Hello and welcome to a new section.
We are now going to do reversing function obfuscation.
So please go and download this project and zip hoodie king.
And therefore, on your desktop incited, you find a function of whiskey to EIC, which we created in
your previous person.
So this function of Coskata, easy Hights, which function call so that if you were to open this with
these two, you you will not see which are ADOC or.
The string, which I like so we can try now.
Be open, be studio.
And then if you drink the esky fast, we used to do.
If we click on Impulse and click on group.
And memory, you will not see any virtual clock.
Same thing if you go to strings and so ascending by clicking on this day and scroll all the way down
to V.
You will also not see any which are OK because we have hidden, obfuscated the emotional strain.
And we also use the proper address API to dynamically look to virtual lock function during runtime.
However, we can still use reverse engineering technique to see what EPA is being dynamically loaded
during runtime.
So to do that, you use actually GBG debugger and a 64 bit conversion.
So let's click on this to open.
Treatment options, preferences, make sure that only the entry point is checked, then open the --
obfuscated.
Yes.
Fog.
And now we can put breakpoint on, get Proc. address, that is because from the previous I, I've seen
it get progress is used to dynamically look what you alac yo.
This is to MSD reference in case you have forgotten.
And these are the notes that accompany the previous lesson we shall also put in the current recession.
So what year law?
He's been loaded here and in here is see APIs that I used to know which are getting more you handle
to get connected to and then.
Going to try to jam the contents of which are lock and key, proper addressed to extract witchell from
the more you wish study to gain entry to the air.
And then here you run.
So that's why we're putting a breakpoint on get proper address.
So come down to the bottom here and put a Bitcoin vpe.
Get your address in there and then go to your breakpoint and confirm that you have gotten this breakpoint
set.
So now you can run and you get the address.
And then from here you see the parameters and get proper address.
Get proper address has got two parameters, Monju and Brotton in.
So we are interested in the second argument, which is the proper name.
From there, we can know what API is trying to dynamically.
So from this you can see to the API is loading is initialize critical section.
King run again.
In his great address, again, this time, India is trying to look at a.
Run again.
And I said, Will you run again?
Initialise critical section, ran again.
And if I CELAC run again ever S.K value ran again.
And asset value run again.
No strings.
Running again.
Favia I wrong again, but which are?
So this is a simple way to find out all the functions or APIs that that particular Melva is trying to
look dynamically just by putting a breakpoint on get proper address is all we need to do to see.
So that's all for this video.
Thank you for watching.