Well, everyone, last time we were able to use our, quote, cave for our shall code and we received
the reverse show today, we are going to make it even harder on any antivirus by encrypting our show
code and decrypting it in runtime in order for us to decrypt our show code.
We need to use a second cave for the decryption mechanism.
Let's copy the memory address of our second case first.
Now, let's open the last same version that we worked on the last time and jump through this cave instead.
This is our show code from the last time I'm going to find this command, the reason why I'm doing this,
because every time you patch a file on, you reopen it in X thirty two debugger, pull your breakpoints
are cleared.
Let's set a breakpoint here.
Let's replace this by our new cave.
As you see, the cave is not completely empty.
Let's scroll down and find another memory address to jump to.
Let's reopen the program and use this address instead.
OK, now we need to write our decryption procedure, we're going to use a simple a simple hacksaw operation.
If we use X or one time against the value, it will result of a different value.
But if we use it again against the encrypted value, it will give us back the decrypted or the original
value that we did that we encrypted.
We're going to use the USB side register to store a pointer to the very beginning of our show code in
the other cave.
But let's save the value in the U.S. first.
We're doing this by pushing Ganassi on the stack.
Now, let's copy the show code pointer to the ASI.
Next, we saw one bite at a time by referencing the pointer stored in IACI, I'm going to use the hex
value a you can use anything else you want.
Let's increment this by now to point at the next byte.
Now, we need to compare of IACI has reached the end of the show code or not.
But first, let's go and get the address of the end of our show code.
We can do that easily by multiple followers of our break and then go to the end of show code.
Let's go back to our second cave now by following our breakpoint.
Uh.
We are going to repeat the XOR operation of the address of our pointer is less than or equal to the
end of our show code.
Or
else let's pop back our IACI.
Now, since we are done with the decryption, we can jump back to the beginning of our show called.
But keep in mind, we are not decrypting our civil code now since it's already decrypted, right.
But instead we are encrypting it and then we will copy the encryption result in a text file.
Let's set a break point at the end of this encryption procedure first.
Now, let's run the program until it hits our our break point.
I'm going to step into one time to go to our encrypted code so we can copy it,
see all the instructions are completely different from before.
Now it's patch patches file with different name.
I'm going to follow this address to go to the show called.
Let's copy the encrypted chokehold from before.
And pasted here.
It's patcher with a different name.
Let's go to the end of our show code and set up breakpoint and see if we get a show after we apply the
decryption mechanism.
This is the encrypted code, we didn't run the decryption mechanism yet, scroll go all the way to the
bottom.
Now, let's run our show code.
Nice, we got a shortcut here.
We got a reverse show in our neck at.
And the program was running fine.
Let's try right outside x 32 debugger.
We got a reversal and also the program was running fine.
This was the last video of our back during these series.
Thanks for watching and see you in another video.