Hello and welcome to this demo, practical in this lab.
We are going to disassemble the net application, a simple one, and then modify or patch it.
So download this from the recent session and I repeat the password to unzip these Cifas is cracking
lessons.
Come put the folder in this new folder on the desktop.
I call it that malware analysis.
If you open the ANZFA, you will see HCFA dot net demo.
And so let us first see what it does so great on the bottom left corner and look for a developer coming
from the developer and then you will see develop a common problem for Visual Studio to 019.
This click I need to open and then copy the path from this window here and then go to the command from
JS Directory Seed Space.
Right, click to paste a new territory bar and hit enter if you type, there are no you will see the
content of it.
So if you run this program target demo one.
If we just play Hello, Demo, and that's all, so in order to use ILADS to disassemble this technical
mine, I am the same, followed by the name of the executable and into you then open it in the application
called I PSM.
And from here you will see there is a hierarchy of files and folders.
You will see that manifest here.
If you double click here, he will show you the manifest contents, many faxes they will contain.
And then and here you see there is another folder called on that one, the name of the application itself.
And this also applies here to explain it further.
Now, the first thing I believe we want to do and we are analyzing the executable, is to locate the
entry point.
The entry point is usually in a programs class or here program.
Sometimes you will see many folders here.
Look for the one with the name program in the back and end up click on it, open it and you will see
the main program here.
So this is the entry point.
So if we double click on this now, you will see that this is the disassemble.
This is the instructions.
And this is the main function in method, the first instruction is to look strong, so the first thing
that you lost is hello, the one he lost it to the stick.
And then the next instruction you call the IPPEI function, correct.
I'm from this class system console to write the string.
The parameter to this function is the string which you load up here.
So that's how you get your output.
When you see the string demo move be returned to the council.
So now if you wanted to to to see the AM in separate editor, you have to be done this first.
So to them then you just go too far here and click them and then here, do not change the default settings,
just click, OK.
And he would dump the contents of the.
Back to a location of her choice.
We are going to choose the desktop here, the net framework and in here, give a name for it, then
notice the extension you dial.
So click.
So now what it does is it will disassemble the FFA into the IFR and save it in a separate file called
Dump It.
So this is the one.
Now, in order to see the content on this, you need to open it with a text editor so I can read it
now and I open it.
We I'm going to use something line open with sublime text.
So even opening sublime text and you can see the eye language, so this is all in our language, we're
going to see eye language.
And here's the entry point.
And here is a look string hello, Demel one, and here is a cause and a function, you write the string
as a parameter to the function.
So if you wanted to pass this now, you need you can do it this way.
Let's say I wanted to change the string so I can just timing.
Hello, demo one and a key changed and then I save this for these days and down here, meaning that
have edited it but haven't saved it yet so far.
Save and I save the -- so far you have to reassembly back to the Heisey so to reassemble to see you
use the ESM.
So let me clear the screen first in time I have ESM.
This is a different program.
The only one is I have the ESM, the means to disassemble.
Now we are doing our ESM --, so we just take the name of the two ESM followed by the Alfa.
So in this case, the IFRS condemned I can enter and then you will see the operation completed successfully
and you have a new faculty.
So now let's randomizer and see what we get done.
I see.
And I you see the string has been out.
It has been modified.
Hello there.
One change.
So this is a string yet we modify using the text editor.
So this is how you can use.
I have the same to disassemble SFR.
I don't need any SFR and then use a text editor and then use I have ESM to rebuild the editor file to
create a new.
Yes.
So that's all for this video.
Thank you for watching.
I'll see you in the next one.