Hello and welcome back.
In this video, we are going to use Dbag to debunk the program, the melee, and we are going to analyze
to look for the evidence of unpacking.
And then after that, we will use Process Hekker to try to dumb the memory.
So let's begin, since we saw in peace to you that it is a deadly Touby program we use today to be version
of DPG.
He said the options, preferences and check system break point and uncheck the base, just leave the
entry point exit.
Reading Open the mailbag.
Selling off house.
And you see the entry point.
We will now put a break point on which I BP, which allow press enter and confirm that the breakpoint
has been set here it and the debate point at which now he will run.
And then hit our point.
So we'll continue this step if we junta are allow.
And now it is going to push the parameters to the stack in preparation to execute, which Hallock.
Now it is going to call the trial and return the allocation of memory in that he actually days to step
over and this is the memory that has been allocated so directly on this and following in.
And you can see here, he's currently blank and you want see why he permission so he can right.
Click and following and remember.
So currently it is readable and writable.
Nice to you run again to see you hit the water along the second time and you have seen a second time
now step over again as before.
He will jump, jump again to travel, and now he's going to push the parameters of his day and he was
going to call trial a second time.
So we will keep an eye on him several.
And this is the second allocation of memory.
So when I was writing this and following them down number two and we come down here, we see the number
two.
This is the second location in memory which has been allocated for and backing.
If we go back to the earlier memory that was allocated, you see that in the memories and back something
they.
Now, the second one is who are here, so let us run and see what happens to this baby, Follet.
Let us go to the memory and see what kind of permission that has been set so directly on this memory.
Follow a memory not and this time and this new location is set to E, R and W, meaning executable,
readable and writable.
So now it is run and see what happens down here.
As you can see, he hasn't paid himself into memory and he can take a look here.
This is a magic bullet for beheader and double confirmation.
You can see the string.
This program cannot be run in dust.
So this is confirmation that he has, in fact, the executable another and executable inside this memory
location.
So now you can try to dumb this memory.
So for that, we use process.
HECKE So we now open sleigh utilities, open process Hekker.
And scroll down to look for there in some way over here that will click on you and take a look.
His memory.
As I spend this, you know, we want to go to this memorial location, three six, followed by four
zeros.
So if you scroll down, you can see over here, right, executable.
So if you double click on this, we can confirm that indeed there is a beheader over there and you can
compare what we saw in 64 gig Apiata at this address.
So now we can Dundies.
So click on the safe and you can dummy in our Hooda.
We're thinking we can call it in some
dumb
click save, so we have now successfully unpacked the executable that was found in memory.
So in the next video to show you how to open the file for analysis using Nedra.
Thank you for watching.