Hello and welcome to a new section in this video, I'm going to show you how to reverse engineer a scription
using it.
So now we have here malware which we created from a previous lesson.
I think, you know, I see you are going to use ACTG to reverse engineer this and decrypt the encrypted
mail and dump it in another file.
So going download in this project, in the resource section, unzip it, put it in the mail for you.
So let's run our Viju 64 beta version and then options.
Preferences, sure.
Entry breakpoint is set and the others are all on checked, click on file and then open your.
Project for the country.
Yes.
Click on the EIC openi, and now we are going to put breakpoint on candy.
Can you criticize us by email that to decrypt the cushion before executing it, before we execute you?
So that's why we put Breakpoint on this.
So check on take on the breakpoints that come down to the bottom in time, be critically
hit, enter and Hannibal.
So now we just run.
Before that.
Make sure you click Symbol's and go to a think tank.
Meanwhile, you can run to synchronize.
So it now is synchronized and is waiting for you to press, enter to decrypt.
So just hit, enter on your keyboard and immediately hit our breakpoint to decrypt.
And then we come down to the parameters for decrypt and give you crepuscule.
Six parameters in total.
As you can see from the MSD documentation.
So that's why we have to come down here and increase this by one so that we can see all of the six parameters
here.
Now, the one that we are interested in.
Is the fifth and sixth parameter, your fifth parameter is the location of the address of the payload,
which is encrypted, and then the sixth parameter is a location on the address, which does the length
of the payload.
So we need to go to these two locations in memory and take a look at what is in there.
So the fifth one parameter you can actually scroll down to read or description immediately is appointed
to a buffer that contains the data to be decrypted.
After the decryption has been performed, the plaintext is placed back into the same buffer.
Demissie overwrite the encrypted data to decrypt one after he has the capacity, and then the six parameter
is a pointer to a given value that indicates the length of their DB data.
And this is an experiment that shows you the length of the bill.
So let's go to the fifth parameter now to see the bill just right click on this follow in done, which
is by default done, number one.
And this is the critical group that async.
And then to see the light, we need to go to the sixth parameter.
But first, you select them two and then follow this in dumb to rankly for low income.
And you can see in them two values today is one to zero in Henkes.
Remember, this is little Hengdian convention because process, entire process.
So you have to really reverse.
So the length of the included below is one to zero in hex.
That means from here you can take this value.
The offset to f7 seals.
You want to go to this, you get the line.
Critical.
And that means you take this address to F 70 plus values to this address.
One to go.
You did it later after we did.
So now we're here in the Encrypt Decrypt API.
So let us execute this.
We have these parameters by clicking on this Runtu user.
So when you click Rantes record, he will execute all these and go back to the user, Miyu in it.
And then you see the decrypted payload overwriting to this address.
Now, before we do that, you can click on this and follow in memory.
And notice that the encrypted payload is on the track.
Known as EFC, it is on the stack.
So AC is in hexadecimal.
If you want to see the value in D.g in decimal.
You can convert it by using a calculator and then EFC and he will convert it to two, A1, two.
So if we want to you can go to trace.
You can see check to A1 two.
This is a stack containing Peter.
So now we know that this bill was created in function ghettoised on a stick.
It is not in the data section or he may.
Have you seen the stack?
OK, so now you can execute this by going to court and notice it has overwritten this.
The address, which was previously encrypted and now is indicated and overwritten, decrypted.
And then the line is previously we saw was one two zero one two zero.
So we can go you can use this value one to zero in hex it to this all set.
And you know how much of this is the decrypted bill.
So we take two F seven zero clue to the calculator to have a seven C zero.
And today, we at hext value one to zero.
We get to ever hit you.
So we scroll down Nilufer to ever hit EOH, which is here.
Which is here.
But because our offset starts at zero, so we have to minus one.
Come to here.
So in this order, this is our decrypted bullet.
Yes.
You can see the last string is not bent on the icy.
Initial initia is supposed to run a bit on the.
So that confirms it.
So now we can dump this.
After the senator, all of this erectly quoting binary and then safe to a far, and then you can drown
this in email and go to the project for the weekend, you can call this a yes, if you could take
a yes, decrypt decrypted B or any other name you prefer.
So let's see if now.
And then you came to the stage.
Now we want to check to see whether it is the same content here if the original Chalco.
So now we can open both in Hex editor.
So let's out how to go to fly flat hexameters.
Open up.
And David, how he kept a binary in here.
And we also have a note that not been the shock before he was encrypted in here.
And now you compare.
We see both are identical, exactly the same.
I said that.
And this one has quite a strong knock.
Right.
I turn it back.
So.
This confirms that we have properly decrypted were so we see that any.
So these kind of things, you have probably nicotine gum or chocolate.
So that's all for this video.
Thank you for watching.
I will see you in the next video.