Hello and welcome back.
In this video, we are going to talk about several things.
First of all, let's talk about data exploration.
Data exploration is where we will use either to convert our data to call or go to data.
No, automatically he doesn't know how to recognise code and distinguish it from data, but sometimes
he may not know.
So there is a way we can intervene and try to create a lot of unknown data or vice versa.
That is going to leave of, you know, by pressing the spacebar and Hillsville to some data section
just until you see the data section here on the left you issue.
All right.
So now here we are in a data session.
As you can see, for example, this bar here, there is some data here, but you did not know that this
is actually a string.
So we can tell you that we need to convert this string.
So to do that and compress a and then either will combine all the bias in the data into a string.
You can also undefined it and go back to the previous date by typing you for undefined.
You can also access it from here and go to strings.
And in here click on this one, which is actually a shortcut you just used, and then you create a string
out of all this bytes, which was undefined.
And if you want to undefined it back again, you can also presto you or bacteria and click on and define,
which is also the shortcut you anytime you find again.
So let us define the string now by pressing aying in any clustering.
Another thing we can do is over here.
We can combine all this into what?
Or Dewormed or Kingwell, so pleasant is bite, so to group these, to tell you that a good this into
a word word is to bite you Prendes and then.
Presently again, and now two guys being grouped together into a wall.
So what is to be your best Diegan and then group for bikes together into a with you?
If I press the again, you will group it by saying to one Keywell, if I keep on pressing these, you
will then go back to the previous day.
So I now press these one time to grillwork another time.
Good Neiwert.
And at a time.
Great.
OK, so this is part of the desperation at that stage.
You can use know, let us try to deliberately undefined something, some instruction and try to fix
it.
Lets us find this instruction by pressing you.
And now it is undefined.
As you can see, he goes back to the raw data.
But if you go to space and go back to the graph, you you see this error here.
So let us try to fix this now precipice again and go back to linear view.
OK, one wave and try to fix it is to select all this part here, which is undefined up to here and
impressed to see Saeki.
Now here are the redefining.
Now just go back to graphical and see what happens.
Press space on the keyboard and you see still some error here.
So we are not properly fixing here.
So go back to linear view again.
So in order to fix this, if you have to undefined entire function.
So the function system here.
So that's undefined everything from here.
And two in here.
So press you to define the whole thing, so the whole function is undefined, so in order to fix it,
why we can do is we select the start obvious, undefined function instead of pressing.
See, this time you press BP for a procedure and now he has fixed it.
Let's go back to G graph.
You press in space and now we have fixed it.
So this is a flexibility.
Either you can change any part of data to code or any parachuting data, you can modify the data and
so on.
Many things you can do is very flexible and sometimes you might need to do that because sometimes you
might misinterpret the data and mistakenly think you need to be caught and you might undo it and fix
it.
So this is why you need to know all these skills.
So let's explore the various windows.
So this is called the disassembly window.
You can press basically go to graph you and if you wanted to open another disassembly window, you can
always go back up here, view points up use and then you can click anywhere on this and you want another
disassembly window and now you have to disassemble a window.
So this would be useful if you need to look to different parts of the court at the same time so you
can switch between this and this easily.
You can use it on the two of the three, for example, to switch between those two views.
All right.
Now we can close this.
Next thing is the hex view the excuse?
Are we synchronized with the idea of you?
If you select this instruction, here it is four eight eight five zero.
If you go here, you can see for it, if I see zero next to explore the functions window, which is
over here, you can drag this over here and you can see most of the functions.
Already known, for example, if close feelings on those which are known to idear looks like this,
he has got a front running.
The address headed the back.
And once we've analyzed it and you get an idea insight into what they do, we can always rename the
label discussed before in the previous video.
And you can see all these functions based on length, for example, if you click on Link.
Or you can decide based on stutt.
And is the next window you can get is a street window, you can get it by going to views, open some
views and select the strings or hear.
In the streets, we never see.
And the shortcut for that is shiftier.
One thing useful is that you can click any of this string and then you take you to the cross-reference
inside the assembly, out to other windows, we show you who are the imports and exports.
So the imports contain the list of all the functions which this executive order relies on.
So just by looking at the list of imports, we can have a good idea of what this executable is capable
of doing.
We can see the evidence here indicating that this program will be reading something, some input from
the user and I and the open.
And it's also Brener, which means that it's also going to put something to the user.
So Sony Asmar, this one, this executable opposed to the world.
So this is not a library.
Therefore, there's only one export, mainly the entry point, which is start another window, which
is quite useful structures using structures.
You can impose some kind of data structures on the raw data that we find, say, India, sort of a new
structure.
We've passed the insert on it on the keyboard.
And then give a name for your new structure, normally we want to call something meaningful and include,
OK, we would like to call it a capital and because it is a kind of object, so we can add new members
of Fuse to the structure by putting our mouse here and then pressing on the the twice you get what you
press, the again you get a double and then you can press the again, you get a quarter so you can cycle
through.
So now if you create one, the attack is zero time and the means for bytes.
And if you only create a second, if you just use a bottom here or go down here and repeat the same
thing by pressing these again until you get the word.
And then let's create one more press down Arrow and Presente a few times until you get another deal.
So now if you want to name the first few, something meaningful, you can press and Shikaki ideas directly
and rename an X, for example.
And then the second one, you can press em and then give it a name, why, for example?
For anyone who can press in and call it Z horizontal.
So now you have struck consisting of three views each full of size, Daewon of four base and X, Y and
Z.
And if you wanted to impose this structure into any part of your assembly now over here, we don't have
any data, which is actually a structure.
But if you wanted to and if you found some offset, which is looks like a part of a structure, you
can impose the structure onto the data by pressing the prestige on the keyboard and then select the
structure that matches the location, which you suspect to be a structure.
OK, now let's talk about how to say, OK, whenever we open a new project IDA database so you can save
it by clicking fire and then control the failsafe or the Shockley's control w so what happens when you
do that?
Currently, if you go and look at the location here, you will see only small, small little files here.
We can up the database, but once you save it, it is what happens.
A new far is critical X one, not 864, so this is the following you can give to your friends or your
team and they can open this file and get back in the same database and analysis which you have done
on the on this project.
You don't have to give the rest of these small files to anybody.
This is the only file you need.
You know, so I have a way to create snapshots, for example, you can click view here and so I can
get a snapshot manager and then you can take a snapshot and give a name, Clokey.
And then you can make some changes whatsoever, whatever you want, and if you want to revert back,
you can just click on this anything to restore to the snapshot.
So each time you get a snapshot, a new database will be created here containing the time in this time.
And this is also the father you can give to your teammates or anybody in your project.
The other thing new about this idea is that you can also undo, for example, here there is the undo
button, undo and redo, control and control shift.
So you admit some mistake and you want to undo you can use this now.
So you want to close this file.
The current way to do this.
Click, file, click.
Close, and then you ask whether you're in the bank or select bank, all right.
OK, and once you do that, you notice what happens.
All the other temporary file disappear, leaving only one for the bank file.
So it is this file which you can give to your teammates or anybody you want to share your analysis with.
So in future, if you want to reopen this project, you just click file open and then from here, select
S1 and you will look automatically for this file and you read that database file and you can resume
analysis from where you stop.
So those are the basic common sense and techniques which you need to know for basic EDA usage.
Thank you for watching.