Welcome back.
That is that how we're tracking if a 60 40 Biggie we'll open it now.
Thanks for the biggie
and we're at the break point on run enter and key.
Click on check and see.
Sorry wrong key message.
So we are going to search for this string and analyze the code around that area so rightly.
Make sure you are in use or not.
And then here go to search for current module string references
and now Sweeney says search is complete and this is the string that we are looking for.
Let's move to the address by double clicking here.
So we have two strings the that string is here and a good string is here and jam here decides which
string to show.
So the jam will only happen if the zero flag is one.
So we can put a big find here and we start run to our break point.
Before that we have to enter something click check.
And we are not at a break point and from here we see that it is not going to jam.
So it is going to jump.
He will show that that message it is not going to jump because you Zero flag is not set to 1.
So just before the jump.
There should be a test or I'll come back over here if a test to this test is the one which determines
the zero flight so you know therefore Zero flag to be set to one.
Yes I must be zero so that means testing whether the value in the register ESEA is zero.
So either yes I value is not zero zero flag is not set then we need to analyze further what sets the
value yes I can check up here and see that this line is a one this sets a value in here say over here
so you can check here X now by putting a breakpoint remove this
run and do anything check and we hit our numeric line and now we see the value is f f f f this is no
good we wanted to be 0 not f f f f.
So that means even before this ISIS already been set to f f event.
So let us investigate the origin of the Russian here.
Set it to MF So do investigate it.
We can put a breakpoint even high up here.
Here remove this we start run and do anything click check so we are now at our new break point a no
D E X is not forever.
And it is also not zero.
What we want is zero.
So let's analyze them by pressing F it and keeping a lookout to see when is he s set to F F F F Q on
pricing f it
OK immediately after this call.
Yes became f f f.
So that is about me.
This call is the one which causes East to become f f f f so it is in this call it is away something
is happening some kind of string comparison maybe it's been done.
And if you look up here we can also see that in preparation for the string comparisons there is something
being loaded and you can see here suing is being looted.
Yes.
So the point is the purpose of this string so it is comparing some it is loading something to this register.
Yes you can see that over there.
So anyway that is now moving our focus to this line.
Put a breakpoint remove this and we are going to come over here and step into it.
So we said run press are a check and now we are going to step into this by placing seven became more
effort to analyze
you can see it is performing some kind of comparison compare strings as you can see here
yes.
So it is already completed.
This car has already loaded.
He exited.
F f f f.
That means the string it is comparing it in these terms.
This is a one resistor ne 03 and we are looking for.
So this hero key is loaded from way this hero key is loaded from this memory address.
He is the first place where he looked he looked in the zero key from here to the stack.
So here is where we should look for this zero key the address 7 1 8 to do a survey and click on this
and go to the address by clicking these rightly following them 7 1 8 2 2 a true enough you can see your
zero key this memory location.
So what we want to do now is to bash this hero key to our own security.
So to do that we can select you can select all this
time this and exactly binary Eddie and over here.
Make sure you check them give size and then down here you change to any zero key one we can make it
reverse he said on ABC 1 2 3 4 5 6 we can reverse it for example CBA
CB that 6 four three two one 1.
OK so now you can see it especially if our own zero G.
Yes.
All right.
So now he can King run and show us the real hero key is fine.
Now we enter our own Cherokee issue best we should be setting the memory CVA six five four three two
one.
Check
right.
And we can correct key.
So we have already had this by modifying the memory location directly and changing it through our own
silky.
So to make this permanent we need to patch it.
So we click file patch file and a patch file again a year.
Let's give a new name
dash patch.
Say
OK now we can open the patch file and run it into our
own zero key pages.
This can check yes she corrects Hiroki.
Yes.
So that's it.
We have solved this challenge.
We found the criteria key and we changed it to a different key of our choice.
So this is how we do a memory patching.
Thank you.
Holiday.