Now, you can use Ghidorah to decompiled those addresses where he found Haseeb game changing.
So who for this first address, Rackley copy.
And in Ghidorah, he goes on to open the go to and you say this is their first address and his address
and he turned OK, he will go to the address.
But he was notice that this location has not been disassemble so less likely and disassembled itself
upon disassemble.
And now it has disassemble and you will see it also as a push over here.
And you scroll down to the second address, this one issue also be written.
So if you scroll down low enough, you should be able to see anything at this address for all three
to be.
For three, do we see a return order, so does the start and of the function so we can go back to the
top here and frankly and create a function, you.
So now Guéra has created a coin fund for three nine Creasey and then automatically you will I mean the
compulsories.
So Clellan decompiled here and you can see the formation.
And now we can analyze using the decomp in the.
So we can scroll down, you can see there is a brief statement and there's a good message showing you
like you and it's a been showing here, sorry, wrong.
He.
So we all get ready to show organization, their message will depend on you are one so we can relabel
this is press hell Anikeeva
calling me the.
Click on it and you will see that this is where result, he said.
So this is probably compare Stringer function and he's probably comparing two strings.
Let's click on local in.
Hilco Fotini seems to be reading a string.
This one looks like Hustvedt.
Double click on this and inspect the agency, so it looks like a password.
So as soon as a password so we can.
Relabelled, this one and.
And we need so we can say this is copy three.
Copy at your key three.
So you copy the specific to the table for 14 so he can relabel look 14 as a pitcher key.
So clearly, Chooky, all right.
And then.
Click on the other one here and look.
18 is over here.
So look at 18 year.
Probably the.
Key, you enter Shirat pattern one to look at me as my foot.
So now you click on this and you can see.
Now come back to our function.
He seems to be comparing my input, your key.
We can confirm it by clicking this to enter the information, and you can see this compares transformations
here, he's comparing string one scene to.
Pattern to his is pattern one is this click on the button.
How much time are you going to see putting one into my input pattern to a key?
To go back and say, hey, we can relabel this has my input and we can relabel this hash tag your key.
And then just click on this and see what's happening over here.
He's assigning a to industry so he can really go.
This is a major key.
This one's assigned to another string.
So you can relabel this as my input string.
And when you click on this now, you can see clearly he is comparing whether your input is actually
if your input is actually a return zero.
So let's see when he returns, zero happens.
Let's click the button.
When he returns zero, he was dying, the result and the result was zero.
He will show you the goodness.
This confirms that this commission is texturing function so we can rename it rebooting as
we can better.
Better still, call it compare, compare strength.
Now, we know for sure that this dysfunction is confined to stress the importance of chokey, and that
confirms that this actually key here, which is coming from the string here.
You said you were pursuing.
So this is how you can use Ghidorah and embargo's together, debugger does not decompiled code, although
EVGA can do it by the compiler, is not as good.
GUÉRA So it is good and recompiling.
And if you want to decompiled code first, you can use debuggers to locate regions of interest.
Looking at prices of interest and watching those addresses, you can come together and then convert
the guitar strings and create functions and then you can decompiled in, interviewed and studied an
algorithm to derive the zero key.
There's another thing I want to show you is the Windows graph function graph, too, so you can click
on on the function here has regained its function as.
We'll call it checks here.
Now you can use a window, click on window function grah.
And you generate the graph, you.
You can zoom in and zoom into a scroll wheel, your mouse, the center of your scroll wheel, and you
can look around
and bottom right is another way to view.
You can drag the square box here to move around.
And the yellow circle here denotes the information that you are analyzing here looking at.
Can school in school, if you can read the lines, you can go here and then drag this out so they can
view the rest of the total lines.
It is not enough.
Go back and do again.
Select Boxtel.
You want to expand about here in.
Now you can see the rest of the string hierarchy, Coraki, you pull this to the right, you'll be clearer.
A red line denotes what happens and you jump zero test is not true.
And the green line denotes the jump that happens when the Jancsi rule is true.
So this is an tells Dingman the green blue line is unconditional.
And you can see from here they were here in a circle pestering.
He's loading facility here, here and here, copy covid and he has a test.
And from based on this jump, he will then jump either to show the message or jump to show the good
message over here.
So this is also a useful tool for visualizing, analyzing the code.
So that's all for this section.
Thank you for watching.