I come back, so we continue from where we left off.
So in order to decrease the string, we can put a break point pretty.
So first we remove all existing points.
Yes, and then we put our new break point here.
And then we are going to stop here and step into it, so let's run now, make sure the perimeter argument
is set here, OK?
Yes, and so you stop here and step into this and see the return type for this trip, a function step
into it.
And so we are here now and he has permission, we scroll down to the return, which is a result here
with a break point and run run to this very point.
Now, you can analyze the recent results and see just how this it is trying to decrypt.
So this is a decree to string correctly.
Copy value and pasting here and I better news over here.
So these are the fast extension areas looking for so we already know that we can stop the iboga and
hit that space hubo to go back to our main Backspacer again.
All right.
So this is where we stop.
So he has decrypted all the attention where he just had a fighting chance.
He's looking for all these files.
And if he's successful, decrypted all those files, he's going to check for each one of these files,
whether it is locked.
You can go inside this function and study to cook.
So this is one of the ways in which he checks whether the file is locked so he can backspaces you define
his nolla.
Then he will go inside and check for this particular house.
That means he's going to filter from this here, is going to filter certain files further.
So what is he going to filter?
We click on this, find out.
All right.
So now it is going to decrypt this great new area of this string.
Click on history and the string is over here.
You can see so the same way we are going to put a break point here and find out what string is trying
to decrypt.
So this is not an obfuscation.
This is a big one.
So let's try it now.
OK, yes.
Remove this point.
All right, so now we are here and we are going to step into this.
All right, so this is a decrypts a thinking and you go down the bottom, put a big point here like
we did earlier.
And run through the grapevine and now go to the results at the bottom and see so you can see it is decrypted,
the string Karpeles is right click.
Copy value and NBC here, so it is looking for database files, Pascual and.
So now we know we can stop this and go back to backspace on the keyboard.
He might be thinking, didn't be thinking until we come back to our mean no more time.
And here so now we know that in this part of the program is filtering out the database files.
Same thing here, so he successfully decrypted the database files extension.
This would be true and then he would split into separate names.
And then here you try to kill some programs.
So these two can go inside here.
So it is going through the list of all the programs and he's trying to kill some programs, as you can
see, video.
OK, so guess what he's doing here?
No, I don't think he is trying to do is over here, you can see.
Now, over here, if this place falls, there is no database for you to go inside and do something else.
And what is this thing here?
This part here seems to be the encryption encryption routine.
All right.
So he's going to encrypt files.
He never.
And then here, same thing, probably you delete the files from me, from the name of this angry sounding
probably probabilities, a deletion function is how you perform malware analysis using the spy as a
static analysis tool as well as dynamic analysis to two in one.
So I will leave the rest of the of the analysis to you.
The basic principle is like this.
Every time you come to a obfuscated string, you can see instead of trying to manually decrypt the string,
we use the debugger and use the break points and let it be obfuscate industry is for us.
So this is the technique for reverse engineering.
Melvin, thank you for watching.