1
00:00:00,780 --> 00:00:07,170
So you first Cranley bugger to take away the location of the address here.

2
00:00:07,200 --> 00:00:10,440
Interesting, because I CBG

3
00:00:14,010 --> 00:00:25,470
and then attached to the running for the same simple area, go to Symbol's select simpliciter DoubleClick

4
00:00:26,490 --> 00:00:33,400
and then click here and search for string's going on.

5
00:00:33,410 --> 00:00:35,330
You think that this.

6
00:00:40,470 --> 00:00:50,370
And then out the sorry key, sorry string, and you will find it here, this double click to go to that

7
00:00:50,370 --> 00:00:55,710
location and you want to select all the function for the BP.

8
00:00:57,390 --> 00:01:00,860
So they saw it on key showing here, connection here.

9
00:01:01,320 --> 00:01:10,800
So we just look for the push, BP, which will, you know, the start of the formation here to push

10
00:01:10,820 --> 00:01:11,280
up.

11
00:01:12,030 --> 00:01:20,430
So the function starts this address for all three nine three C, so likely and coppice.

12
00:01:23,830 --> 00:01:28,240
Copy the address and put it in

13
00:01:32,220 --> 00:01:32,520
that.

14
00:01:40,720 --> 00:01:45,820
All right, and then the end of the function should be the hurried.

15
00:01:47,920 --> 00:01:53,840
We just had this address so rightly on this, and you copy the address.

16
00:02:01,060 --> 00:02:11,560
OK, so now show you another way to get these interesting addresses using changing.

17
00:02:14,350 --> 00:02:19,000
So this fire everything again and one changing.

18
00:02:26,790 --> 00:02:34,950
By the way, I would give you the links where you can download hastag and changing, so click on this

19
00:02:35,460 --> 00:02:50,190
and attach to symbols here, open the memory of you and go to view for reference strings and guess.

20
00:02:52,710 --> 00:02:54,870
And you say for all the strings.

21
00:03:05,120 --> 00:03:08,660
Now look for click on Search, look for sorry,

22
00:03:12,890 --> 00:03:21,350
and then hit on the button, fine, and there's a hit sorry Ronke and this is the address.

23
00:03:21,360 --> 00:03:22,550
So double click on this.

24
00:03:24,050 --> 00:03:24,890
And there you are.

25
00:03:26,600 --> 00:03:29,330
And you want to go to the starting discussion.

26
00:03:29,960 --> 00:03:30,590
You can just.

27
00:03:30,590 --> 00:03:30,780
Right.

28
00:03:30,800 --> 00:03:34,280
Click and hit and select the information.

29
00:03:35,690 --> 00:03:41,660
And now you can see the start of the function is also pushing TV and it's the address.

30
00:03:41,670 --> 00:03:52,580
And compared to what we found, actually B.G. is the same for all 290 increase and return is should

31
00:03:52,580 --> 00:03:53,150
be this one.

32
00:03:53,990 --> 00:04:05,360
So the Arrietty look for the Harrity scroll down and your heart and that's your function companion piece

33
00:04:07,100 --> 00:04:07,740
is the same.

34
00:04:08,070 --> 00:04:16,100
OK, so these are two ways you can use debuggers to find interesting addresses to be.

35
00:04:17,510 --> 00:04:18,630
So now you have these two.

36
00:04:18,630 --> 00:04:22,760
We are ready to decompiled according to the compiler function.

37
00:04:23,690 --> 00:04:25,400
So we head back to Ghidorah.

38
00:04:28,720 --> 00:04:37,450
We can detach judging from this, by closing, closing this Dagley, now we are Nyjer, so we are ready

39
00:04:37,450 --> 00:04:44,910
to decompiled the interesting addresses and for that, how we show you in the next video.

40
00:04:46,750 --> 00:04:47,770
Thank you for watching.