So fire your A.G..
And they set the options, preferences and check system break point, and yes, Corvex picks it.
Then open the Melbourne.
So, like all files.
And select a single Milray, and he opened.
And now you should be at the entry point.
And now we are going to put a break point.
We are going to set a break point at this address, four zero one one five six.
So come down to the command line and take BP, followed by the address, which you can write and copy
from Keija.
P.S. here.
And enter and the message says Breakpoint at four one one five six set and click on the Bitcoin step
to double confirm me.
You know, you can run to the point.
And you have every point, four zero one one five six.
OK, now you will see here that X contains the address that is going to jump to.
So just step over.
And that is the easting.
So he's going to push through the stack, so this is the normal push followed by the normal, right.
So now he's pushing this stack you can see here on this tank.
And when he returns, he returns to this address.
So this is your normal routine.
So here you see, this is probably the Chalco, which is and back into memory, we are now going to
Dondi Chalco analyzing Engager.
So a way to do this is to use the safe data command.
So the safety, the command is in this format saved data path to output, far better dressed in size.
And this is a sample of the parameters.
So now we are going to pull the path to our amplifier, which should be in this location.
So I'm just going to copy this sample and put it down here.
They're part of the appeal for the second Parmeter is your base and tries to find a base address for
this code, you can go to a memory map and see this already highlighted.
So it is a base address.
Zero zero two three, followed by four zeros.
So we can just copy this or just type it into our not back here.
So our base address will be.
Zero zero two three zero zero two three four by four zero one two three four.
And finally, the size is eight seven zero zero zero zero, so the size we can just copy from here is
the same as a sample and just pieces here.
So now we going to copy all this.
And then paste is common and any common input.
And when you enter, if you see a message about confirming success and you see a return to this, so
now we have a shark in INSIGHT is who the.
Now, we you need to go back to Nedra.
And then we'll track the Chalco year, just dumb.
Is this one?
It into Georgia.
Ghidorah did not recognize it, so we had to targeter what formalities click on to treat us like ice
eighty-six and a.m. from here.
So like this one.
OK, and now confirm everything is doing OK again and you will begin the process.
OK.
So now you can either drag this into the browser or you can also use the or the open code browser to
open it.
So click file open and select initial click, click, OK.
And he asked you to confirm whether you want to analyze it.
Click on.
Yes.
And over here, check on the compiler parameterized.
And there is no changes required in the life.
Now that you just finished analyzing data does not know where is the entry point.
So we have to give each the entry point and you can do that by going to CBG and look for the entry point,
which is this address.
But this is the basis that we need to get you all set to provide the Ghidorah, so in order to calculate
said we can take this in minus this base address so you can open your calculator.
And you change to the program with a calculator.
And it's like Hecks and King, these evalu.
To be six, he needs you to.
B.
60.
These zero to be 60, the diesel to be 60, zero minus their base address, which you can get from the
memory.
So the base address is
two three, followed by four zero two three, followed by four zeros.
And they're really fully offset it six the zero, so that now we know the offset we can use offset in
Ghidorah.
So eight six eight zero.
So engager select navigation go to and then key in the offset.
Here, eight six eight zero.
So here you timing it, six e the zero, and he OK, and this is the entry point for the Chalco.
OK, so now we're going to do the same analysis, we try to look at the epilogue for these functions,
Chalco function and see if there's any abnormal epilog.
So on the right here, you can scroll down to the bottom and we turn here.
And then you look at the Eppalock.
So Epilogue also looks very good because there's a push before I return, by this time he's pushing
him and he seems to be pushing a local variable.
So in order to find out what is the address and look over what is the address on the very day it's been
pushed to 88, we can use the debugger since the debugger is already open, we can put a break point
and this offset in a debugger it's F.C. for.
So let's go back to the debugger.
And then over here we are going to put a break point and the offset it.
We're going to put a break point out that six F C fall, remember, that is eight is a bit address.
We just want the offset.
All right.
So here the address is usually to be.
So we have to put the breakpoint at BP.
We take the base address here, zero zero to be, zero zero to be.
And then the last four numbers here will be offset Tufano from here, which is six F.C. four six and
C four.
All right, so now you can enter and he says breakpoint at this address, so we go to break point and
confirm that indeed he has been set to return.
All right.
So now we are ready to run to this point.
All right.
Now we will let it run.
A great point.
And now he's hitting every point for the abnormal return and then.
No, no, this is his sister.
The address is returning to so he can now go Stepanova to return.
And there you go, he goes back to this address, four zero two three seven.
Now, this is already outside the Chalco.
It is not in sight.
I mean, so this could be an indication the U.N. backing is already over.
It might appear that this nitrogen is just redirecting us back to the original location.
Obviously, the main entry point, and this is probably has overwritten with some new.