Hello, welcome.
In this video, we are going to scrutinize correct one to make it run wide open.
Microsoft binte.
So Microsoft pinnies program in your C Windows system, three to four year, you will find use Microsoft
being programmed.
So Kimie, one is the father here.
If you run it, he just opens a normal cookie.
You can give anything you check and give to the wrong zero key.
So let's get started.
We first opened a ST2 dbg.
And then of Shane's preference, certainly entry point is set and then open your.
Creamy one.
Now, your entry point put a breakpoint here.
You point out the Danny Netskope, a few lines here to see how many lines are going to overwrite.
Then he put a jump, so rightly copy selection, then open you look back and basically into your back
and is now rehung for our cookie is until you see all zeros in this column.
There you go here.
So this is a stunner you could case here.
This is all the attempt by the debugger to make sense of zero zero zero.
So this is not real, not real assembly code.
So he put a breakpoint, you have to recognize, address, copy and put it in our Noot.
OK, now we go back up to our entry point,
assemble and jump to our quickly to assemble the jump press space anikeeva and that JMB type zero X
and then paste your address.
You copy.
This is your quote, Keith Recreant Pace, so this Contrave.
Make sure you check for, you know, because you want to see what he overwrites.
So oppositely if you assemble the gym, it's going to overwrite this call, which we have to replace
it.
Time being OK.
All right.
So you just overwrites one instruction.
So the only instruction you have to replace is this instruction.
So the rest are still safe.
OK.
And then this all we can delete.
So at an insider good care, we have to insert this instruction and then you jump to this address.
So we just put it there first to remind ourselves that these are two things you need to insert in a
court case later on in order to be able to continue with the original court execution.
So inside a court, the first thing to do is to push Haiti and then push Avdi and then put your shellcode.
Can you need to put the ball aidi and then put this thrashing?
After they put this instruction, they say that's all we need to do.
So let's do that now.
So you are here.
You click on this, you see the red line.
It means he's going to jump to Sherko so you can follow it by double clicking this or pressing enter.
OK, so now you're here and beaning of your circle.
So a press piece and then they push it, push it.
We save the content of higher registers by pushing it to the stake.
We need to do that because later on we want to resume the original program.
So we need to put back all this step.
The registers were in before we jumped to our shortcut.
OK, OK, next one is Bush Afy Bush, I did receive the register a flex.
Which is just one, two, four, four.
OK.
So the next one is you can put out what you say here.
So to get your shako, we open our Chalco here with her hexameter.
Like this.
And then we do the right column, so we click on view and visible columns, select hexagon.
Then we need to copy this.
Including the zero zero.
And important.
This is important because it is at the end of the string.
How a chocolate and give her the name of the program once F-Secure, which is a string actually, and
has been followed by another minute.
So another matter, the string.
This why you must make sure you include it.
So this is a one by one.
So we copy Rackley.
Copy this.
And then we come back to how here we are going to insert our Chalco here.
So you select this line.
And then scroll down.
No need to go all the way to the bottom somewhere here, we do make sure you select enough by morning
196 because our schedule is only six.
Vice President, hold down the shift key and click here to select all this.
Now, Rackley binary.
And then edit.
And then here he sure is like the first by Contrave to pace your shellcode.
So now you see.
Compared with your Hex editor at first base FC, FC, FC, there are some eighty six five zero zero
your last two base, six five zero zero, OK.
I can go back up.
OK, there you go.
So this I wish I could start from F.S. here.
And three six five zero zero zero zero here is part of the show.
So next instruction, you start here, not here, because if you stay here, you all right in Dallas
and by.
So we start here and this is where we can assemble from F.D. Press, the spacebar top heavy.
And then next one will be pop Haiti in reverse order.
OK, is in reverse order from the Bush because he's stuck here.
Push, push and push ahead.
And then here you reverse it from the fallout from Haiti.
OK, so now next one, we are going to insert the quote, the overeaten and is done.
So just to remind you, we all written this.
This line is caught in the entry point, so we have to put it back now.
So what we do is we hear a symbol call zero X.
And then copy this address.
Right click, copy and put it back here like right click, OK?
Right.
So this is to call obviously overwritten at the start of the entry point when we assemble a jump, just
to remind you.
Originally that was a call here, but we changed it to a jam because he they jumped to our shock, to
our cookie.
So now you had to pull back the instruction overwritten.
OK, that's the purpose of this.
Now, the next thing you want to do is to jump back to this right so called place.
This is address at the entry point.
So copy puti here.
Press spacebar and pace.
And remember, to put your accent in front, because this is hex.
And you no need to feel guilty.
All right.
So the purpose of this term is to if I click on it, I can fully, easily jump back to the beginning
of the entry point just after you jumped the shark.
We see here, we jump to the cookie and here we're coming back from the cookie.
All right.
So that is the meaning of this.
All right, so.
For who uncrazy for his to check, make sure he got it right.
All right, great.
So now we are ready to veggie.
So let's patch it.
Big match.
Evening goalie cracked me to
say.
Now make sure that all the pages are black, sometimes you get less.
No touchscreen like probably like one night out of two or five or something like that.
EVC then that means your cookie is not big enough for you to fetch.
Right.
OK.
He goes, no, you can stop this and then open your independent fire so you open a new new file and
fix the exit doors.
SHACKLEY Now if you run, you see, I can assure you, I mean, keep open.
Rohini Rano.
How shall Covid launch Microsoft Paint?
And then you see Microsoft being run by the correct me when they cease.
So there is something wrong we have to fix.
And who do that in the next lesson?
Thank you for watching.