Hello and welcome back.
I hope you have given a try on your own to try to solve crimes.
Thirteen.
So anyway here is the lecture for the first week which is this on and this is the easiest to do because
you do need to unpack the file.
So now let's get started.
So the first thing we want to do is confirm that it is packed.
So to do that we can use the techie easy.
So just open the file here.
Hey take it easy
and get it easy.
We'll show you the name of the Packer and it is a duplex.
So this confirms the device back.
Sometimes however the certain authors may use their own customized pecker which may not shop here.
In this case how he shows here it is.
So let's close this now and then before I open the file on me for SCC for I'm going to disable the scalar
height first so just send I started to
and then over here I will go to plug ins scary high options and under the profiles here this and I disable
so you would turn off home the options there's a reason why I'm doing this is so that you can even see
what happens when the debugger is not hidden.
So now you can open the correct me at 18.
So go to um go to granny for the
Hey.
Open it.
Crime 818 and then no that's funny
again.
Okay I have to disable my very points so let me remove my points which I said earlier get Australian
restart run and immediately the software TV bug feature has detected a debugger and shows up a message
box telling you that the debugger is detected and the program will now quit.
So if you click OK The program is terminated debugging stop.
So in order to defeat the entity bug protection and you can use this restart for us and we can use the
plugin.
So now you turn on as I plug in options and here.
So like basic so basically any will all these options apply.
OK.
So just click OK here
and cozy.
So now if you were to run in immediately you see the window showing up it just debugger status a debugger
is not detected.
So now we can go ahead and find the place where the 0 keys in check.
So here we can go ahead and just keen.
And you're wrong zero key.
You click the button.
Check.
So now you get a pop up position showing us that the wrong zero key as we enter.
So we can now go and pass.
We are going to use the Caustic Method.
So we are going to pass it now.
And once is
all right let's try again.
All right.
Sometimes you get this kind of error.
No worries if you see this kind of error just go hang your key here is restart and then run again just
enter clicking click check.
And now the going hit the pass button and this time he has passed.
So in our response you go and is I mean the costing and look for the user more you here in this address
writing on this and click follow from you know here we screwed up you'll see that he.
This subroutine has been called to show this error message.
And the noise coming from the state.
Oh here.
So if you look out for no use here Jamie cohere A.
This is where it is decided to jump.
Ready to jump or not jump.
So basically we wanted to become heavy doing jump.
You show the wrong zero key message.
This is a bad message.
So we wanted to jump.
So this is the way we should patch to make a jump so.
Before we take a note is the address.
Hey this is a place to patch.
So we actually can push her back file.
So we have to unpack it first.
So in this case we are we don't want to unpack it.
So what we do is we need to use a loader to begin the process not a file.
So in order to take the process first we must find out the one byte that you want to patch.
So to do that you double click to assemble although you really can assembly and you file yourself by
UK.
Now assembly just to check whether you want.
So we are going to jump to this address.
So yes I mean I'm sure the address is the same size or smaller and then OK and close it.
So now he comes here he region.
So we can put a break point here and no do not restart if you restart you will lose all this because
the file is packed in whatever is back and you put a brake line you will lose them entry point so do
not restart just go to the program.
So here a little K can run for us.
His only run has an angle here.
Okay.
And then click checking again one more time.
And now you see it has hit our brake point and you can tell that he is going to jump because we just
said a jump here.
All right.
So now we are not going to bash use but we want to get the offset address so we click file although
we are clicking bashful.
We are not actually going to Padgett.
We are just going to a spot.
This uh offset the rest so who here.
I spotted a colleague patch offset.
If you forget how to do this you can go ahead and revise the lessons on this earlier.
So now we saved the page offset and then 1 five spot.
So now we just keep patching because you won't be able to bash a backfire anyway.
So just keep this.
So now just close and we can now going do our load.
So now we go to open our Duke to 0 here.
I mean if you do know how you can do to just refer back and revise her lesson on this.
So definitely do to create a new project click on project view and give a name here.
Great meeting.
And here select the file
to correct me
select the file itself and then oh yeah I just we leave everything as it is click save and then right
select this directly at offset patch so click outside patch.
Now how you frankly edit you can either select edit oh you can just double.
So now your target file is selected.
Again it is this file.
Um who here you select reality which will address and then over here go and open your export partially
offset file using notepad and then the address.
This is the offset address so select the offset address basically in your set issue are you using our
V.A. and any of them by Sony for and you want to patch it to become maybe
all right.
So now you've done that yet if you had any more the vice to pass you just keep adding them here in the
list so that's all for the sponsor we just save.
No no we can save our project
can leave a default name you've done look to extension Harry.
Now we can create a load loader so select project create loader select simple loader OK can the default
name is fine his CV so you can write in now Oh you can write it manually I will only manually cyclic
no go here and run the loader so this the new file and you load that's been created so I just I'm looking
at and now you can enter any key check and your loader has successfully Pash the running process in
the memory.
Note that we are not patching a file here patching a process which is running in memory you can actually
see the process by using task manager click here Tasmania and then when the Tasmanians open select more
details and you can see here trainees 13 years running in memory so you're patching the memory so not
the file Why do I have to here.
Because my my exit for the bikies open sites closes and you see that you'll be one.
So this is the one which is where patching your process in memory set not the file.
OK so that's how this thing works.
Using Lotus and see you in a next one.
Thank you for watching.