Hello and welcome back.
In this video, I'm going to show you how to be he actually follows in the Air Force, so go in create
folder on your desktop called Mandate, and then download this file from the recession and zip and put
in Modak inside this file.
You will find two projects, simple, easy project and a simple gear project.
So just open this simple, easy for there.
And you will find Yazar source code for C++.
Simple, easy and a compiler script.
So let's open this employee.
See my right clicking and Mopani we've not back plus plus and is a simple program.
There is a main function and this print statement, this prints helper and then a user to Presti in
Turkey and then he exits.
These are the header files.
Standard C header for us.
So in order to compile these, we can use the compiler script who are here.
So if you open these Kompass click here.
Right.
Click and open any big notepad plus.
Plus, you will see that if you simply calling the C a command line compiler to compile this into a
Yassky.
So this is a simple way of building a E.S. Far from the command line.
So in order to build this, you need to open the correct the correct prompt command line from left.
Click on the bottom here and then here search for Netiv.
And then here you will find a few.
Look for the 64 bit.
No 464 s.e.c for native tools combined from four V.
S to 019.
If you are bidding for a 64 bit Yangzi, since you are bidding the output to be 64 bit easy, we will
choose this one.
s.E.C for Netiv is common from.
So just click on this now and then you open the car.
Come on, environment.
I suggest you find it.
If two is common from four wishes to do it, two zero nine.
Now we have to navigate to the folder that contains have a project which is this folder.
So just like the mafia rackley and copy that path and then come back down here and used to change directory
command, which is CD.
And then put a space by pressing spacebar and then use the mouse rightly to paste pop here and maybe
the enter key.
And then if you press diar r, he released the contents of this directory.
So we press enter you see that there is the compiler script day and the subsequent Far East as well.
So in order to use his script to compile is seeping into an equal, we just have to run the compiler
script by typing the name to script, compile that and enter.
And immediately you see here on the hand corner, it has been populated, you've and fast and Farleigh
snakes.
Yes, you can see.
So now in order to run this far, all we need to do is take the name of the sea.
Yes.
Type simple.
And then the extension should be easy.
And he enter a prince.
Halloa to the screen.
We can actually examine years using process hacker so you can go to FLER here and then go for utilities
and look for process hacker cleaning process hacker.
Process hacker is more powerful than Tasmania.
So here you scroll down and you can see the parent processes command line and the child process is simple
EIC, which is now running in memory.
So you can double click on simply a seat, open up another window, expand.
And you can see here the command line is simple.
I see.
And it is a 64 bit program.
Over here, you can see.
And here's the path to the image, file and directory.
And if you click on memory, you can look for the location in memory.
Then use EIC has been loaded.
You need to spend on these column here to see the path.
And here you can see he is loaded in memory and this address like this.
So you can expand and you see all these here.
This is how you can examine the running process in memory.
And you can click on Molineux and see what are the other dialyzed.
It is depending on most of it.
You have connected to the base.
Yeah.
a.D.A.
These three are the basic ones for all programs that are running in windows.
So we can close this, not we lift heck up, and so now we're here.
If we compare this, if our sourcecode.
So this is what we're expected to see whenever a program runs.
If you look for mean function, so for command line, the main function is mean.
And then you say you get a penny.
So this brunette who cannot go to the screen and then go to the new light, who here?
And then after that, he will call the getcha getcha is a C function that will wait for you to take
something on the command line.
So we can get to this program or we won't have a chance to examine the process.
That is why we put Jinda.
So now over here, if you press enter and the program, will you exit, OK?
If your program doesn't just take any character, for example, E and enter, and then you actually
that is built a dia alpha.
So we have a gal who here.
So we will never get to the idea of project here.
Quite simple.
Yeah.
And in society you will find two files as well.
You have the same compiler script and we have a ship.
So there is rightly impune he nonpaid plus plus no idea is different from AC DC.
We have a main function and he can do this by savvy memory.
But again, I cannot run independently again needs to be loaded into the process piece of a running
EIC.
So idea does not have me, but it has something called the L mean.
And there are many.
We have Suchi nominee that will run depending on the lifecycle of these.
Yeah.
For example, when the idea is first attached to a running process, this case will be triggered.
And when it is detach from the running process, this case will be triggered, something for me attached
to a track, you would trigger this case.
And if we detach from a threat, you trigger this case.
So at the moment, all of them are blank, empty.
You just return true in this.
We also haven't exported functions.
Now, Gmail needs to export functions so that other processes can make use of it.
So in this case, we are exporting one function.
Say hello.
Let us do this now using a script.
So we go back to here absentminded yell Kompass screen correctly and open is not bad.
Plus plus you will see we have also a command line compiler here.
By this time, we are compiling a simple idea that CVP sourcecode how we think it as a simple idea dot.
Yeah, you did an extension.
OK, so let's now change our directory by typing key space dhanda to go back to the parent directory.
And then yeah.
To see the contents.
So now enter the folder for the simple the am
I type dir to list the contents of the directory.
And then there's a compiler script.
So I think the name of the script on the back and into.
So is now going to combine the the file and it is completed, as you can see down here.
If you want to test the deal, we can use to that to the operating system called Randy and you type
Randy out twenty two and then the name Eedle Comma, followed by the exporter's functions in this case,
he had to add any to.
Then you execute the exported function.
Now, this exported function comes from the source code and that is reexamined the sasko rankly king
in openi even back plus plus.
And you can see the esposa function.
You say hello.
So it is important to put a comma for them by the function that you want to call from the L.
So now the question is, what if you do know why the body functions?
Then you can test it up so you can test by running and being human command, followed by forward snack
time spots, followed by a name of the D.A. So he didn't.
So this will show you and the Espiner function.
Say hello.
Another way to check is using be there.
So you open your flair here.
Guti retail is.
And lunch B.
Now you can open the reality for eBay.
So let's go to our audio file.
And every day, a simple dial into Beeban.
And then here, if he spend years and go through the ice, that we can see why the function is being
exported.
So there is one function call.
Say hello.
And then he also be there.
You can see the structure of the for every program in windows is called the B, e, fo B stands for
portable executable format.
So if you want to know more details, p fa structure, you can refer to this.
Tigran, we showed you some detail.
Every P for we have a header and the header consists of a dossier doing a desktop and followed by some
other headers here.
Otieno Heda session tables.
So at this point in time, we do not go into too much detail about this, just knowing that there is
such a thing as a behavior that identifies the fight as a B file, an executable file, or niloufer
this structure of the AP header and contents can be seen here so that he has the DOS header, which
is here.
And if you click on this does header, you can see the AMZIE meeting right now, Amesys matching base,
which is a zesting in all be false.
So when the moment you open fire movie in a hex editor, you can see these Amzie and you start.
Which means that this is a portable executable fire.
The other telltale sign that is Beevor is this string.
This program cannot be run in DOS.
Not so when you see these two things, you know for sure that this is a P, as if it were a fire detail
as well.
Both has got these telltale signs and.
And this string.
Now, you can also see I mean, and EKU far using B there.
So let's say we now drag our SFR in here.
Django, easy for you to be bad.
We can now examine the file as well.
And you click on the nice header.
You also see the Amzie magic byte and the string.
This program cannot be run in month.
So this also seems to go far more fesco the same behavior.
So in addition to that, you can also see that he has other things as well.
For example, he has got the sanctions.
So are the sessions here.
You can click on this session.
He does and reviewed all the sanctions that are existing in the EIC far that the next session is a session
on memory where he contains all the instructions.
Our data contains realigning data.
Data contains all the global variables.
B, data contains these data exceptions and relock the information on telling the system to dynamically
load the base address.
Same thing with our dialer as well.
Yeah.
Also Haskell only section Cleeland sections you go to you go to session hater's you receive the has
also got the same thing here.
Right.
But the main difference between them and yes.
Is that there needs to export functions.
So you click on exports, you see all the functions, which is exporting for use by other processes.
Yes.
However, there will be.
The important thing is the imports, the imports, all those libraries, which it is using.
These libraries are the APIs coming from the operating system.
So if you need more information about this, you can go to this website here.
This Web site.
Back Okami picks, which contains a lot of nice diagrams, we can give you a lot of detailed information
about the behavior.
For example, you can click on these to download this if you wanted to.
And you can see that he has got in great detail about the structure of each of its SFR.
So that's all for this video.
Thank you for watching.