Hello, and welcome back to a new lesson.
You are going to do the practical work through everyone's functional kitchen by implementing our own
custom Win32 API function.
And we are going to do the eastern one here, but at the same time, we are going to revisit all the
earlier methods.
The first time, it's the second time obfuscation.
And then we are going to do the advancement it here.
So let's get started.
So going down this project, you called zero for advance function obfuscation and zip it and put it
in this directory, economy may have to open it and you will find three folders.
And there's also an encryption script, which we use in the first course in order to create the the
string name for which I look.
So in version one, here you have two files.
And if you open this now, if not that you will see that it is the original program which is not confiscated
in any way.
You have a plane, which I hear called.
So let's try to build this now.
I see what happens.
You know, they'd be trying to look for it.
I mean, in the studio.
So let's copy this path now.
Open your.
Access your phone it tools and key to get directory and inequality, compile version one batch script
and then now we can run it.
And as you can see, even when you open up the issue as usual.
OK, now let's try to look at it using peace to you and see whether we can detect the evil Sherlock.
We are only thinking, which are a lot of things.
You could do it for any of the functions.
So let's put this into words into to do it, for it to analyze.
He has completed his notice.
Now you take a look at the inputs, and if you go on to memory, you can see what you look.
And then here, if you go to extremes.
And you click this is sort of Sandy.
Can you pull this all the way down?
You will find also there, which are a long civil here, is a string to the barometer for.
And so that's why we want to hide this tree, which are low, as well as height, which are low here
as well.
So to do that, we come up with version to.
So wrestling promotion to opening.
And this version to be used on any API loading or here you use get biology.
And then you just get a handle.
And then we obfuscate the incredible string, the actual encryption and then put it here and encrypt
history for each other.
And then over here you have the decryption key as well.
And during the runtime, you call Typekit XOR in order to decrypt decrypt history and in overwrite it
back to its original string.
And it passes through here.
His second parameter to get my chance and get progressively dynamically, look for this virtual lock
during runtime and return here and then record it here.
So let's build it now.
We change directory first to the version to.
In a corgi compound wishing to bet.
All right, so it's compact and now the rainy.
Switching to press and taking a.
So he looks OK, this is not an alliance.
This will be to you.
So will.
You courses in Rawalpindi studio and you're the to.
Which is this one?
And analyze the inputs in the strings and get.
Now that he has finished analyzing click on imports and go for the memory group and you will find what
you are like is gone.
It is being obfuscated.
Go to strings and scroll down to the VIP section.
Click on Saw this ending first and then scroll to the VIP section.
And you find it which I like, it's also one you only have waited for.
So we have managed to obfuscate it, you know, saying crypto three parameter keys or less regulation
three.
So if you open to use machinery, you find some additional folders here.
You have to my angel hedge here for the header file.
This contains the function function for the time and then the.
My API, CBB contains the function definition for our dual customized function, which I already explained
to you in a high level view, if you understood the halo explanation which I giving to you in the previous
lesson, that should be good enough to get you going.
So now important is how do we use this to user defined, proper dressing user defined?
Get more you handle.
So let's take a look at.
Wishing Tree were here.
So if you open version three, you will find now that we are using our own, might we get progress and
get more you handle?
Now you can see you are using customized get projects you have in mind frame.
And also get customized, get more.
You handle the wine front, which is defined in my API gossip.
Who here he was.
As I could assume, the easiest thing now is these two functions are customized.
OK, so let's try to build it now and go to choose directory to version three.
That's clear the screen and call the compounded.
All right.
Yes, Bill.
So now let's try to honey his rush injury, and he looks OK, so now let's try to examine these together
again as he open these to do.
And you examine which country types do you analyze?
Anything on the impos and then you go down to memory, which is also not there.
And if you go to extremes and you click on value.
Click on this to sort of sending a score down to V, which are locked us in on day.
OK, so this to have understanding of trying to offer to obfuscate your function calls as well using
more of our standing by creating your own, get pictures, get more you handle.
So that's all for this video.
Thank you for watching.