Hello and welcome back.
Today we show you the second way of solving this cracking meter teen which is to hide the debugger to
unpack then bash these hero key.
So let's get started.
So we will open the cranky
using 64 BBG they define it.
Tell me one more time remind you that he is back and you can check by using the.
Take it easy
issues say display
now we are going to unpack it.
So let's opening in 64 for the BBG
and then now the ad is addressing why the entry point and Avis amount to push the registers to this
tank and the button one you're interested in is the memory address in EVP Sue press F eight and see
what happens
now.
Notice all the registers having pushed in a stack and one of ACL a BP address in 19 8 0
reaches over here.
So this is a one way intersection.
So we will go and look at a dumb and its location so rightly.
And then follow in dumb and the following We are looking for this man the address of the stack.
So now over here 19 f f f sees here.
This is the EVP memory address.
There has been push onto this day in reverse order because on the little engine system in the intel.
So a 19 f f a 0 is your IP address.
So now we'll put a hardware breakpoint on his memory address likely and then.
Here select breakpoint Sally highway address and select view.
And now you can run and see when the program assesses the hardware brick fine.
So that is the time when the EVP is button that to the register so we run and you can see now it is
faster.
Have every point.
So if you know score up here you will see that he has popped the EVP back so probably will pop everything
from this tank that into the registers and then now you can press have a to step over and go to the
jam.
He has a loop here and we can come up with a loop by selecting the address after it and selecting DBA
run until selection press run.
So we end up here and then we are about to jump to the outside of here.
Stop all the pecker.
So now you press have been looking for the gem and we are out of the Pekka so now we press it again
and a gem right over here so this is the origin entry point.
The court has me unpack and we are about to go there.
So now and then we put a new comment here.
Visa or AP homogeneity by
all right.
So now we are ready to dump the memory of the extracted quote So we click on the plugin.
Go to this killer plugin
and over here click on the file silly down memory and then scroll down and look for the quote that has
been back because this one over here and in in dumb the be slightly on be ending save it in the new
location incriminating fact folder.
And you can give it a name.
And put it down here ascension please save
and there's no need to save the men.
Recently cancer.
And now we need to fix the IED table.
If you were to run the damn now he wouldn't be able to run because he doesn't know where to find the
details that he needs.
So disclose if we are going to fix the IED by now.
Go back to Skyler and over here on Heidi auto search
and he has to say no.
Hey you found the I.T. table to start any of the I.T. diva.
OK and now key on these getting passed you get all the addresses for the details.
We can be fixed and done so.
Click on the system and said and done you open and you can see the status in part reboot success and
he has created a new file dump.
See why.
So now we can test how damn I see Y to see if he runs does DoubleClick and it is running.
Okay so now that you successfully unpacked it let's confirm that is really and pay so close my so far.
And check this file with the I
and you confirmed it.
There is no pecker.
So now we can go ahead and bash
too close they were close tequila and close.
Uh I for first and then you reopen How can you far open entity.
I for the veggie run
and now you can run again
and oh here you can enter any
Syria number and a here click on the boss and notice he his passed.
Now you can inspect the coast and look for the user mail you can follow from
an oh here we see the.
Gee I like probably saw earlier.
So now you can bash by assembling the jump.
Here and here.
OK.
Closes and you can see of in Beijing.
If you want to test you can test.
So yes.
Uh
can run and then going closest Hinkley check.
So our uh.
Sure how we jam assembly works.
Now we can actually go here.
Fine.
English batch file and this time you click is button bashing offer.
And then selling and Union for a call.
Damn I see why we've ne prefix how it is half expect safe.
OK and.
Now we can test our patience quickly and anything can check.
So our patch works.
So just as a quick summary what we did was firstly we open this uh page file and be very open.
He also had to make sure that the scalar high plugin is uh set to basic so that you can hide the debugger
from the program.
And then we went through the unpacking process and we created then after that we opened a fixed income
hierarchy table to produce to dump a c y file.
Once you got the damage so far we confirmed the IP that is already successfully unpacked and then we
reopening again with the ICC for the biggie and passionate file to produce this file.
So this is how we can use a skill high to hide the debugger and produce a patch file so that's all for
this lesson.
Thank you for watching.
See you in the next one.