Hello and welcome back.
Today we're going to unpack the program and this is the summary of the how a KFC bag program runs.
You can download this from a resource I share.
This is also being used in the introduction lecture.
So let's open a bank.
Yes a program we've excessive for DBC
and now.
Yeah.
The entry fine which is here entry by next.
The we need to check the Bush-Cheney output EVP session.
You can see data push here so when you press F it you push all the registered value to the stack.
Oh here
so the effect of a push you say this pushing you to push everything that is say that the only interest
in push BP So let's check it up.
Press has it now
and you see all the registered voters having pushed through this day and the one we're interested in
is 19 5 9 4 which is here 19 5 9 4.
So it's already on the stack.
So now the better we keep on executing
and better.
Here's how you push the register to the SEC.
Now you uncompressed the original AC and then have the right you resolve the 80 table and then you both
from the secondary register.
So we need to watch out for this so this is important because this is where we know the attacker has
completed and compressing the easy file and he's about to return control to the extractor easy.
And this the one you underdone.
So we have to watch this.
So to watch this we need to put a bullet point.
So to do that will go to look for the stack here which contains the EVP existing EVP which is at this
memory address.
So we write figures we go to them for this in a done and over here you can see this is the stack which
starts the existing EVP.
So we say like this will do what we want it for.
And you will notice this is reversed 0 0 1 9 5 9 4 is reversed.
So here is 19 verses 19 f f 9 4 but then you storing memory it is in reverse order.
Also known as The Little Engine.
So what we do is we referee this debate and in here look for the break point and have a sense do you
want to click on this and you have a big funny set.
So now we just run and until they have a bit fun is triggered OK all right.
And now you see he have a big one has been too good and your boss at this location and if you just screw
up a bit he will see.
Poppy he has happened.
So this has happened.
He has restored the original status by using pop Hades or body B soda pop.
Ada is equivalent to all this insulting.
Well we're interested in is a popular Bebe so now yeah here and he is finally going to attempt to re
original entry point.
Ready.
How you doing.
Yes he has been uncompressed.
So we just have to keep on pressing it now until he jumps to the original entry line.
So he's performing some final look.
So we can get a signal by clicking on the satin after the look on the map.
Francis election and Gigli 9 0 press run.
So now we're here out of the loop press avail again.
And now he's going to jam to the overtime supine press TV and you will see the address we change.
So this is known as the always end to mine.
Our original entry point.
So now we are the are the entry point.
So just press f it again one time for try to look to high 80s.
So now is Rita done in there.
Now you can go to ballgames click on this killer click on File down memory now a search for a strategy.
And from Press TV I see that he said this in any location now that you're funny.
This is what's in memory now.
You've gone and done the P so click on dumpy give it any name you want you can call it dummy AC I've
done this before so it's damn easy
for memory cancer on his 80s and now David dummy we can go and test data.
You didn't the back.
Okay now let's test it out.
Can you see that face to run.
Is it because the high table he's messed up.
We need to fix it.
So to fix the I.T. table the I.T. Xavier refers to the memory addresses of all the DEA files which the
program needs in order to run.
So the fix the I.T. table the open skill are bringing in entry on I.T. autos such as whoever they want
to serve as a result single handedly.
Okay.
It's funny.
And then now you get a pass for on the DL files.
So these are all the DEA libraries which is used by the program.
Yeah.
Now we can fix to the dump.
So yes click on FEMA and select the dumb people open and now the dam has a face.
You can see here it says in part redo success and using union for your file.
Now see why.
So that's going to be a little dicey right.
So now we can write and you know we try getting anything it is working.
So now you're ready to bash this.
I see why.
So this is how you strike the original ESEA far from the pack.
So I'll see you in an assassin.
Thank you for watching.