And, Lou, come back into this video, I'll show you how to get started, the Windows guitar behind
it, go ahead and create a new folder called Hydra Projects.
And inside you create new software called GWI.
They correct me one and download this from the resource link, and I provide it for you and put this
with me inside this new folder.
This is a Greek himi so that is writing first and see what he does.
And to any kind of Shiraki, a canine on check and you're getting that message.
So this is a behavior now we are going to reverse this.
Correct me.
In Keija, click on the file, click on New Project.
Click next.
And then click on the three dots.
Navigate to your new folder.
Guitarra produce and sell this hotel, kongregate me and click on the Select Project directory giggling
Naeem Khan, who threatening me
dash one and hit on the finish button.
Now we are going to import this crime into guitarra, so drag and drop it into this new folder.
And he has detected the P format click, OK.
And this is the summary of the budget process, click on the button.
OK.
Now you can start analyzing dragging into the Nikon.
And you open up a good browser and ask you to confirm if you want to analyze it, click on Yes.
And then in the least, analyses.
Check this box, the compiler parameter parameterized.
And then scroll down and check PDV and so.
Previous to the Berghofer, the January 10, when you create a program now, only the person, the programmer
who writes the program will have this need PDUFA.
If you downloaded program or correct me from the third party, source says he will not have access to
this.
So you assume you don't have access to this PDB debugger for.
Sylvia and Jackie.
And then check this one.
Will be will propagate the extent barometer and make it easy for us to analyze data.
So clearly, in a nice.
And keep your eye on the bottom right corner, which shows you the status and progress of the analysis.
After about one minute, the analysis is now complete.
The thing I want to do now is to set in their preferences, to go to edit, select two options and then
select listing fees.
Listing fees and an entire new focus tax highlight.
And then here the default, so change it to the left.
Similar to what we did for the IRA on Linux.
So take look for the functions for the again, new for me.
But you won't find any meaning because this is a GUI program.
So Noufal actually entry point is to.
There you go.
Entry point, so entry point is the thing that runs before me, but in good programs days.
No, I mean, even though you can find your entry, there is no mean.
But he does have a win win.
Win win is the entry point for Windows program.
I also put this link in a resource file.
Can you download?
So this is the signature we need, but sometimes you won't find it.
Say the coolest thing.
So on the right, you go to the decompiled window and look for entry, Davis and then you scroll down
looking for women.
You may not find one clue of where women could be is just after the function that gets all the environmental
variables.
So you going to come line here, so this could be let's check it up.
Yes, this is it.
So this is me and you can see the dialogue, Perram, and show the window.
So when this show Window API call, you display this.
You know, it is a meeting.
I'm sure this must be giving me the signature so we can go to.
The documentation for women using a computer semicolon and a back, so you may want to do this to.
And leave the semicolon, right, click copy and head back to Ghidorah and directly hold undefined the
undefined function and select edit function signature.
And now here you can just basing Reichling and based on controversy, controversy to best, what do
you just copy and then remove the WINEP?
So once you've done this mission, there is no semicolon in the back here, click, OK.
Again, for this one, you can just accept the default SBW string point the industry, OK?
And so now you have the correct nature for me, you can see it.
So while look typically with those who have value, where he keeps on passing or scanning for the inputs
from the user and then checking, that is the message talo.
And today, it is that different message, for example, if you use your mouse and click on click on
these windows in the mouse, you translate it using a translate message function, installing windows
structure called MSJ.
And then he would especially you despatching to the callback function.
But here you don't see the callback function.
So function is not visible here if you have done something, just programming, even though he will
recognise this kind of just kind of code.
But we are not going to use this to to solve this challenge, he said.
We are going to search for strings.
So here is the message here.
Try again, go to Windows Menu and select define string.
And he will show you all the strength that has found who are doing analysis so you can scroll down and
look for the back passage, which is wrong.
Here we try again.
I can feel data from the room and there you go.
Wrong here.
OK, try again.
Sometimes you may not be able to find it in the defined strings window, so if you don't see your strings
here, for example, it is unique.
You may not see the strings here.
You might or you might not.
So in that case, if you don't see here, you go to search, use a different to call search and select
for strings.
And then here.
A seventh default.
This is home and loaded blocks, click search, and there you go, you you get another resource here.
If this window doesn't performing here, sometimes you might you might be floating window like this,
for example.
And you want to dump this window in here.
He just drank it inside Gluba.
Nobody else on the inside gluba drag it to the right here and let go.
And then you were talking here and you have the text showing you all the windows, then you stopped.
Right.
So so you can use the result of the search here and filter out sorry.
And Davor, so you have two ways of searching for string's.
One to use and you find a string which is coming from windows, define string.
The other way is to use, to use to search for strength and you find here.
So now you can double click on this and go to the location of the string which is here.
Wrong, seriously, try again and then you will find a cross references to the function which makes
use of the string so you can just double click on these cross references and he takes you to the code
listing the function screw up and you will see the function.
This is a function from four zero one zero nine zero.
So when you see this in a listing, you will also be displaying the decompiled of you.
So click the compiler that here and this is a function.
All right.
So this is a main function.
Can rename.
It has been.
And here he see getting along item tax is a window API to extract whatever the user type.
And then he was called on, he received the message for a good message and a message for that message.
So whether you're showing the correct key or the wrong guy, you will depend on the result of your voluntary.
So you've got three is the result of your comparison.
So this is a comparison, look, if you go through the process comparison and it looks quite complicated,
it is actually doing some kind of strange comparison between the actual parts of it and what you enter.
So even the comparison is chosen.
The key that you enter is the same as the actual key.
Then you voluntary should be zero, then you show the message box.
Now, another way you can view this is whole function main is to use the window, grab on the window
and go down to window function called.
And if I can go to the game.
Do graphical analysis and show you from a high level point of view what your call stack looks like.
So, of course I started with me and from give me a call.
You mean because this one you just really
hanging from from this main function, you have all the support functions.
We didn't need some information.
For example, a Kindle item is just one and possibly message somewhere down at the bottom.
And then message box will be these message boxes, I hear.
And sometimes you can even expand further if you have a plus icon and a minus icon.
If you if it's a minocycline, you can collapse the parent.
And so if you click on the bottom line, you the child.
So it's quite a good tool for visualizing your stack sometimes.
You can also use this to trace the pattern.
OK, now that you have the decompiled mean here, you can scroll down and analyze the code.
You can see here that it is having a get to light and tax API is doing what the U.S. and you can check
out the library by going to Google Chrome and search for gay Tyler.
All right.
Thanks.
And clicking on this result, so this one reading the stream story here.
This is handled through the window that you are trying to read, and again, this is a string, just
toss the item, this and that item referring to the textbooks.
So you are starting your taxiing that that parameter one to three.
So when you come back here, you see so this parameter one, two, three, that barometer contains your
string.
His wife, Unter.
All right, and interestingly, you see on top here, Boockvar is right.
He looks like the two of us.
So you can rename it is on is the actual key.
This is just an assumption.
So even if it's just an assumption, you just go ahead and rename it.
So it's local to define that parameter mandatory.
So this is your input?
My input.
And then you starting here, you can also bring in.
Reichling in Geneva, press haling you, Khiva, and you call this point to point out, it's just a
memory address point to underscore my.
So Alyokhina might.
And then if you go down for the.
He is trying to strike some things.
You don't have to understand every single light just from the high level conceptual view, he's good
in a.
So just by looking like this, you can see this taking your input and using it in various pieces and
doing some kind of string operation with the key input.
So even if you didn't understand every single line, still you can guess that they are comparing these
two things.
So this makes it very highly likely that this is actually the actual key.
Right.
And then based on this, he will then store the results of your comparison, probably in this vial to
why?
Because at the end, after doing all this, he was going to check whether you are to zero.
That means this one probably you can remember now as the result.
Right.
Click the new result here.
OK, so if the result is zero, then you show you a good message, right.
So from here you have a very good basis for suggesting that this is your actual key so you can test
it out.
Now you can go to our quami and so we just run our economy and then try to enter the password.
So from here, your password is cracking essence.
So we just copy.
And right, just right, clean copy and get from here directly in peace.
There you go.
So we saw this, correct me, by reversing it in.
Before we leave.
I want to show you another photo on the windows.
You can also look at some countries here.
So we do Fasching Trees.
He will show you to beknown about them.
On the left is incoming call and you're right, outgoing call.
The outgoing call is all the functions continue within the mean.
So you can see you mean any sign of all these outgoing calls or ongoing functions like then set and
who are here message Boxey.
So should be down here somewhere.
He got a few message boxes here and then get down to it and text his phone here and so on.
And on the left panel is your incoming calls, incoming calls list all the parents for more information.
That means the other functions, which calls mean, for example, women.
And these tallies up nicely with our graph.
So you go back to here windows and click on Function Condra and you can see we have a pattern for me.
And compared with your country, we minister incoming incoming reference, so we need to parents who
are here a million years of being me, and then down here you see a ongoing cause and you compare the
Rapino.
I'm going cause I don't hear.
So there are two ways to visualize your.
You can use windows.
Function Colora, or we can use the Windows function country from here windows.
Function Goldburg Oh.
Functioning countries is still quite useful.
The other one is functioning.
So he clearly functions, he released all the functions that I believe in this whole program.
This can also be done, can pull it out from here, you can pull up to the top and so it becomes a little
thing I can take you by here by pulling the inside, but nobody else pulling inside by putting here.
And you would duck here.
One, two, three, four.
So these are the main things you can use.
So in this lesson, you learned quite a lot.
Yes, you learn how to identify an entry point for windows reprograms, how to use the such strings,
which for defined strings and also for using the string.
Such might also learn how to use the function.
Three called three and function Colgrove.
And also how to understand and search for Windows XP, if there's any.
So that's all for this video.
Thank you, Hoity.