Welcome back.
In a previous lesson, I already showed you how to hide your function, call names from the antivirus
scanners.
However, when we look at new strings and to you, you can still see who here.
So now in this video, I'm going to show you how to hide the strings by escaping it.
So one way to do it, a simple way to do it, is to replace your string Geetha encrypted string.
And then when the program runs, if we decrypt to produce back the origin, to allow string.
And basically this function as the second parameter.
So let's first close our B studio.
Now, in order to do that, we need to create a new variable.
So let's create a new variable.
You can call it string, which aola.
And in here, he uncomment this.
So this is truly shallow and this is what the story should look like after encryption.
But for now, let's pretend we don't have it again.
If you wanted to encrypt something, you need to decrypt it.
So you need to provide the key to what you were saying could be.
So in this case, we use a simple key.
One, two, three, four, five, six, seven, eight, nine, ABC.
Now, you should now use something which is suspicious, which would be easily stand out via scan or
any kind of string scan.
So it is something which is harmless.
For example, like a string of one, two, five like this.
You can also use any of the strings which you see when you need to be studio string skin, so any of
those species a day could be used as the encryption key, then baby withdraw any malware analyst who
happens to be scanning for strings so far.
So you're just going to keep it simple.
Who will use 123456 79 a, b, c?
However, there is one warning after encrypting your which our last name, you should make sure that
there are no not characters as a result of the encryption.
If they are, you need to change your encryption key and could begin until there are no known characters
in sight.
OK, so let's get started.
So now here you have already created you were able to replace the name of the which I locked the string
before encrypted string.
You are going to use who action.
So in in here.
We are going to pierce our encrypted so our string here, which is actually the which name in encrypted
form.
So because he is encrypted, we need to decrypt it.
So I'm going to uncomment this.
So here we are going to decrypt.
And this is the functional decree which is up here.
We have used this before when we did the actual encryption lessons.
So it's exactly the same function.
So we're just really reusing here.
So how does this code works?
So this could make this program runs.
It will go to the main here, main function, and then it will decrypt this string.
This encrypted virtual lock string, which is actually actually encrypted even.
All right.
This string with the name of the actual virtual string.
And this string will be used as the second parameter in a block address.
So that's how to get progress.
Knows what function that you are going to call.
So and the rest is the same.
So the only difference now is you are encrypting you are encrypting the name of the function that you
are using.
And in, say, here when the program runs, is decrypting it.
So now how do we get the encrypted string?
How do we take the string to allow and encrypted?
We will use a python script, which is here.
This is the Python script which you have used before.
Then we were studying x y encryption, and it's exactly the same script.
The only difference is now encryption key.
I put it up here.
Now, this encryption key must also be the same as the decryption key.
Then you are going to put in your main function.
So if you make any changes here, you must also added it here and vice versa.
So now how do we include this?
Now, remember that this script requires an input file.
So you need to create a proof.
Let's call let's create any Bufano.
Let's call it new.
Text document, and you will shivaya virtual
dead inside.
The idea is going to put one string which you add up, and then we are going to save this and use this
as an input file for this Python script.
So that Python script, we think this will open this file registry and then and create it.
We have the key, this key over here and output the result of the encryption in the separate file Debka.
So now let us save this and then close it.
And now we are ready to call this.
Python script using Python two point seven, as you'll recall, we need to provide a path to our python
two point seven, which we have done before.
So for me, it is in this folder C folder, Python two seven Python.
And then now provide the name of the Python script, which in this case it is called in GTV r.
Now, Lightning Nim input fire.
The input file is called virtual.
The steam.
Now, before you redirect to Aberfan, you just hit enter first to see whether there are any not characters
that is being generated yet is being created because of the encryption.
So in this case, there is none sometimes because of the key that you are using.
You may result in one on this character being or X or Y zero.
So if you see any way zero emesis and not character, you have to change the key and try again until
you get an encrypted array, which doesn't have any null character.
Now, the reason you should not have a nakata is because.
So in this case, it is OK, there is no not character.
So now we can repeat the command.
By this time, three, redirect to an output file, which will allow dot axolotl Hitchen to nowadays
a new file here called virtual SLR.
Let us open it, if not back, and then we can copy this.
Now, notice, voiture along has the same number of characters as this number of Bisha v i r t u a l,
a, l, l or C virtual l.
But this is, of course, the hex values encrypted in SLR.
So let's see.
That is copy this now.
Right click, copy this and then open your -- obfuscated copy.
And frankly.
And paste it here.
This is your encrypted string.
Voiture?
Encrypted.
Excellent.
Now we save it.
You remember the save.
So now let's check one more time.
I mean, this function runs you comes to this line 67 that you call decrypt.
So are passing the string, this string, this array, which is encrypted.
And the length of it.
So the length of it is automatically calculated on the fly string, which allows the encryption key,
which is here.
And we became sure that this encryption key is the same one that you use when you were encrypting it
with Python script.
And then the last perimeter his size and encryption key, which is also calculated on the fly after
that, he will can't get progress address and pass this, decrypt the string into the Caprock headdress.
So now we are ready to comply.
So let's run the Kompass script.
And now let us run the resulting CFR.
He didn't gain any looks.
Now we shall open peace to you and then open our letters, followed by dragging it into the studio.
The studio has finished analyzing.
Now let's go and look at the imports.
This group, according to groups and the memory, do you see any moschella?
No, it's good.
Now let's go to the strings and then click on this to sort it in ascending order.
And let's go down to V under V and see if we can find Michelle.
Gone see that we only have woodchipper thing, which Allah is of.
It is hidden.
So we have successfully obfuscated our what your Allah function call.
So now you know how to obfuscate your -- calls and hide your -- calls from antivirus.
You can do the same for any other function.
And you want to obfuscate.
You want to hide.
For example, you can hide, worship or think you can hide.
Great threat.
You can hide a career track.
You can hide and move memory.
Yes.
About a new function call that you want.
You can hide.
Using this technique of doing so.
So that's all for this video.
Thank you for watching.