Hello and welcome to a new section in this lesson, we are going to reverse engineer malware base64,
including EIC and unpack the basis for encoding chocolate.
And the objective is to unpack the chocolate into the original base64 and also later on to I'm begging
for that to get back to original before you encoded into basically four.
So let's get started.
As you recall, base64 encoding EIC is the malware we created in the previous lesson, very encoded
Chalco into Base64.
So just to remind you what listing does, we will copy this part here and then open.
A man from excessive force wanted to saw even a normal command prompt navigate to this folder here in
Denver to run this program.
So now we're here, you can see the prince of the base addressing yellow men.
And I see the press enter to the basically for a copy to allocate that memory.
See the president, he on a second problem as the press enter to career track and you tell again he
will dictate the show.
If I shall quote.
And then there shall accordingly then run the whole bit.
So this is what he does.
Test you refresh your memory.
So now to unpack this chuckled.
You know, basically for Chergui, we need to use x dbg.
Yeah, 64 bit version.
So just fry up your electricity for the IBG.
And options, preferences, he only entry point is checked and then click file open and go to the folder
where you have your project.
So before you can do this, going down this project, reversing base64 and zippi and put them out there
for the.
So let's open.
Yeah.
Now we basically find Guti
and then we are going to put several big points.
I've already done this.
And these are two big points which you need to put.
So the first one is what you protect.
Second one is Koczela, and that one is good string to binary.
And to put these great points, you just time BP followed by which you line up, hit, enter, and then.
What you think he'd enter and then good.
String.
Do binary a hit enter.
So it's how you sounded to make points, make sure they're all three or you send it.
And now either run the program so many you run, you hit the first, which were luck, and then you
step away and then you come to call this call.
Then you look at the parameters for the call here in.
And as you remember from the previous lesson, the second parameter, the second parameter is the long
term memory contains the address of the memory, which starts to allocate the memory.
So we need to follow this in.
So replicates and follow in them.
So now maybe several of these you will see that the value start C followed by four zeros.
So you can actually go there now.
So I can jump in here to expression.
She followed by four zeros.
So this is the witching hour long allocated memory.
And then now we run again.
And now is waiting for us to press enter.
So we press into and he hits another break point, keeps trying to binary.
He restrained in binary.
He's got all these parameters.
The first parameter is he pointed to the string that contains the formatted string.
We call it that.
So you can look here.
The first parameter.
You see this location so you can go there in them and the tree and this followed them.
And this is the and could at this point could a shock.
And then the second parameter, you see all the number of characters of the format history to be caught
with it.
So you can see is one seven five hex.
So one seven five if you move your mouse over.
You can see the popup dress, one seven five zero zero zero zero zero.
So one seven five should be here somewhere.
One seven always here.
Can you move across to here is one seven three.
As you can see the popup show you one seven.
OK.
So all this you can highlight.
So directly in binary select shift file, you're going to go to our contact folder.
In this for reversing base64.
Yeah, I'm going to call it dumb.
Don't be 64.
To remind ourselves and this base64 included Chako.
Now we showed you Codi so we can open a new terminal.
Go down to here in California, keys tooth.
Copy that path.
And if we get there, we used to kill combine to decode it with a dash decode barometer, provide the
profile.
And providing De'Monte help with far reaching according damnably, now you enter.
And he says, combine competing successfully and you will see a new fire here, -- on being, which
is to decode it from basic.
So now you can compare it.
You can go and use it.
You can use Hex editor to look at them.
Open Hex editor, hasty drawing, you know, been into here and you will see, I'll bet on Etsy and
eBay and about them.
And you can compare this with the original Sherkat, not Benjamín.
And then I've seen both of them.
I see.
So we're successfully and back the basis for collection mainly by using the.
So you to combine to do it.
Another way to unpack it is to area and base into memory, because we know that he has allocated this
region of memory from the abushahla earlier.
So we can continue this now by running.
And so now he's what's important.
And we see here he has an Bazo from the circle, which is encoded base64.
He hasn't banked decoded into this region in memory.
And you've also done this now.
So the solar is up to here.
And it's frankly binary safety or fire.
Mr. Nalgae.
And then you can call this done to them, do not mean
and then now you can open them to inside your case editor
and you see the same here.
So these are two ways of how to and pay basically for and a chocolate.
So that's all for this video.
Thank you for watching.