Hello and welcome to a new section and coding all encrypting Pilates.
Why in court or why encrypt and could only encrypt ballots in order to prevent antivirus and reverse
engineers from detecting a malware SMB antivirus use patterns of bytes or string switches to detect
malware signatures?
Chako parents have bounden malware signatures, so encoding an encryption scrambles the data to make
it different from ground signatures.
That's defeating antivirus and also making it difficult for malware analyst and reverse engineers to
study the information.
What is the difference between encrypted and transforms data from one format to another format for use
by another system.
For example, sending binary data over email, the binary data would need to be encoded into a certain
format which is suitable sending over the Internet.
On the other hand, encryption transforms in data from one format, also known as plain text to another
format called ciphertext, using a secret key so that others cannot read the hidden information.
So the purpose of encoding is usability to make it easy to use the Internet for transmitting data.
For example, by the purpose of encryption is to hide data from those who are not authorized to consume
that data.
The difference between the two is that encoding does not require a secret key.
If you know the algorithm for the input, you can also use the reverse algorithm to decode.
On the other hand, and Kruschen requires the recipient to know the secret key.
So a person who receives the data, which is encrypted, would not be able to decrypt it without the
secret key and sample encoding and encryption.
And Ghadames Base64 is an example encoding algorithm.
Axel, are you saying Cushiony and Gardam?
Although it's a simple one and.
Yes.
Encryption algorithm do.
So now we are going to take a look at how you can use encoding.
Go in, download this project.
Zero three base64 encoding below, unzip it and put it in your mother folder in just to open this folder
and you will see a few files.
We are going to take a look at the CPP file base64 encoding CPP open you back plus plus.
So this is a sample of a base, 64 people.
And then here is an example of a program which can decode this base64 and then execute it as you see
Gazoo new function here, which is called the base64 and copy to allocate their memory.
And here is the main function.
We also have to watch how long it will allow these to reserve her memory location for unpacking the
base64.
So over here, after his allocated memory, he will pass it to the variable and then he will print the
address of the obesity for formula, which is this address here for this array.
And then you also pin the address on the allocated of memory.
Then the program will help here and inform the user to press enter in order to decode base64 and copy
to educate their memory.
And you will pause here and wait for the user to press the enter key after the user has pressed into
key.
He will proceed and execute this function.
And this function is actually up here and define up here.
If I set these parameters, this is user defined function.
So you set the first parameter is the basic for payload, which is actually here basically for people.
And all this is in the data session.
Is it because these are global variables?
The second parameter is the length of key vestibular base64 bill.
And the basic torpedo is here and the length is calculated using this function size of synthesizer function.
Says he built a calculating return this size stores in this variable and this variable is used here.
The second parameter of this function, and then the third parameter is to allocate memory, which came
from the what you ALAC over here.
And finally, the last parameter is the length of the box.
Again, repeated twice.
So when you call this function, you pass all these parameters into this function here.
The first parameter we set this this default payload, and then you say here he will call this function,
which is provided by the Windows API.
It is called string to binary.
He's in MSDS documentation.
This function accepts seven parameters.
In the first parameter is the string that contains the format string to be converted.
You know, what it does is to convert the basic for into binary format.
And then to it.
In another variable.
Who are here?
So you accept your source and then do the conversion.
And then saw it in another separate variable, and the third conviction that you need is specified in
that parameter.
In this case, CREP string, basically base64.
Which refers to here.
They took parameter so that that barometer is that from the string to be cool with it.
It can be one of these values we are using.
This one string could string base64.
And then here is the allocated memory, which you pass from this function call.
And it came from the ritual.
And the next parameter is the length of the output string, which should be the same as her sustaining.
So as you can see over here and you call this function, you are basically for Peter Lang.
He's provided twice here and here.
It means your source name is the same as your destination line.
The source name.
He says they may see how could name and the last parameter we just leave it has no return of this function
can either be true or false.
We should be reseize, actually, this variable result, the return.
This function is a bull.
Now, here, he says the return value, if the fashion succeeds to return value is non-zero.
OK, so here if the function succeeds, the song will be true.
And then down here, we test whether the result is true or false.
If it's not true, then you specify the upper line zero.
So when you upwellings specify zero, you will return it as zero.
Then after you set the memory region to become reliable and secure the world by using what you protect.
So the Miami region is the one here where you have Hosny copy.
He you could basically fall and then you print in other prompted a user asking user to present to to
create a track.
When you use a presenter, you come and test for the return value of the watch reporting.
If it's non-zero, it means which reporting succeeded.
And then you call the career clarify, you can execute.
OK.
So there is the explanation for this program.
So the next thing to do is to generate this base64 cut.
So we are going to use our knockback chocolate.
These new special court is a one regenerator using the Metasploit in Kali Linux earlier.
It was previously not banned.
ICAO and I rename it to not bet on Bin, but is actually the same font.
So now, before we can use this, we need to convert it into base64.
We need to encoding Base64 Sutea encoding message before you can use Windows Utility.
So let's open command from here and you command from type native open density for any to.
And this Bahia Rackley copy.
Now you see the space.
Right click to paste above hit enter.
An idea to list 10 in order to convert this, not that bin, which is a binary for your chocolate file
into a base64 encode.
We used to win a new treaty which is called Sethu.
You kill sick, you kill.
So this so you functionality tool is used by windows for some kind of certificate management.
We can also use it to encode base64.
So you pass it barometer gashing code and then the input file.
Note that bin and the name of your Profar.
Note that the BTC for to remind ourselves.
This is a base64 encoded binary.
Now we enter and he sees the input line to seven when they are pulling for file.
So the input command completed successfully.
So now you see there is a new far greater here.
This is a basis for including.
So what we need to do is now open.
This is not a plus plus and copy despite.
Here to hear directly copied is again coming to our south, far and busy down here giving all these
first A and C over here.
Then we have to put the quotes front and added back.
Because this is a string.
And you have to put a semicolon to end the expression.
So now we have our basically four and caught it below here.
So in the next video, I'm going to compile this into a EIC and then we are going to run it using TVG.
Thank you for watching.