Hello.
Welcome to a new session.
In this video lesson, we are going to reverse engineer Cookie.
As we all know before, a shark caught in a cookie can execute the program, needs to safety registers
in inflects.
And then additionally, after the shark has finished, he needs to restore the Fleck's and then the
registers based on these two characteristics.
We can search for expectance 60 Nici, which marks the start of the shark appeal.
And then we look for the corresponding hex pattern.
Ninety six one, which marks the end of the shark look.
So between these two, we can identify the Shakuri cell.
So 60 is push had a nice push Ifni, which refers to this region.
The concave receives deregister and set a flex.
And in here from F.D., he's 90 and then probably sixty one.
So at least to restore the flies and Prop 80 is to restore the register.
So let's get started.
So going download this project, reversing cookie estrogen and unzip and put it in a mound for the.
Then open a DBG 32 bit.
Big on the options preferences, make sure that entry break point only is checked.
And then open the correct me.
Cracking the tree, which is in this folder, which you have just on the.
So now we can look for the pattern.
The expected sixty nine seat.
So to do that, we just right clicking here.
And then scroll down, search for current region.
Pattern.
So the pattern here, you are going to type in six zero nine C, six zero nine C again, select entire
block.
Click OK.
And the results will be shown in the references dead and so on hit.
He has found Bush 80.
So right click on this address and select follow in this assembler.
And it takes you right to the beginning of the cookie.
Over here, you could have also reshare by following the Jumeirah entry point by sometimes go against
me, you know, jump at the first line, the entry point.
So this method is more reliable.
So Nadia found this, you know, is the start of the court case should be just one.
Based on her understanding of the anatomy of the court case, they sure comes after you have a 80 and
push hefty.
Now we need to identify where does it end?
So we need to look for.
The property and property, so for for that, this is the one we are following these two wishes here
and heading back Bush-Cheney, and we shall now we need to look for these two to look at the end of
the circle.
So to do that, we can either you repeat this search or easier just to scroll scroll down and look for
a 96 one or Picardy probability.
So you just can just look in this column and you shouldn't have any difficulty finding it.
Here you are, probably 50 and pop lady.
And then you can see 96 one here.
So this marks the end of the circle, the end of the circle is over here.
Over here.
So now we know that he shellcode starts from.
I'm here so we can follow this in the dumb, dumb one.
So we just select this address.
Right click.
And gang following them selected address, and they will.
So six zero nine C.
Is Bush-Cheney, which you can see here year and I see.
And then the enemy shellcode is.
Nine or six one nine oh six one disinfo, nine oh six one.
Six one.
This is nine six one nine eight six one over here.
So your Sherkat is from here to here.
Deselected, but six zero nine CCRA push Haiti, push Aidy.
This is one issue, pop and pop, 80.
So you have selected.
You can dummy so directly, you can also see the spin dicy and the noncommital here Eastend Automator.
So you can no dummy by, right.
Clicking the selection.
Going to binary and click Cifas.
Navigate to the folder that you want to see in.
So we can give it a name.
You can call it gum.
The bin Laden thing on safe.
Now you can close this.
And going to see or dumby.
There you go.
To a better view, you can open it next, Ed.
And you can see the start of the chocolate and English.
So that's how you can reverse engineer Cookie Trojan and done the chocolate.
Thank you for watching.
I'll see you in the next video.