Hello and welcome back.
In this video, we're going to baldies.
And if you look at the for the South for this project and how the compiled script here, if you open
it, if you look back plus plus, you can see that the parameters to take the code.
And Campari and EIC.
You hear this and it's a 64 bit.
All right, so let's do that now.
So we need to open a 64 bit environment, common problem.
So we go to the bottom left corner and type Netiv and then open this one xixi for native tools combined
from four weeks to a nine.
He sure he got the right one, you can see the title here, and then we should change to these fuda.
So is click on this correctly.
He copied it off.
Come down here.
That CD to choose directory is spacebar right click the paste part pressed into to navigate to the new
location that India are now to see the contents of this folder.
We sure the compound that screen is there.
And then now you can run this compound script by typing file name on the Apache script and press enter.
And they if so, if the bill was successful, you should see a new, far higher bill in taxation to
see.
So to run this new E.S. far.
You just taking the name of the fund, but before less time the hour to see the content of the yago
the following.
So to run this now, just take the name.
Bailando fatal in taxation and press to.
So at this point in time, issuing your chacal Pilates and dress and also the allocative memory address,
which is coming from let's open this now to SARS-CoV-2.
Take a look.
You are not back.
So this message here is coming from this Freenet.
So as you can see, it brings the Chakotay to address coming from here, which is the array here, here
that's in disarray.
And in second is the address of the allocated memory from the which are long, which are successful.
Take this memory and you are printing out here to see.
So what you seeing is coming from this line.
OK, so now Nonnatus copy is just so like this is most likely to copy and come up to not back here and
open a new blank file from you.
And right click basing it.
Are we going to analyze it?
OK, now we can attach your debugger to this process and it is still running.
Now he's asking you press enter to create Shreck.
And this message is coming from.
If you go back to the source code, you can see it is coming from this line presenter to create Trent
in his boss here and get Char to it for you to type something before he creates a trick in 1999.
So before we create a generated name and that is attached to a debugger to open, you asked for the
this is for beta version.
And in.
Before you open and here in ocean setting preference.
And check system, break point and in the context, live only into Bitcoin, check and click save now
open, not open, sorry, take file attach.
And then here look for the running process.
This is a running process below in taxation.
So now attached to it after you selected it.
OK, now we just attach and you can click on Symbolics and select.
The bailout, the main function here.
Main menu, day dangling run.
So a nice synchronized exit for the Biji with your running process.
Now we are ready to press enter here and watch what happens when the press enter.
Watch what happens to your acidifying TVG.
Student salivated jumps to this region in memory.
Stop here.
Now, if you scroll up, you will see no, no entry.
And that and that is coming from your Chalco here.
Why does that happen?
That happens because your creator has run to the shellcode and this address and.
That is why he'll actually be stuck there because of the entry instructor.
He wishes to seek hexadecimal, serving as TVG 63.
He will hot down the breakpoint.
So this is how actually we stops at the break point, because this is a break point.
So we are using a shackle to put artificial breakpoint so they can hard for you to examine.
We can actually look for this in the memory map.
Just go to memory map rightly anywhere here and find PETAN.
And then here he Sherko reaches nine zero nine zero.
C, c, c three.
Right.
This is a Chalco here.
Nine zero nine zero, C and C three.
OK.
And you will find that reheats.
So now let's copy this to our notepad.
So we erectly men who are here.
Click copy corruptible in any container.
OK.
And then we came back down here so that we can analyze it.
Now, take a look at the first address.
The first address is one B F one zero, which is your Sherkat payload address, this one.
So you go back to memory make.
One VFR, one zero should be somewhere here.
This is a.
And you can see on this day.
Now, what is this thing?
A state is allocated regional memory for local functions to run.
So that is the meaning of a state.
So is allocated for a trick called nine zero C see, I think nine.
This is only nine.
And if you go look at Trent here, you can see one on this is the track.
It is 93.
So 96 in hexadecimal.
You can use a calculator to convert it to the decimal.
A nine.
The C is two five to four one two five two four zero.
So this is how one is in suspended state.
So in this region of memory is says think why is our string this one following the state?
I hear why is on the state east on this thing, because if you look at the SARS-CoV-2 here, this thing
is in sight, the main function.
So anything has been declared in Senate function could be found on this tank.
So that's why nothing is fine in the state.
As you can see here, state.
Now, let's go to the second one.
The second place finisher is found in this address.
Let's go back to this one.
Yes, one onesI followed by four zeros now one C for about four zeros.
Is here the result of the virtual lock?
Now, if you look at law, which are allocated memory and ST2 allotment, and this is what it is to
allocate memory, which I know has given.
So where is this fun once you buy four zeros?
You're looking at memory, then one C followed by four zeros.
He's over here and he's already selected.
Highlighted.
Why?
Because your program has halted here.
Because in the breakpoint.
Right.
And that's why you see the.
Take a look at this.
This region of memory was previously readable and writeable, but again was changed to become executable
and readable, right.
Because of the virtual thing.
If you look at a Sasko here, this watch alone sets this region in memory to be readable, writable
by when you came to watch it for a day, you change it to become readable, recyclable.
That's why you get e r.
This one.
So this is your your original memory that has been allocated and by which.
OK, let's take a look at the next one.
How about this one?
One tree F nine six oh, one E.
So if you look for it in memory mett, it is over here under the taxation.
One tree F 96, one triple zero over here in this region in a taxi area.
So as you can recall in the earlier lectures, the test region is where the instructions are fun.
So we can actually go there now.
Right.
Click on this and follow in this assembler and you screw around this region.
You should be able to see your court at nine or nine 00, C.C.C. three.
So this is the text region in memory.
OK, so that's the meaning of these three locations where you can find your shako.
So that's all for this video.
Thank you for watching.