Welcome back to another lesson, if you remember earlier on, we did a strictly script using EIC to
act and saw that there was some embedded.
Inside the 80s itself.
So now in this lesson, I'm going to show you how to let the program run into memory and then let this
script expand into memory, and then we are going to dumb using the program.
So in order to let this thing run and expand and bang itself into a memory, we need to use a debugger.
So the debugger that you'll be using is actually dig down here.
So there are two, 64 and 32.
So in since this program is 32 bit, we run extended to GBG.
So once our strategy has started, we need to do some things first, click the options preferences in
here and check system break points.
In this context, we want it to stick.
We go to the entry break point so we think it's safe and in here we can open the mailbox.
So now the dynamic is so go to the desktop, which contains the folder for your Melva.
Selling off as an openly sample sample, being an open.
So now we are going to run it.
So we just click here and then run by before we run, notice that this is already the entry point.
And to point now from our analysis using Ghidorah, we know that there is a U.S. border present being
caught, so we have to put a break point for this is present.
All right.
So from here, we saw that he would address how this is about the present.
He said he said four zero three B seven eight and the base zero zero 004.
But if you look at our egg.
This address may not be the same soon as clicking on the new map and you notice this address is different.
It is one two three zero zero zero for this happen because of something called a SLR, SLR security
security measure.
In order to randomize, he'd be suggesting the program is running.
So in order to convert this into the correct address where the president is loaded in memory.
We have to do some calculation.
So from here, we know that he also needs to be Sereni.
So all we need to do is take three BSEE and go from here and the only to the basic rights of one two
one zero zero zero.
So that would give us one to one trevisan.
Many.
One, two, one, three, seven, so all we need to do is go to that address so quickly and then go
to.
Go to expression in here, put one to one to one tree, be seven, eight, and then click, and then
we take it straight to the other, as you can see.
So do you want to put on breakpoint here so directly on this and then set point Tongo and the breakpoint
you set?
So now when we run, it will stop in and break point.
Now we see the value of X is this.
So let's run over this.
So we click on this Istanbouli and this will be the result of this API call starting in a way, in the
register.
So now he sees one, which means that debugger is connected.
So we want to modify this to zero.
So just right.
Click on this modify value, set it to zero and click.
OK, so zero means it is debugger present is fast and easy.
Did not need a debugger.
The next minute instruction is going to test whether or not this is zero.
So since we have changed to zero, he is not going to jump.
He is going to go straight.
Jany mizin gemological so he is not.
You could zero then he is going to jump by because we only modify the register to make a zero.
So it is not going to jump so we can test it out by typing.
And then you click on this, you see it is not going to jump this higher.
Okay.
All right.
So we are just defeated the EU brother present check.
So now the next thing is if you want to go and go to the location where he is going to unpack the code
that we saw in how to write script.
So to do that, if you put a breakpoint on what you ALAC so we can put a break point by going to the
command line type weepie virtual Hallock virtual lock and hit into anything breakpoint set.
If you go to a break point, you can see all the breakpoint that is set so that we are set which are
now.
So let's run to each other.
OK, yesterday hit the which I'll give you some time, which a lot is now hit.
Yes, he did break point, so which a lot you saw is used by malware just before you unpack this.
So its function is to allocate memory so that you can pay whatever I supposed to unpack.
So now you're going to step over security, which are lot.
Now he's going to escape by jumping to.
And now he's going to execute.
All right, so this is where a lot is going to execute, let Samuel until he goes, he hits the call,
he's pushing all the parameters to the state in preparation for the call.
So now step over and the return address is here.
So it is the address where he has allocated the memory.
If you need to learn more about which are law and the return value, you can MSDS for what you allow.
Google for MSDS, which I look right now, we just want to get to the address where he has allocated
the memory.
So click on X and following done and this is allocated memory for that for the Malaby mother has allocated
it this memory in this location by calling me Charlock.
So now we run again and you will find that you will call.
I love a second time but before we run it again, we want to see what the commission said.
Things for this 3C Cixi to follow by four zero so we can go to memory and look for the location.
We can right click this and here follow in agreement and you see this location, the commission has
been set has e r w executable, readable and right in the.
OK, so now you can run it a second time so that you.
Trigger the ritual upon which time, and then you step over, step over again, and now he's going to
push new parameters, this tank in readiness to Kabul to allow a second time.
So just step over.
All right.
Now he's about to call this and watch the return address.
All right, so he has allocated some space in this kitchen, right?
So, you know, the location was here, this location at six four zero.
So we know we can open back and make a note of how your first memory address, where your mother has
her located space in memory to do something.
So the first memory addresses zero zero six C, followed by four zero.
Now we are going to see what the next address is.
Connecticut zero zero C zero.
So second location is zero zero.
S..
Four of the five zero, so the two locations in memory.
All right, so that we can click on this and then follow and see, this is another location in memory.
Radmila has allocated space to unpack something.
And if you go to the memory map, you can see the permissions.
So if I click on this following memory map and you can see this location and memory has also set it
to be, are you meaning executable, readable and reliable?
OK, so we now know where it is.
We're going to unpack itself, another quote in memory.
So next lesson.
I'm going to show you how to extract how the eyestrain that quote is from the memory cell.
So before we do that, we going to put Breakpoint here rightly and then we are going to send a entry
point, how we execute over here.
So whenever the the mother has hung back and he's about to execute, he wanted to break up with her.
So that's why we're putting a break point.
How they execute.
So now if you go back to break points, you receive a set holiday break point in this location so that
we can break whenever the malware is about to execute the cookies here.
So I will do that in the next person.
I will show you another tool where we can and we can dump the memory just before we execute this.
So I'll see you in FSN.
Thank you for watching.