Hello and welcome to a new section called Functions Association.
Now, what is functions, obfuscation, function obfuscation means that you're trying to hide the functions
that you're using so that Andy Virus cannot detect it.
The reason why we want to hide that is because antivirus sometimes detecting whether a particular application
is malicious or not based on the type of functions that it is using.
Let's take an example of a new project here going down on this and zip and putting nowadays 06 functioning
obfuscation.
Now, let's open this file functioning, obfuscated the CPP.
Inside here, there is the usual people in this case, it is the Chalco to run.
Not that no say here you will see in excusal.
Which lock move memory?
Would you protect, create training and so on?
Now, all this can be detected by antivirus and antivirus, the technology using this site.
This is a malicious program.
So that's why you and the high, somewhat dysfunctional homes.
So let's say we try to compile and run this without hiding any of our function calls and see what we
can detect.
So let's now open a command common terminal X Nitish to command from.
Company bar.
And navigate to it so you can buy.
And now we were running using you, Farkle.
Function obfuscated dout eic.
So let's hit enter into again.
So this shellcode opens up, look back.
So now let's see.
You try to analyze this fifth studio.
I put a shortcut in the desktop, you can do the same, just go to play and then open the treaties and
then Jack rankling in these two do to a desktop.
So now we will drag the malware in sight, the studio and let unionise.
Now, if you click on the inputs, you will see all the functions that are be used by this Malaby.
And you can group them take on group and you look at memory, which like which is pointing and so on.
So all of these are visible by antivirus.
So let's take, for example, we try to highlight what you ALAC.
How do we hire are from the antivirus?
We can use runtime loading.
That means we dynamically load the functions during runtime and we can do that using.
The more you handle API and the gate process address API, going download this file from the association.
He continues to notes for this lecture and the subsequent ones.
So as you can see from here.
This is how you use getting more under.
Assuming you wanted to look connected to the earth, because connected to the area provides the function
Covid Sherlock.
So you used this function to the country too, to after you get he connected, he too.
He was saving into his milieu and used it in the second function here called get proper.
Yes.
And you will supply the Hazmi you containing the country to you.
And from here, you try to extract their functions, which are from the country to the air and sea to
address.
So now that do this address, you can call it as a virtual function.
So this is how one of the ways you can dynamically look your functions during runtime.
Let's try this now.
So now let's see if we will close our piece to you.
And now we open our function, obfuscated CP.
If not, back plus plus.
So here, instead of writing the name of the function here, which Sherlock?
We don't want to do that.
Instead, we will look this dynamically, so to do that, we will use this baseline.
Let me and who will get the process handle?
Process address for which I long over here.
So in this year, we will give it a name which will allow.
And then the first barometer is the Hendo that contains the deal that we have to watch our law functioning.
So how do you know which a lot comes from going to do?
You can refer to the documentation for which you are.
Now, this is Majella.
If you scroll down to the bottom, you can see what the contents it connected to the URL.
That's how you know.
So that's why we're here.
And the first Bahrami to get proper address.
You have to call you get them on.
You handle to look at your data.
So the documentation for getting will you handle is also in the question.
So here you see again.
Will you handle.
And these are the parameter you provide the module name, which is going to take you to use a string.
And if you return the my you nearly 10 times more new.
So that's why you can call it directly like this over here.
You have also to declare address appointer.
So we are with you along.
So since we already declared address to start this, which are our lock function, we also have to turn
this into a pointer and address.
So there is a declaration we have to declare up here.
We can declare, yes, a global variable.
The easiest way is to go to the.
Emceeing in Copia, Your Watch.
Function call in nature.
And you come back here and it over here.
Next thing you do is you.
Turn this to a pointer.
So you in India says BTR, which along.
BTR, which I love, and then you cast it as a as an address.
So you put opening and close it here and you convert it into a green API dress, like putting the Assiri
symbol.
So now this is an address rather than a direct function call.
So this way, you can now make use of this.
Titled Nina Extravert.
So this is how you can declare an address for what you allow.
Then you can use it in, say, your main function over here by calling it politics.
And then once you get there, you'll be able to make use with.
This spring.
So now you can save this.
Try to compile it.
And we running again.
It still works.
Now, let us analyze it a piece to you.
We will drink in New York following the studio.
Now we click on imports and look under memory, you will see what it is missing.
So this is how you can hide the function call from the antivirus.
However, if you click on strings.
And then we click on this to a certain ascending order.
And if you scroll down to go to Allah.
And the V.
You will still see the string which are along.
As an excuse to.
Now, the reason there happens to be because you are using as a string over here.
That's why they're piercing the string skin.
So antivirus may still be able to detect your which function call through the string scan by using this.
So in the next video, I'm going to show you how to obfuscate this string so that antivirus may not
be able to find your virtual string in sight.
Strings can.
So that's all for this video.
I'll see you in the next to one.