Hello and welcome to a new section call Advanced Function Obfuscation.
Implementing your own custom Win32 API functions, as you have seen from the first course on the basics
for mobile development.
The purpose or function obfuscation is to avoid detection by antivirus.
So assuming we have member then makes use of her function API call.
What's your outlook now?
If there were no obfuscation, which will be clearly detectable by the antivirus now in order to defeat
the antivirus?
Well, we tried.
First was to use dynamic API loading.
So the method is called function obfuscation.
So in this Tanami API, including the obfuscated function by using the Gate Address API to look which
are low during runtime.
So we get address, we need to have two parameters.
The first parameter will be the handle to the of containers here, which are OK.
So in this case, we will use get more you handle and pass.
Yeah, and it contains D, which are so your hand will be return the handle to kind of three to Liane
and keep our address.
We used it to search for the water.
So once he finds it, he will return a pointer and we will sabihin the variable copy, which are OK.
So we which will be then used to perform the which allocation of memory during runtime.
So in this way, you can hide this, which are from the antivirus.
However, if you later saw that the antivirus can still detect the string because the string, which
is plainly visible in the screen strings, can and can be seen in the memory.
So what we need to do next was to hide this string.
And for that, we will use another method called string parameter encryption.
So in this next second stage obfuscation, we will use function, obfuscation plus string parameter
encryption.
So in this method, we will take this plain text string and encrypted using XOR encryption all equally
when you say yes, encryption.
And after being encrypted, he will save it in a string variable called SDR, which I like now.
During runtime, we will call the decrypt function, which we then decrypt the the string back into
plaintext and in plastic as parameter to the Padres.
So this second light, second level obfuscation could then defeat the antivirus, which such as four
strings in memory.
No.
In this course, we will look at another method.
Even more advanced in this.
So what is the problem?
The second stage at the second level meant it.
The second and the third is that.
We need to use, get progress and get them on your handle in order to dynamically load the function
that we need.
So these to have visible to the antivirus.
So in this advanced tiny fish, you are going to study nice.
We are going to obfuscate or height is to.
So this method is called custom API function of whiskey.
So how do we hide this tool from antivirus?
We will create our own capable address and also create our own game model handle.
So in this year, you can see the customized address.
We'll call it my apologies because this is customizing your real self and any the game you handle the
customize on your mind, get more you handle again because we are going to write this ourselves.
So this too, this is advancement day, because trying to write your own progress is quite complicated
and so is getting a is writing your own game more, you know, API.
So let's get started.
This is the theory and how they are going to push this.
So as you can see here, now that it's running, if he wants to find out about the little details he
will, you can look at the behavior in the behavior.
You will find a lot of fields.
And one of the important field is the Lisa Gale Senior Editor Directory.
So the data directory can be seen here like this?
This is a diagram of her behavior.
You can see here's a dossier that contains imaging by MS.
Here and here on its position.
Three.
See, there is a pointer to your behavior.
So a behavior starts here and behavior is quite amazing by be followed by do not track characters.
So it is known as a behavior and also known as A. It's the same thing.
Sometimes they also call cophura all this, but here is the optional heater and optional head.
Isa contains several other subheadings and the important one for our purposes today.
Today, atriz, which is over here, the data Garrett is continue exploitable and in particular decided
to fuse of the data that which you are interested in and we have seen before in previous license.
So this example of a country to the L and the optional behavior has quite a spotting directory and important
directory.
And then you can look at, yeah, the details are it by clicking the X POSTECH to see the meaning of
all these various views inside the P export directory.
So this is done before just to refresh your memory to coming back to this.
So the malware will know the behavior and then look at a little else in the data directory and then
you day.
We will search for Chanatry, too from the lease on the house.
So this this idea is contained inside the impact table in Python table.
So this list would tell the programmer if you are writing a program to obfuscate the function.
You can see what are the important details and cannot agree to the is always important for sure in any
program that is running.
So we need to search for the module, the address on your model.
So to do that, you will use the method for searching and he will go through all this process, which
I been the and then you will return the address of 82.
So once you get your desk country to you, you will then be able to pass through the list of APIs exported
by country to using this method by going to the export directory.
And then from this point directory, going to the address and function.
And then from the address information, you can iterate through the list in there to look for the function
that you are interested in.
For example, here.
So here you can go to the address of functions and then look through all this list and find the functional
unit.
So this is just a reminder of our lesson here.
So why don't you find this a function, for example, in this case, if you want to look for quick progress?
So once you find your address, you can use it to look for which you are OK.
Another complication is here.
If you also want to obfuscate this search, this search here is actually getting more you handle.
Here.
So capable address is this one we are looking for address how you get progress, but what can you handle?
So for game your handle, we need to use to help move to other structures.
Go to the NPV.
Every running program in windows has got TB and B-BBEE, so environment is important because it contains
a list of all the details that are important as all of the environmental variables in the path to the
current diet tree, the path to executable and other data and information which is needed by a particular
process in order to run every program that runs is run as a process and process can have multiple TB
inside it.
So all the information about the tracks is found in the the environment block.
So in order to get hold of the PB, you need to go through the TB.
So this is how the Windows system operates.
TB contains a pointer to the PB.
And then once we get the APB, we can then go to the loader field and another few will have a pointer
to a lease on the house and then we need essentially lethal gas in order to get the address or not,
No.32.
So once you get it, you can return to the caller.
Let's take a look at the example of that.
Now this, you would be doing this later in a particular walkthrough, but now I just want to explain
how it works.
No, we have this finishing off with Gator English one.
Version one.
It is not obfuscated at all.
OK, so this is a program this year than before in a previous course on the basics.
And we have a payload here, shackle we who run note back when you're security.
And then here is your main function, and you also have a decrypting function to decrypt SLR.
And then in the main function we use, which are lock because you want to allocate memory in order to
store our bill.
And then over here is where the copy of Bill to the allocated memory and the bill is actually this bill
and then down here we change the permission of the allocated memory so that you can execute it down
here.
If you've forgotten or this, you can refer back to the previous course.
No, the problem with this is that these which are long is visible to anti-virus.
So we wanted to hide this.
So not to hide this.
We can't.
We can come up with a second version of this program whereby we use dynamic API loading by using a project
in conjunction.
You get more you can do, and you also want to hide the string, which are lock string.
So we increase this string up here by using this key and come out with this and crypto version, which
you a lot.
Then during runtime, you called a a function to decrypt this vacuum think tanks and then pass these
to these two parameters to a general address, an address will then return the address on which channel
and then down here.
He called the channel in the usual way.
So this is the second method which we covered in the first course.
But the problem is this second method is that this ghetto address function call is visible to antivirus.
And so it is also visible in my youth center.
So now in this advanced method, we went to hide this too by customizing our own gear proper address.
And that's how we come up with a tabulation.
So in distinguishing.
We will use our own version of Gail from Address, call my reporter right over here.
So using my apologies.
To get hold of the address of which I like and then return it to what you are up to a variable cost
the are and then down here we will use it in the normal way and for an extra demonstration, we are
also going to use his CMT to get the you're trying to get the address or more memory.
All right.
And return it here and use it in.
You shall be down here as if I should point out.
So let's take a look at this to now.
How do we how do we define our own hateful address?
How do we define our gig mall?
You handle function.
That's where we make use of a new and different file called my API.
So my API, CPC and the header file easier to hit FAQ on this or media function for the time and implementation
is following my API and CBP.
No say here you have two functions which are defined.
One is my gate progress and one is my your.
So these are two custom made APIs that are also in order to defeat the antivirus.
So we may get progressively this part here is testing, but on the hater behavior.
Why do any party be here, though?
Because the beta contains an important directory called the data directory.
So from the data diatriot, you can go through the spot export address table once again as far as this
table over here, which is over here.
You can then look go through all the list of function names and search for it down here.
So you can either search for him by ordinance or such void by functioning after you found this point
to this variable people address will continue address of here function.
And you're looking for.
All right.
So this is how it works.
And also, we have a second bar here.
If the function you're looking for is a forward, it function properly function saying is from Yale
named function.
So you did what the case?
Then you will use this second part of in order to perform search on the name in order to extract the
function.
And this town name will be passed the recursively to this functioning in multiple address.
And that happens down here.
Major progress.
So this first part of the second block here is just to split the folding them into two parts.
So the owl name is starting here as string followed here and function name is started asking for this
function.
And once you split into two parts, you will then you might not get progress to get your address or
law library because you need the library.
So this particular library is too the Yale so that you get proper dress would be able to look for function
and it's only a dress.
So his how he will stand in for the top buy here game on your hand on this first, but here he is to
a string.
The pointer from the Czech environment blocked the TV, so it is still functioning, essentially working
on a TV and for three steady six s 86, his knees are set.
These are several.
TV contains the pointer to the P.B. and if his SSD for this are set, a TV contains the pointer to the
BBB.
So in this case, if he's 84, this will run and return the pointer to B-BBEE.
Once you get it B-BBEE, you can get in opinion.
So I the bass and race and getting over here, this is where you go to the loader.
The pibil content, louder and louder, is where he has a link to the lease of the house.
And once you get over here, you get the list of all the DLC from the loader.
You will use these to search for it in a loop.
So this is where you search for the detail attached and then return.
It is where you any.
So this is a high level view of how these two functions hook.
So that's all for this lesson in their next video, we're going to do a practical walkthrough on all
this.
Thank you, Heidi.