Welcome to this demonstration, this is the file which you have downloaded and I've put mine on the
desktop.
And you need to scan this, you take it easy, Vye, in order to confirm that this is indeed Doneck
application.
So once you confirmed that it is hand on application, you can just run it now and see what it does.
You can open the command from.
And then head over to this location computer office and see to it click and based upon president's desire
to see the contents of the file and then to run this just.
Yes, followed by the name of the hero.
And you see, after a while, you get a pop up message by saying try again.
So the objective of this demonstration is to analyze their behavior and defeat any anti analysis, any
ism, defend your frustrations and find the flight, which is an email address.
So the first thing we run into is this kind of anti analysis mechanism.
So do understand centenaries mechanism.
We need to use the inspire to this decompiled.
So this is a sixty four week program.
So I'm going to open the city for the NSA by releasing this location.
Now, you drag and drop it into the audience by three.
The first thing we do is look for the entry point, so the suspense is Reichling on the ending, so
like go to entry point.
So this is the entry point, and if you analyze the main function, you will see that there is verification
at startup function which returns boolean value.
If the flight is true, then you execute the spot and then open a new and a new classical client.
But if this flight is false, then it will show the message to try again, which we just saw just now,
maybe try to run.
This is the one try again.
So obviously we don't want the airlines to execute.
We want the flag to be true.
So in order to find out what makes the flight true, we need to enter this function.
So we just click on that and you can see the return value is good for this function.
This method in here, we see that whether or not he returns, true or not, depends on the check that
is performed here.
Check.
So over here it is comparing string B with check string, so extreme V is not equal to string B, then
it is true, then you return false.
So what we want is for the check string to be equal to the V string.
So in order to find out what is the value of the check string and the B string, we need to put a break
point in.
So put a break by clicking here and click on the run.
OK, the program has stopped our breaking point, and at about panel, you can see the local variables
presently the restring is showing now and the beastliness also showing now.
So let us step over the execution and see what happens to the check string, which actually now has
got the value of a.
Hexadecimal string this value, we are about to execute the thirty three.
So let's take a look and see what is the value of a B string after this line executes.
And you can see the B string is this value.
So obviously, they are not the same.
That is why this flag is returning through.
So how do we make both of them the same?
So in order to make both of them the same, we have to ensure that one of these is change to retain
a string which is similar to the other one.
So if you can see from to here, Changwon.
Wang is returning a string, so we have to make sure that this check one functions return a string,
which is similar to be string B.
So he can be seen being on.
Over here.
Now, a copy be and then you enter Changwon function by clicking on.
And then over here, you can see the Changwon is dysfunction here it is turning this valley seven zero
eight.
So you can see here so you can see the dysfunction.
Changwon is returning the value in this.
Check one, two.
One is the key and the value is so we need to return the value we copy.
And so we need to add this and paste hash that we copy clear.
So to do that, we can right.
Click here and then edit the class Zetia.
And then from here we just go for the value that we wish to add.
Here is this one.
So we sell this string here
and this.
All right.
So now you click on compile.
Right now, we click on the backspace to go back to the previous one, so we have to done this to create
a new executable.
So we click on you and then we are going to call it a different name calling.
Dumb number one, dumb one
and click.
So now if you go to our location in a folder, we see that in your file and if you run it, how you
run down one.
We don't get the end analysis message.
Try again.
Instead, we get a new different kind of dialogue.
So if you click on this dial up now he says the valley fire teslik severity or the defeater the analysis.
So now you have to go and see how we can analyze this to find out how what is the event handler for
this button.
So to do that, you open back how?
He ends by.
And then.
Remove the breakpoint, go back to our main entry point by pressing the button,
and we notice that if the flag on any return is true, he should return.
True, because they've already evaded the and the analysis.
So he will return true and he will run this spot and run this new class new line.
So let's click on this new plane and see what we get.
So this new plan here is the one that he's supposed to show us from here.
He saw this film and there should be a button somewhere on this form.
And you can see the send button.
Here is the one.
So when you click on the button.
He's going to perform a.
And if it it is authorized, he will show this message in attempt so we know that is this is true because
this message was shown.
But what we want is to show the house, but the house will give you the flak, as you can see, return
email address.
So you want to be false.
We have to find out why this flag false.
So at any moment the flag is true.
That's why this runs.
So if you want effectively this thing, Washington must listen through.
So you just return to Denver with the operation will negate it to become false.
So that must be true.
So in order to analyze what makes the authentication, that's true.
We can do this.
And you can see the function is authorized here, is authorized here, who get the IP address for this
virtual machine and see it here and then here you go through the collected IP address and they check
whether it is the string.
So if it is destroying them, true, so our objective now is to make the flag true in order to make
it true.
We have to check this IP address to the actual IP address of our virtual machine.
So to do that, we had to find out what is our IP address.
So we click on the command from here to find an IP address.
We type IP config and we see how IP addresses 10 zero to 15.
It will be different for your machine.
So just follow us for me is 10 zero to 15.
So I'm going to add in this by clicking is this time we used to edit our instruction.
I only use the.
So over here, I would look for the string, the loose string over here, and I'm going to chain used
to my IP address, which is 10 zero to 15.
10 zero to 15, and then I click on OK?
Now, I have to dumb this to a new far more you and this time I'm going to call it dumb to.
And I see, OK, and now I have another for.
Let's clear the screen time.
Yeah, let me close this first one now, having you find time to run them to.
And authenticate, so we solve the challenge, this is the the email that we are supposed to fish out
of this binary.
So this is how you can use the spy to let the office yourself by modifying the program behavior to the
debugging process.
And then get our information that we require.
So if this was a malaby, this email would be your indicator of compromise.
So this is hopefully the smartest for you.
Thank you for watching.
I'll see you in the next one.