Hello and welcome back and let's continue if you click on any of these sections, you can see the data
and I'm here for the data section.
You can see the string.
Hello were there Windows will read the data in the sections here from the disk file and then make use
of his right address, wrong address and Rosyth and copy them into virtual memory.
However, many copies of this individual memory initials are the right size.
Here there are signs and witnesses are not the same as you can see.
So Rennies copy into which a memory he will notice is different.
We can confirm this by checking the process.
Hekker over here, the address is 200.
But how many copies this into what your memory you would take on a different address.
And Yalcin is one thousand.
So here you come.
Here you can see Crenna the are semi's.
One thousand four is the best image.
Address his Facinelli.
So we take the emission base plus the offset and you get this address.
Next we shall take a look at the our phones dynamically libraries.
Let's consider a program like this.
Now there is program one in program to walk mixed, use a helper function.
It will be better then since they are both sharing the same code to create the file out of the helper
function so that they can check rather than to repeat the helper function in each call.
So if you were to take a helper function and put it in a DNA file, we will get something quite different.
Let's take a look.
We will end up with something like this.
So now these have a function has been factored out into the URL file.
So this is the meaning of Giurgiu dynamically libraries.
He has got the extension and the back.
The file also uses the PEF format, just like the Windows Executable File EIC extension similar to EIC
files.
DL files also hold executable code and instructions.
If you click yes, he will launch his process, but if you click Deadfall, he won't launch a process.
This is because indeed our files can cannot be used independently and can only be used in combination
with another HCFA you can use in order to detect when a fire is ideal or an SFR.
Another way is by using the characteristics feel in a B file.
For me, if the file is the URL, the characteristics feel the value to indicate this property and CFF
Explorer shows this.
That is an example.
Sample for two.
Let us run and check some of our two.
And you can see ten point three percent.
This is a dynamic library to confirm it.
We can open in Sierra Explorer just right in here, and now you open a separate checkpoint.
If you click Fida, click on the characteristics, feel you can see that the flag here, finally filicide,
the yellow.
So the CIA explorer together with Trip confirms that this is indeed a deep and if a deal is just another
peafowl.
So when executable peafowl is about to run windows, look, the DL files first into memory windows will
then check for the list of export that functions from the DFS.
By referring to the important category also known as the impact table.
So if you go back to sample for one Pignone punditry, you can see sample file.
He needs to have Ms.
Viscardi.
Yeah.
So if you were to now run.
Posts one for one and look at a more dubstep.
That is hopefully a process A..
Now, quickly, on some fallen.
If you go to the Monistat, you see the symbol for one misusage.
Yes.
So this confirms what we've just seen, he said I saw.
So this confirms that this library, Microsoft C runtime library, is loaded into the popular memory
for the SFR sample for this one, one of the things you might have noticed in a while step here is that
there are many others this holiday in addition to this.
But over here, you don't see that.
Now, this is because of dependency chaining Microsoft.
We should see runtime.
Yaffa also has dependencies.
It also needs other details.
So that is why we also see other deals here in addition to this Yaffa.
So to get any formatting, this might be connected to candidates who may need something else.
So on.
And you can also use a dependency walker who are here to check it out.
Sampo, for one, needs this year.
But this deal needs so many others like cannabis and T.J. and so on.
And that is why you see some additional details loaded into the virtual memory for this EIC.
So this is what we mean by dependency.
Another important concept is I had input investible.
The question now is how does the we know which part of the deal contains the function that he needs?
He does that by something known as idee, input, address table.
Coming back to this example here, this program, one in program to both needs to use the help of a
function that comes from this deal that is not try the other samples.
We are going to rename something for to.
I think A, because if you just confirm it is a -- sample, 40 years.
Yes, he has a name and it requires the DL and the.
Let's close this one, a random sample for three.
So when you run some poultry, we see this message helper function two coming from DDL.
It is now open some people for three in Koff Explorer.
And this one closes and look is down here.
So now we have to fast sample for three and each corresponding the alpha.
If you look at a sample for do the Al Aqsa phone directory, you can see there two functions which I
spotted.
And if you going to get some powerful trigger easy empathetically, they require sample Faltu and you
click on it.
You can see it requires helper function to which is coming from export territory, have a function do.
So this is how vehicles work.
Yeah.
Has got the export directory which is used by the EIC import directory.
And this is the offset to this helper function to OK.
So it's all for this lesson.
Thank you for watching.