Hello and welcome.
So now we're going to do a reverse engineering on crack, me too.
So I'm going down and put it in your creamy folder and it's funny and see what he does.
So you just pop something, tells you that he's unregister software.
Please correct me.
So according to the Donald Page where this thing is downloaded from the instruction.
She said, you are supposed to this is the download page discussion without getting registered in your
name.
So let's try to solve this now.
So we just remember that when he runs, he shows his.
So how do you register?
He also says, please correct me, so I think what he wants to do is to.
Find a way to make this become registered.
So presumably that will happen when the tax changes to register sort of same thing with this money issue
register.
That is presumption.
So let's see how this thing works.
You open it up.
So I've already done it.
And when you first open that file and either you will see something like this.
Like this.
From the start here.
But this is not the main entry point.
This is just the start of a the program all these years just to set up the system for showing people
and you normally say that gut check and then here you find instance and then here you find Mexico.
And I want to see this exit poll like this is just before, as I said, go here, you should have a
call to give me an entry point homilist.
This is a one, right?
You have a few pushes and here within minutes of mine.
So you double click on this.
And here you are now the main entry point.
In this section, so the first thing you see is great, great pyramids, who set up the window to show
a dialogue window.
So this is a narrow window like this.
And these are all the parameters, and in here you see something interesting, you find out 60.
And then here is the API concrete file, and these are the parameters that are pushed to this thing
before you call the API and you can refer to the API in the end.
So this is you create file API so far is not just to clarify.
It's also use for opening a file for reading or writing.
So it depends on the second parameter, the design access.
So here you can see the second parameters design process, and it followed by seven zeros hexes, actually
the flat for reading Hamisi opening a file for reading and you can refer to the documentation online
or here the access musk.
So if you send this to one full amount of zeros in binary and incongruities in two axes, it fallen
by seven zeros.
It is for reading, if it was or writing, and then you would get were setting is.
On one here, disaffecting, one hand is open for writing and he'll be zero.
So when you convert that to you'll be.
Four four seven zero.
That's how, you know, is hoping for reading or for writing, so in this case it's for reading.
So we know that he is looking for his father, key father text based on this analysis.
So he's pushing his father is pushing this perimeter to open this powerful reading.
So now he's open for reading.
We expect to find a Refah function, a wi fi API tuner.
When you come down here, you see this.
So on here, the quickfire API returns the result to X over here.
And if it's negative, then you would know that the file is not phone.
But if he's had a negative, that means the is fun.
So this is the comparison for whether or not it is negative.
It pushes the result of nucleophile EPA, which is next to IACI, and then you compare it with ISIS
and negative No.
Negative one in this case.
So then here, if it is negative one, then it will be comparison.
The return of zero emission USA minus needs will be zero.
Then you would jump, you would jump to four 01 or even Lemieux's.
You take the Green Arrow and there is there would be the failure.
There is a fairly small town.
So we should clarify this tells us that we should clarify.
Right.
And then so we can go through the following year, frankly.
New.
Thanks for.
And in college, he gave our daughter, my wife, should we put inside of her?
So let's analyze this.
Whether he's opening the fire, he is reading the fire and the fire API.
You can also refer to the modern refineries who were here.
So far has got these parameters, the FA handle the buffer, so the buffer is where you stole the content
that is direct from the FA.
So we are interested in a buffer in the second parameter.
So the second parameter is just one buffer.
And here I've only renamed this variable as far content, you can just press in on your keyboard and
then Renesmee to Fartman 10 so it's easier to read.
And once you rename it, you can easily follow through the rest of the code because it could be running
as well.
So after you open the file, you the content and CV inside this variable cofound buffer and then over
here is going to set up in text.
So how does send the line text?
What is meaningless and right index.
Can we come to the embassy and send that I can send a title or text in a controller that unlocks so
our suspicion or true that means is going to change this text here and also the text here in here.
So probably is going to say register to follow by whatever your name is.
So the name that you specify inside a key file is probably going to be attended to some kind of text
and then shown here.
So is going to create a new string.
So a new string is going to create in place of this.
Let's take a look.
So from here, you can see that it is moving.
Some things registered, too.
So we suspect that the first part of the string is registered to.
Yes, sir.
And you said to it in the second part is probably coming from the Kifah so we can test the hypothesis,
we can put our name here
is put on in there and see and then come back here and continue checking.
So if our hypothesis is correct, it is going to create a new string registered to an insect that then
I and thanks to this new string.
And here is another function, which is and knowing this way goes up and my suspicion is that this Saphir
is to take this far conten and A to this.
So this Phalcon 10:00 Eastern is coming from the content of the father.
So if you supply your name, Insania Kifah, you would take that name and pass it along with the string
to this function.
So this function, my guess is to create a new string so we can call it again, renaming the press and
reliably.
Greek registered.
Do so, he's going to create a string already to and so and so and him, right.
So this the purpose of this one is creating this.
You will now over here.
Set that right and thanks to this, registered to right, so now we can close this and reopen again
to see whether we are right.
So now if you are right, you the content on this far.
So that's open to.
And we are right, Sarah is not changing the content of the dialogue inside to register to follow by
the name.
Same thing here, we just had to fly.
OK, so this is how we can use static analysis to analyze executable binary and solve he correct me.
The important thing to take away from this also is to always refer to the MSDS documentation in Google
by Googling for it and understand the parameters to the API.
What do they mean?
And also, don't be scared to rename rename the labels as I have done here.
And also here and also here, so the more you do, the more easier it is to heal your reverse engineering
project.
So the whole idea of reverse engineering static analysis is to relabel to rename labels, to insert
comments and to convert data to meaningful names and so on.
So that's all for this lesson.
Thank you for watching.