I come back in this video, I'm going to show you how to take this memory and Becky, using a Ostberg.
Means we are going to reverse engineer and decrypt Batel and C to a separate dummy, not to a separate
file.
So now let us open this easy inside AKB.
If you before we show options, preferences set to entry point, you need to open open your encrypted
Palitha.
And now we are going to set some brief points, hitting a breakpoint stack.
And then down here, time breakpoint on which you haven't hit, enter an arbitrary point on what you
protect.
And he had to confirm them both day and then now go back to the CPU.
And now you can run.
So now he's going to call Machala.
So that's temporary.
And then he come to the call here by stepping away.
Look at a second parameter, how the X.
The second parameter to watch out to these empty allocated for your memory is the address is tossed.
The value of the address where you allocate memory.
So you need to follow in Gangwon in order to see.
So you set it down one a rankling s and follow in then.
So now he's going to store the memory address here.
Right.
OK.
So now we step away and we see here is the address of the newly elected memory, which is one C followed
by four zero.
So you can go to Dunolly to directly and go to the expression one C followed by four years.
OK.
So this is a return memory value.
So you would include the shortcut, the encrypted Exline cryptococcal and dummy here.
So now let's run and see that happen.
OK, so now there he is, waiting for us to present.
So we enter and then come back here you see he has an Bazo into Canada.
And you can see here the last string is not bad.
At this point, you can dummy if you want to wait for it to run with, but you can also do that.
So it's up to you.
So let's say we go ahead and follow reciprocating.
So we step up with a young to watch a day and come over here.
And then now he's going to execute this.
Look, Handies, again, perimeter the security perimeter to watch Apotex, is the region a memory that
is going to change to the mission?
So at a moment, you can follow this in least following them, this Havelin dunam victory, following
them in the tree.
And then from here, you can see he says him and he's done them to the same fire.
So he is actually going to change.
But we shouldn't be for this region in memory to make it executable.
You can see it happening by falling here rightly following memory presently.
You can see it is a and right there.
But let's tamper with these things that happen.
Step away now is changed to executable.
So now for sure, he has finished with this time.
He's going to execute it.
And probably this is the best time to me.
So now you can select all these decrypted, Schuckert, rightly go to binary safe through a file.
You can see over here.
Not that the gun clicks here.
OK, so now we're done.
We can stop this.
We can use our hex editor by opening as editor.
And you're going to compare the newly dumphy great and you say here first and then compare the 50 or,
you know, chanco.
So it could drag it here and now you compare it to anything else.
So we successfully by the X Y encrypted Baylor.
That's all for this video.
Thank you for watching.