Hi guys.
In these video we'll analyze the fourth round somewhat.
We start by configuring some filters in Process Monitor.
We only want to see events generated by Green Dot except to avoid cluttering the screen.
Ron they're on somewhat to notice the effect the background has changed as to pay to get the files back.
We can terminate the process since it has already done each job
less check.
The most interesting API calls we want to find out where it is writing the encrypted files
note these are the interesting block file.
Let's check its content so open creep the log file dot takes that
this is the least of files that have been affected.
Next we search for another right file call that writes the actual encrypted blocks back to the files.
We look at the call stack and take the first functioning the list that belongs to Green Dot Dickson
let's open eyed up roll and navigate to the address.
The shortcut to jumped on addresses capital G raised the entire a bit to get more working space either
shows the function diagram next to the assembly code.
This is useful to get a picture of the floor before diving in
notice.
Here are the two right file calls while writing the log file and the other writing the encrypted data.
It's useful to add comments along the way while you're in analyzing.
These will help you a lot later when you come back to your research
so we've keeping on practicing these
here's a function strategically located just before the right file call.
Most probably this is the encryption routine we were after.
To give a function a more human readable name press capital N.
luckily the code is short we notice a loop that operates on a sixteen byte block.
Things are becoming clear.
There is a sixteen byte with exhorting repeatedly applied to all the blocks of the input file.
Take your time and go through the code again.
If anything is not clear Don't forget or always to write comments.
The Annotated I'd upload database containing these comments is available in the resources section.
So here we have located the key
in the next lecture.
We see a way to make their own summary view the key without any reverse engineering involved.
Thank you guys for watching and see you in the next.