Let's get started.
We'll open this chief Sixty for DBC
and then press F nine to run it or just click on the wrong button.
Here before that.
Make sure your options are set as follows click options preferences unchecked system required unchecked
yes callbacks and make sure your exceptions are not these exceptions let's click Run and the windows
shows up is the main window and try to enter a name just that a hey and that any kind of
input click on the check and it says wrong zero key try again OK to about about and just use the credit
for the freighter which is my cell.
And then here again.
Now observe here the text has is being shown.
So you have to caption sorry.
And the text message we say it's wrong zero key try again as we have learned before.
There are a few methods to approach this.
Cracking the first one is to search for strengths for example in this case where you can search for
this string the wrong zero key try again and then once we find a string we can put a breakpoint just
some location before the string and then analyze the logic The second way is to use a search for into
modulo calls and then find the put the break points in all the into modulo calls.
In this case we will look for message box so then once you put the breakpoint one on the breakpoint
will trigger.
Once you click check and from there we can narrow down to the line in the memory address that call the
message box and if the method is to use the call stack which is here that means when these measures.
Error Message message box is being shown immediately put a box here and analyze the costing to look
for the latest user my new car and then from there we can trace the address we call the message box.
The bad message box to be shown.
So in this lesson I will choose the first method of attacking this one way which is to put a breakpoint
on the string which is the string in so to put it back find the string.
First you make sure you are in the user space use them or use space which is normally the entry point
address which is around here.
0 0 4.
In this case once you ensure that you are in the user's module space you search for strings.
You can rightly anyway.
And then search for current module string references and once is completed you will find your back nice
ish here.
Wrong zero key.
Try again.
And this is the address where this string is being used so we can just go there by double clicking and
then here we are.
The message is here.
Sorry is the caption wrong zero key try again.
Is your message and the pushers here.
The push to the stack in preparation for this call.
This column makes use of the parameters in the push and then on top here if you screw up you see the
good message.
Congrats.
Well done.
And then this is the good message.
We want instead of this so.
And if you you just above it he will see a jump not equal with jumps over the good message.
So this is the place where the decision is being made based on this test.
So you're testing here whether he x is zero the instruction test.
Yes yes means he's x is 0.
So in this case he he s 0 0 will be 1 he will not jump.
So it will only jump if the zero flag is not equal to 1.
So in this case the Zero flag is not equal to one.
Therefore it is jumping.
So now what we need to do is to look at the logic why and how this X is being set who sets the value
of X so we can screw up further and try to look try to look for the part where the zero key is being
is being input is being read and there seems to be something here and get that the item takes little
item tax is the Windows API function.
We share a strengths the string from the input dialog and you can look it up in MSD n m s The N stands
for Microsoft develop but never get data item test
you couldn't give us the result here and you can read about it here.
So here that that item Texas gets the input from the dialog box and this is a dialog box idea and starts
the input in this string.
So this is how it works you can read these parameters on here which has got the details all right.
We do need to go that deep into it.
So we can put a breakpoint here and then restart the program because we want to his I mean this place
before the decision is made.
So let's restart the program and run again enter first name anything a enter anything in maybe an S
S S S and click check.
And now he has hit our break point in the program debugger has passed and now we can step through by
typing F H
So as you press F it always keeping higher on the on the string instead are all to detect it in this
column as well as the registers to see if anything interesting appears anything any strings pops up.
So just keep on pressing Effie and keep a lookout.
And then here he says.
Get that item.
Thanks.
And here we get right index.
And then here get local time CCP trying to get a look at a time and look out get local time also gets
the ditch the local date and you can also search em as the NSA showing earlier how to do this press
effort to continue.
And notice your he SB stack pointer has loaded the string as SSL switches what you entered through here.
Now let's keep on pressing
and pressing f eight to step over every line every instruction and now you see it has loaded your name
in E X register which comes from here.
So this is interesting.
So he's going to perform some kind of manipulation with the strings you shall see.
Let's press effort to continue
ok.
Now it is.
Has loaded some kind of format string format specifies there's a golf string format specifies.
Let's see continue to press every
and Diego he has called this function.
This is a C C++ function that we as printer v show format strings which combines different parts of
strings to create new strings.
So as you can see he has created a new string r of the name a and put a dash and then put some numbers
behind it.
So if I had to guess I would say this 4 0 0 0 key.
So let's continue to press F it
and there you go.
Now he has slowed it.
He s in here and this is a good time to copy this string.
So just frankly any of the lines which contains the Sierra key can take this one on this one on this
one but I'll figure this one and then go down here right click this and click.
Copy line and then open up your back
and paste into your note that so this is the zero key
so you actually solve it to be equal to zero key.
Based on our input the name so let's step through
and you can see now it is comparing over here.
It is a loaded two strings.
Yes.
The DEA has loaded your input.
You'll see your key as you entered which is all s and then easy X has been loaded.
We've the January to 0 key and now over here it is.
He has compared it to CMB.
So a comparison string comparison.
And then after that to here is going to the next line and then we he's going to jump
so it is jump and now we're here.
Let's continue.
Press F it
and now it is testing so it is testing and he's found that he sees uh not zero.
So it is it's not zero.
That means the test feels it is going to jump because the Zero flag is not set.
So he is going to jungle with a good message and come to the very message down here.
This is going to show you sorry wrong zero key.
Try again.
So let's press effort and you will see me.
That message has been shown.
So now let's restart the program and try to put in the right zero key.
So we have to use back the same name here because the CRT has been generated from this name.
Now let's just copy this and be sitting here.
A quick check now.
Yes boss at the break point.
Is clean fun
and your message.
Congratulations.
Well done.
So that's all for this video.
I hope you learned something from it.
Thank you for watching.
I'll see you in the next challenge.