Hello.
In this new session, we are going to use E.S. encryption to encrypt the email.
Now, what is encryption and how does it work?
You can go to this link here, which I provided for you in the following year.
We saw of session and read all the details about it here.
If you are interested in the inner workings of this encryption.
So for our project, go in this file.
Zero five is encrypting payload and zip and put it in the malware folder on the desktop.
Inside it, you will find four files.
We have to compile that which will compile your source code into the new malware EIC.
And then we have the new Python script, which will take your shellcode north baton bin and encrypted
using Aiyaz encryption.
So let's take a look at the Python script first.
The opening act is not bad pass plus.
So this Python script to use encryption key, the length Peattie 16 characters will be randomise using
the random function.
And then we have pet function, we access s, which is the string.
And then you return this combination of operations and dispatch function is using another function called
the U.S. could be access to input, the plaintext and the key.
So the plain text is coming from the parameter to this script.
And the key the key coming from chinky here.
And this function is called function, this function call here.
So inside these two functions, we have the details of how it works that require some advance knowledge.
Yes, InnerWorkings.
And we don't go into it here.
But just remember that when he accepts, he it enticing key will do the action and return the ciphertext,
the main entry point.
So we're here where you're supposed to file for re.
And after reading it, we save the content of debt file that far will be or shall we say it in plain
text variable.
And if there's an error, if the user did not provide funding, it will print the error showing the
usage of each script.
Can you exit assuming the user has correctly provided?
In fact, he will not proceed to this line.
We will call this function call.
He is encrypt.
He will pass the sherkat and the encryption key coming from here and to this function.
So this function will make use of the sherkat and a key to do the encryption.
And then you return to the caller.
So when he return, you come to this line and you'll be saved in this variable called ciphertext.
And then you print the key as well as the Yankees payroll.
So this print here will be coming from the encryption key up here.
And this print here will be coming from the ciphertext, which is written from this function.
And then once you finally got this encryption key, as well as the encrypted ciphertext, you take both
and put it in this file.
So let's open this file.
So in this file, you have a new function called decree.
Yes.
And you have the main function.
You will pay to include that payroll here and you base your encryption key here.
So these two are coming from the output from the Python script.
And then the rest is almost the same as the previous Zuwara encryption.
He will create the he will calculate the size for the payload, submit to this variable.
He will call which you to allocate memory.
And then you will print the address of the payload, which is this one and the Alcatel memory coming
from which you are OK.
And then you will wait for user to present the key, and then you will call the police function, which
is up here so that you could ask function to accept the encrypted below the length of independent encryption
key and the size of the cushion key, which is calculated on the fly.
You would come here and perform the decryption and the decryption he misuse of the Encrypt API in Windows
operating system.
And these are the four permissions which comes when we include the five functions, which comes from
Encrypt.
And if you are interested, I provided the link for us throughout.
You can go in now.
Sfar contains all the links for documentation, for all the functions, and then the explanation is
all here.
Starting this first function, quiet context, which explains the parameters for this one.
And then next one is your.
Barometer for barometer one, two, three, four if our barometer of this function is where you push
for weight and whatever encryption you want.
So in this case, we use the p r we rc s constant telling.
That means we can encrypt this idea using RC or he has an explanation for that.
He's coming from here.
He's here cryptographic provider types.
And this Asao, the provider thinks you can read about it here.
All the other stuff we're using is this.
And then the next function is to create hash, she is coming from here.
You can read about it here as well.
And what the parameters mean, the important one is the second parameter where you are going to create
a hash out of this provider and then setting this variable hash it handled through the hash in the hash
you're using must provided in a second parameter.
He has an ID.
In this case, Qadhafi's next one will be hash data, which is explained here.
So.
And when you start, you calculate the hash for the key and say in here.
And then the fourth one is the crib drive key, which is this one can derive key.
You can read about it here.
How he looks and the barometers and then you can see the second parameter is the algorithm, Heidi.
So in this case, you want to use the ace encryption devices.
So that's the important thing.
The second parameter is a telltale sign you are using.
Yes.
So here you derive a key and you save it in here.
Henschke.
And here you pass this key to decrypt.
And if you stay.
And the payload to decrypt your bill and save you back to the bill.
In explanation for that function is strong here.
Here you can read all about it.
And you see the BBC data is here and potatoes has spin here are pointed to the buffer that contains
the data could be decrypted after the decryption has been performed.
The plain text is placed back into this same buffer.
I miss you.
All right.
Yeah, Bill, when you pass the payload, which is origin encrypted, you take the key from the handle
here and then he would be all right if the decrypted data.
And then you have to release all the objects after to complete it using the API for action decryption
functions.
And then once you've decrypted it, epilog will now be overwritten with the decrypted data.
Then you will copy memory from the payload, which has been taken into the allocated memory and Covid
you're protecting executable.
And then when the user presses enter, he will create a check out of that allocated memory, which contains
a special court.
And the rest is the same.
OK.
So here's how it works.
And then the compiler script.
It's open in their capacity.
Will take your seats so far.
She's called a doorstep and give the phone over here.
So this is your output malgre, which contains he encrypted email.
So this explanation for all these scripts and files.
So in the next video, I'll show you how to encrypt your.
Shall we?
Yes.
And then build your output using the compiler script.
Thank you for watching.