.
So elusive.
First year 2032.
And you still have to resolve the high table yet.
Look, the second, yeah, cannabis, yeah, he's now got it right now, you'll lose the next year,
he shouted into the air each time you click run.
He said, Yeah, so you may need to click it a few times and to all of the else, download it
discreetly when clicking and you can see already my ideas being loaded given clicking.
OK, now when you see all this surrender, Mr changes being made to this region of memory, that means
now the IED table has been fully resolved.
That's why it turns out.
And if you go back to this location?
Thanks.
Sorry.
He should be here.
Go to the text here and now you can see your function name has been resolved because the high table
has been resolved.
So if you click on this now and come down here and follow it in the same address, you will find this.
These are in part of this table with all the reality which you address for the functions function,
so you can follow this correctly and follow Cuba in this assembler wiki.
Because the 16 64 bit programs each address is a baseline.
Yes.
Why Cuba?
So we follow this Cuba in this assembler and you can see getting more handle.
And you can see this is not a direct reference to an address is actually a jump table and we have GMP
here.
That means whenever you are resolving this function, you actually go to a jump table to jump to the
actual location for the get more, you know, W.
Yeah.
Some functions which are direct to the idea to the function we tie table this Friday's one.
OK, this is also a young team that would be somewhere that you see the knowing Norwegians, but that
actually references the function itself.
So this is to work true on the function lookup table, an input address table.
Thank you for watching.