All right, so now let us try to sort of level one here, one here has open terminal.
So let's run this one.
And he asked for Bosworth if you gave the wrong password, he just shows you a dash, so you need to
supply the correct password in order for it to show the key and the key, you use it to unlock level
two from BE1.
So let us now open X1 one, we've yeeda.
A new.
And open go to the reverse enfolded.
In level one, open one.
OK, so this is the disassemble code, and the first thing that is interesting is this nine.
He sees this quite symmetric stream and by the differences in life, has got to forward, slash and
go forward slash.
So this might suggest that this is some escaped characters and you can double click on this and go to
the data section to take a look and in the right hand is a character which is not shown here.
So this is the original string.
So a reasonable guess would be that this is a password, so you can try to just copy this.
And then go to the terminal and right, click this hit enter, and true enough, that is the password.
So this is the key to unlock level two.
So another way to do this is to use a string strength util so you can heading into the.
He was in Florida
and used his strength to next excellent and here you see, this is also the password shown here in clear
text.
OK, so now they've got this key that is trying to use it, VFP one.
So let's copy this.
Likely copy.
And now we run P1.
And we face.
The key hit enter, and it looks encouraging.
So now you see this as a lesson.
You see there's a new folder being created, meaning it will unlock the will to be one.
OK, so let's compare this to the parent directory, so we go to the final arbiter here and we see we
have to see right.
Click on this cutie.
Go to the Pandi, Panditji and P.S. here now, you open BE2 folder.
You also see Beita and X2.
So this is our next challenge.
But before we move on to the next challenge, that is try to analyze and understand more about this
X1.
Because the knowledge are analyzing X1 will be probably be useful for the future levels.
The key to go back to the previous.
So it seems like this box here, string compare is comparing two strings, so the two strings is comparing
probabilities to.
As soon as two people decided to barometer's to the string compar function, so let's in this very blessed
puleo course in front press in an SUV Renesmee to global input string G4 Global.
Key to confirm that this is indeed a global variable, you can actually double click on this to go to
the section for an initialised data and you can see it is indeed global.
Anything will be a data, see how global variables, so it's global and the size of this one being X
and then, you know, this year versus SAIC's the segment.
So Scallan VSS.
So this is a global Airbus and initialised hurdles.
So this is a declaration for creating an initialised variable.
You use a WP kinesthetically and let's take a look around so that we're more prepared for the next level
following the comparisons and compare.
You can go left or right and here because of the exclamation dash, this is a failure block.
So we can put a comment here and use that to put the entire comment and time failure.
And if you remember, this one came from here, a fatal blow, he's just coming from here.
Here's how we know that this is a federal law and then for the success before you get this escalation
and a symbol which is coming from here is clear, mission impossible.
I mean, this is a success block, so we can put it a..
Come in here, Pressin said, and then success.
A lot of reverse engineering is just renaming labels and inserting comments.
And then from here, he says that after the crown prince's success exclamation mark, plus it is supposed
to bring the actual key here to remind you.
At Princeton, acclimation in applause you on your key.
So where does this come from?
You can only come from something that came after the printer, which is this dysfunction here.
So this is a function which brings a key.
So we can rename this by typing in and timing every key.
Now a lot of reverse engineering is all about renaming labels and also inserting comments.
So the more labels that you can rename and the more comments that you can insert makes your disassembly
and reverse engineering much easier to understand.
It seems that these functions have been keys also using the input string to derive the key, as you
can see before the call is met.
This is a barometer for that is moving through the register.
And one of the principles of assembly is that before any function is called, the preceding statements
prepared the parameters for the function call, just like for Pranav before Rubinoff is executed, you
prepare the parameters for Rapino.
So before this function is called, you prepare the parameters here for this function.
One of the essential differences between for me and that it would be programs are that there three two
be programs frequently use push push to the stack as in as a method of passing that test before the
function is called.
But 64 bit programs.
Normally they use Fusca, which means they use the registers to whole parameters for the function cost.
Now let's analyze the first block here to see what is happening.
We have a C function and you open an the open can be used to open files.
So even standard in the initial terminal input.
Whenever you have a terminal input like this, this is called standing in and you can see from here
before the function of call you, you're here preparing the parameters to the function and after you
open here accepts two parameters.
The first one is to follow the script.
The second one is the most.
And you can check it up online using Google.
And here is a description of the open from documentation for C programming.
And you open first parameter.
So far this year, so far this quarter can be a standard in which is your terminal input or you can
be an actual file and then a second parameter estimate, which can be for reading, for writing, so
on.
So these are two parameters for the open.
So when you see zero here, that means this is standard in.
And here is a comment that he has helpfully put in for this to zero so we can insert here a helpful
interior comment just like this line and insert to insert into your comment.
So here you can see if you open and then the first parameter is standard in which is your terminal input
and is for reading R.
As you can see here.
Our Senate and coming back to the description for the FDA, open evidence have pointed to a file.
So taking a look at this emittance the result here into RSX every function of intensive Isar in the
area.
So he asked for this to and in this case, the result is copied into into the stream variable, which
is in the code segment.
So stream is the file pointer that returns from FDA open so we can modify our anterior commands, click
on that press search and then here we can make it even clearer.
Returns a file pointer to string.
So over here, we see, you know, preparing these arguments, barometers for the next function call,
and it is passing the input string and he's also passing a value, which is one B. So one B is.
Twenty seven.
Twenty seven, so if you click on stream here and go to this location, you can see the size of the
input stream is 27.
Which is one the press escape.
You can read me, just press in and we can call it function rechartering.
So this concludes our reverse engineering hall.
Level one, thank you for watching.