Hello and welcome back.
In this video, I will introduce you to a powerful dissembler and the compiler known as Ghidorah.
So click on the bottom left corner on the Windows icon in its search for Ghidorah.
Click on the first report and you find to launch Ghidorah, Najai is now firing up.
He will show you team after day, just close it and here is your window for creating a new project.
So now you have no project.
Let's create a new one to file new project.
And then launched that project, click on Next, and they select the desktop folder where you have and
zip your melody.
So we get to the movies and poetry and select the project directory as my sample tree.
And in the project name, you can call it Milray Tree and then click on Finish.
Now he have a new project and you can see the food there has been created in Giurgiu, we can now drink
our some of sample here and you can see the GUIORA has created a new folder in some other files.
So we shall sample been into this project.
So drag and drop into this arbitrary Hooda.
And Jadeja will begin the import process.
We show you that he has detected a format as portable, executable B and the language is actually eighty-six,
that it'd be Windows.
So just click on OK?
And now he will.
After a while, you get a window security alert, just check boxes and allow access.
This is almost daedra needs to use it.
And now he is showing you the import results summary.
And you can see that he has the name of the program, the processor ASI study to be program and so on.
OK.
And now he has imported it, we can see top here and there's a two chest and two chairs are the tools
you use to analyze the coat.
So over here, what we want to do is open this sample being Browsr.
So let's sample bin and drop it in the browser and begin the analysis process.
GI Joe will then ask you whether you would like to analyze it now click on Yes.
And here you can see all the very diverse groups, all analyses that can be used do not change anything,
just accept the default and click on the button, analyze and you can see the analysis process have
begun and the status who is showing on the bottom right corner of the screen.
This will take a few minutes.
So you need to be patient and I will pass to you and come back once it's done.
After a few minutes, he has finally finished the analysis now on the left here, you can see the program
trees, and this is a listing of all the U.S. is contained within the mailbag.
So you have got a text, the holiday target, daytime resource and so on.
And this is similar to what you saw when you use the piece to you all CFF Explorer in a center panel
is a single tree, and this contains all the names that are found inside the number, all the software
that you're analyzing and you can expand on them to look inside a group.
According to Directress of Imports, imports contain all the video files and your functions within them,
them being used by the program and then expose those supported by the program.
And the function here, you can see, is one entry.
So if you click on it in the center in the listing panel, this is called the listing window.
You will see the disassemble assembly language.
And here is the entry point.
The entry point is the any program first starts when it runs and then just below it, you can see there's
a call to security in each cookie.
And this is a hint that you are you should look for when you are when you are disassembling and doing
the analysis of the code.
And just below this call to security cookie, you will find a jump.
Right.
And this is the jungle.
We take you to the main function.
Now, on the right here, you will find the decompiled window.
And this is where you will see a C language listing of the assembly code.
And this is not perfect.
Sometimes he could be wrong, but it is quite close to the sea language.
So now in order to find the main function, we will click on the job.
And it comes after the call to the security in its cookie.
So let's click on these to head over there.
And now we are in the function that will contain the mean.
So on the right here, you see the Easting also shows you the corresponding computer decompiled code
for this mission.
And if you look here and scroll down, if you find one function, which has got three variables, three
parameters, and this is the one is called one, two and three, this is your main function.
Normally it is just below somewhere the bottom below the equation.
So this is the main function that is that is always there for any Windows program.
If you want to know more about this, you can look up in you head over to the browser and look for Amsden
and you keep the windows.
You just type everything.
Windows need information signature.
And then I think this should be the one he's carrying on.
And he would tell you the what he looks like, I mean, I'm sure signature.
All right, so the complete misinformation signature is going to be wearables, Occy to point out the
checkpoint work environment variables.
So just is standard signature for women, for Windows main function.
So you can use this actually to identify your main function in Ghidorah.
So when analyzing after entering the entry and you scroll down, look for function with Katrina, reboost
three parameters, one, two, three, and that will be your main function.
So you can directly in the function signature and you can call this mean.
And.
The faster way is to base when you have a copy from the Amazon, and so one, two, three is Baysinger.
I can't pace because I copy from our site the washing machine, so here I can change.
The nature of everything will be the first perimeter will be the three count.
How many were how many variables you have in your in your windows?
Kate, the first one is in Occy, second child being in that environment, so he's going to change to
so the first parameter, you don't have to do this, but I'm just showing you so that you know how to
edit the signature of any functions.
So this should can't be taken will be on char.
Point to how we describe it, but inside Syria, you cannot use his square guitar doesn't understand
it, so you have to convert the square to start front.
And finally, the last parameter is your environment variable.
Just put a. a..
This one will be point is a.
So this is how you and add function, the e-signature and you function.
OK, why is it OK?
The name of the team will be reflected here automatically.
And you say yes.
Well.
So click this to you here.
All right, this is a win win here.
So these are the barometers pushed in the state.
We have three push.
Before call.
All right, so here is the same tree.
One, two, three, then you have a car.
So this tree pushes one to.
Just one to three, then call, so just call me if I can make use of these three.
One, two, three.
So this is your me, right?
So now you look it don't mean remember, you always have to push your car or another because you can
look functionally has three parameters, and that is your main function.
So now you can click on this and go straight to the main function and this is your only function and
here also your decompiled window, which to show you your main function.
Right.
So this are information and you can scroll down and take a look at it.
And this is why it looks like.
At this stage, you can see that this is the main main function and there are many other smaller functions
within it.
So normally we would investigate each one of the Internet by double clicking and entering it.
So if you double click and there is something and then you want to step out of it, you just have to
click the button, you see.
Now you're standing to it.
You and go back is click back and then you step out of this function to go back to the pattern formation.
Now you're backing me, right?
And then you can also to click on Windows here and click on function called Graph to look at the graphical
representation of all these functions.
So Ghidorah, we show you the function called GRA.
So for men, you have all the other functions within minutes.
So it is way to view it and you can zoom in and out by using your mouse to scroll.
And then from me you can see all these functions and an issue.
Each one of these, you can again click, click on it to enter it and click, click on it like this.
And then it's a plus at the bottom of the class, a spin and show you what is inside these functions.
And you explain to show you what is inside this function.
And you can see in the bottom here all the functions within it.
You can move, you can just draw in holes, your left mouse, and you will move like this.
Then if you take the minus.
Here you can see a minus.
He would collapse again.
All right, now another to you.
Can you see this on the news and then go down to function, click on Function Graph and you will it
should a graphic form a square blocks like this.
And then here you can zoom in now using your scroll wheel.
You can zoom in, you can move by dragging and moving around.
You can also move your blocks around by dragging the title of each block and moving around so that he
can allow yourself to make it easier to view.
Like this, and in here, you can see if housing blocks are clearly marked here like that, and at the
bottom is an overview of your graphic of view function graph you in this.
OK.
Now, think this is a graphic of you, of the compiler here, for example, function previously.
So basically, you know, into each one of these calls here to see if there are anything interesting.
OK, so so as you enter each one, you will find it is one particular function which is interesting
and just click on it.
You would.
And here you can see there is one function API call his debugger present.
So it appears that this Melgar is checking that there is a debugger attached to the program.
So he returns the result in Beevor one.
So if you want to know what is about the present that you can Google for investing in using the method,
I told you earlier.
So if you see Sebago is present, it will return.
True, so true.
The one you gorga is not present within zero.
Here is a testees.
It is testing whether the result is one or not.
If the result is not equal to zero, that means the is present.
And so he will put the message box to let the user, the pieces third party compile each script and
then he will go somewhere else.
But if a debugger is not present then you see before and then he will go down here and do what is supposed
to do as Albay.
Right.
So this so you have to somehow change this to be false.
We don't we don't want the metal detector debugger.
So in order to do that, we need to use in order to call debug activities, a powerful modern debugger
where you can modify the running program to change the value of any kind of API which is running.
So to do that, I will show you in a nice mess.
Thank you for watching, Soudan.