Hello and welcome back.
In this letter and I'm going to show you some of these uh points differences between greetings hero
programs setting preferences how to view and use this assembler window pane while the entry points and
so the basic commands to step over the program's line by line.
OK let's get started now.
If you go back and look at the place where you download this cracked me it is stated by the author which
you see a programmer and that this is a very easy fly What do you mean by fly.
Flag is a kind of password.
You can also view it as a serial number which you're supposed to find from the program.
Let's take a look at a program which we downloaded here.
If you were to double click and run in
he would just open and close.
Very briefly so this shows that it is a command line interface program which you need to use run from
the command from.
So you need to open up on prom and run it.
So that gives us he first example of the differences between GRI ends here.
Programs great programs graphical user interface programs which are those programs.
We have a window and the mouse.
It can be used to click to run our two minute program CNI programs command line interface programs such
as this.
So when we first start to learn about software cracking we would like to keep things simple and learn
how to create come online interface programs first and then later on we can move to the graphical user
interface.
So this Mexican great me is a command line interface program so to run the program we need to open the
command line from initially how did it then.
So you click on the bottom left corner right click on it and look for command from and then open a command
problem and then issue navigate to this location of the uh correct me.
So you can type C D E C colon backslash followed by this.
You can type it out manually type this
or an easier way is to simply type C D and then from here.
Copy the path and here correctly base and then presenter immediately you enter the correct folder that
contains your correct me.
So not to run it from the command line prompt.
First you must list the content of this directory by typing D I R and enter and you will see the name
of your correct me which is called on Title 1 EIC not to run the program from the command line you do
something like this.
He would take the name of the program.
He didn't have to spell it out in full.
You can just type you in and press the tab key on your keyboard and you will complete the name for you.
Now we just have to press enter to run it and you can see you can see an output see try hard.
OK so this is why it shows you that you need to find a way to get hold of the flag.
The zero no password or whatever you might like to call it.
So in the among hacking circles and cracking and groups this trying to find out the sheer number or
the password or some secret phrase is called Capture the Flag CTF in shot CTF.
So this uh tracking
activity is something like trying to capture the flag as well.
So that's why this auto series is a very easy Capture the Flag.
So at the moment this program is teasing you.
I seem to try harder.
So OK now I will show you how to capture the flag.
So what we going to do is firstly analyze this program which I've shown you how to do in the previous
lessons that used to open in view of the i.e. so in your point of view i.e. you will show you the entry
point any emission base.
So this is a hint to tell you where there's a program start to run and what are these numbers.
These numbers are memory addresses KMI closes and show you.
So now we are going to open this cracked me using the x 64 BBG so I get and drop it here and run.
Okay so now is the moment you open this program you can see so this started by his past day and it is
past at this entry point.
This is not entry point very well.
It is starting off the operating system.
It is not yet your program.
You haven't even enter your program yet you are in the operating system.
So how do I know that.
Because early on when we analyzed a program by opening of even the IEEE the IEEE showed us that the
entry point is at this location in Mission bases at this location.
So an image based his the address you enter your program starts but it is not the entry point to get
the entry point.
You must take this no which is in hexadecimal.
Add to this number the image base and that would give you your entry point.
So the entry point should be 0 0 4 0 1 4 He's 0.
That is the entry point.
Okay.
And from here we can reach the entry point.
I'll show you how to do it.
But first things first we need to set some references for our access before the G so to set the preferences.
We go to Options and top here click on preferences and we want to uncheck this the s convex or there
is no need to know what this means because the only gets more confusing.
But trust me you don't want to have this checked.
So for all your tracking projects we should sure this is unchecked and normally you only have to do
this once and even will remain unchecked.
So yes unchained is the second thing you want to do is go to the accession.
So this events there now would a sessions that.
And here you are going to enter a range of exceptions and what I section say exceptions are errors that
arise in the program.
Now X 64 DV G is able to handle any errors that arise.
It is a debugger after all but for cracking solver purposes we want to truly roll back to the program.
So we are gonna tell X 64 DB g to ignore all errors so that the program will handle it and we can analyze
his behavior better.
So we have to add these exceptions here.
So click on Add range no exceptions.
Range from the numbers 0 0 0 0 0 0 0 0.
There are eight zeros there and here.
It FS have have have have.
For f f f.
It s so this.
Okay.
If you have these so this means that you won your SCC for debugger to ignore all these errors and truly
back to the running program to handle it so that we can observe its behavior.
So now just click save and we are all set.
So now you can see the program pass and this uh operating system address.
So let me explain to you what all this means.
Now the first column is known as the address address in REM memory.
The second column is your quote in binary form written has hex numbers.
If these numbers are actually in 1 0 1 0 1 0 and so on.
But to make the numbers shorter we put it in hexadecimal form.
So this actually known as COP quotes on machine inputs of course.
So for the most part we are just gonna ignore this our codes and in the third column is your interpretation
of this of codes in human readable form.
So this is this human rule form is what we call assembly language and that is where we get a name.
This assembler from this program exists for the BBG is this assembler because in this assemble the machine
code into human readable form car assembly code.
So from code on wishing code to assembly code or assembly program.
And this is what we are looking at.
Most of the time because this is human readable so the tech column in the fourth column here is the
comment column.
The comment column sometimes is populated by strings like this.
You can see the comment.
These comments are inserted helpfully by existing for the BJP.
And it makes our job much easier because the excessive for the BJP has interpreted some of the meaning
of this symbol and show it to us here and we'll be making our use use of this quite a lot as we go along.
Now there is one more column which I mean meta which is over here and this is something like a graph.
So this graph here tried to map how the instructions are really jumping from one location to another.
For example you see this instruction would jump from here to here.
This and many of you jump GJ all these instructions that you in Jamie's to jump.
And yeah many of them you can see here jump here and then here's another jam.
All those things studying J means jam and I'll get I'll explain that in greater detail later.
OK so this is how you interpret this assembly window or this assembly view.
OK.
So now we start whenever you start a program he always starts in the operating system here.
And if you want to restart the program you just click on this then restart and you start all over again
in the operating system.
Now realign our brain system.
We are not yet in this entry point your entry point is entry point for your.
Correct me sir.
So we do not one to correct the operating system.
We want to create the correct me sir.
So we have to go to this image address location so remember this is address.
So we have to go to 0 4 0 0 1 4 0.
So to go there there is a shortcut.
Way to go to directly.
That is by clicking this button front or pressing F nine on the key what we do the same thing.
So you click this now or press F nine and immediately watch the address as I click on this.
It goes straight to the entry point.
So this entry point is supposed to be your entry point for your program.
All right.
4 0 1 4 3 0 OK.
So we are correct.
So we study the entry point for one for each zero and you can compare the IEEE take this number at this
and you get this number for 0 1 for each 0.
So this is how you can know where is the entry point supposed to be and to go there.
All you need to do is restart the program.
Take this one time and you will land on your entry point sometimes.
This command does not show entry point here.
So sometime this might be just be a blank.
So if this is a blank even you want to confirm whether this is ready to go the entry point always refer
back to the IEEE the IEEE detected.
Easy.
We'll show you the entry point.
Just take this hex number add to this Can you get this entry point.
OK.
So that is how we launch our program into the entry point.
All right.
So the next thing I want to show you is how do we step through all these instructions to the step to
the instructions.
We will press the F A key on the keyboard.
Or you can click this key this button which means step over so f it key is to step over F nine is to
run what is the difference if you click f if you click this button and run or press F nine you will
run in the program.
That means you will go through the program without stopping and your program has terminated.
As you can see on the top bottom left on the bottom left corner committed to debugging stop.
So we doing 1 2 press F nine all the time.
That's why we need press f it after pressing F nine to hit.
How do we find.
So let's try again.
We start now we are starting to go to the entry point.
What do we do.
We press F nine on the keyboard click on this button run and we land in a two point okay.
So now we want to step through line by line.
We should press f 8 or this button so we keep pressing f here or we click on this but then he will move
from one instruction to the other in sequence from top to bottom.
Sometimes he may jump all over the place let's take a look.
Okay.
This call will go to this address 4 0 2 6 8 0 and an income back continue here okay.
So you go.
You go to the address.
Come back here in this step.
Call
keep on pressing f it.
All right.
Have you come to our income remember I mentioned earlier all those instructions starting G jump instructions
and there are two types of instructions that jam.
One is conditioner.
The idea is unconditional.
This instruction is a condition on jam.
This instruction GMB is unconditional and.
What is the difference.
Conditional income would depend on the test just above it.
So based on the result of this test it is testing two registers.
Here is testing something different based on the result the test.
He would decide whether to jump or not to jump an unconditional income does not depend on any test.
He would jump straightaway.
That is the meaning of unconditional income.
So now we are here.
As you can see let's continue this step repressing f it so now it is at this point.
And how do we know whether you were German.
How do we know.
We can look at this and look at the status box here and use this gem.
He's not taken.
That means it will not jam and another indication that he went on jammies who look at this line it is
going to jam this line will turn red.
This line indicates the jam.
Look it is a long jump right to the bottom somewhere.
But we're not going to go there now.
So it is not going to jam all right.
So this is confirms it as well.
It is not going to jam.
So if you press effort you would just go to the next line without jumping.
Watch.
So I press f it quickness.
True enough he goes to the next line and the keyboard pressing f it see what happens f f f g f it.
Okay so now you notice this line turns red meaning that this jump will be taken because this turns red.
And then a confirmation is here.
Germany has taken notice.
So this is called unconditional John.
It does not depend on any test and birth before it.
So now this press effort and c jump and even tells you where it is going to jump to.
It is going to jump to this location 4 0 1 2 1 6 here 4 0 1 2 1 6.
You can see the two arrows one here and another arrow here.
So this this column tries to draw a better graphical view of the jumps.
Here is a simplified arrow to show you the jumps and you see you notice the arrow can be pointing down
and some areas are pointing up.
This means jump up habits.
This means jump downward so did not look the direction the arrow tells you where you reach it will jump.
Now this kind of thing jumps normally loops that give given looping for certain periods of a certain
number of times.
All right.
So now you're here and you're going to jump unconditionally and this will work in front.
Here is a name of a program which is Title 1.
So normally the the and the FCC for DG will put your program name in front.
Put a dot followed by the address where you will jump to case.
Now if you press F it was going to jump all the way down to 4 0 1 2 0 1 6.
As mentioned here.
So let's do it now and see what happens syllogism.
True enough so it's taken a jump.
So now you press heavily gay and include ongoing.
Now let's let's analyze this now.
Press TV Okay.
Is it going to jump or not why do you think yes I think you you will go.
You have got it correct.
It is not going to jump because firstly this line did not turn red.
Now remember this is average.
It is but he didn't turn red.
So it is not going to jump in error.
Another indication is over here Jim has not taken indicating that it is not going to jump all right.
He can confirm it by pressing epic and issue move to the next line below it.
And true enough he moved the next line below.
Let's continue pressing Evy Evy ethically Evy now what do you think.
Is he going to jump yes it is not going to jump.
Why you didn't and read the line in it and read.
And the indication here is jump is not taken.
So.
Press Evy
yes this one would jump because he turned red.
And the indication shows jump.
He's taken so less passive he so is very is going to jump to you is going to jump to 4 0 1 4 8 1.
So he's going to jump way below down here for 0 1 for it.
Right.
OK now I already move.
Scroll down with my mouth.
How do I go back to the last location.
Very easy CAIB.
Click on it and you go back to the last place where you stop.
So EIB is call an instruction pointer to the e in front means extend that extended instruction pointer
all the e front means extended.
So EIB whenever you're lost I say I screw all the way down and I want to go back to my last indication
why I.
I just I quickly this and I go back here now and continue stepping.
So when I press f it he will jump all the way to 4 0 1 4 1 as do it.
See he landed here.
So now I press f it again and continue to go like this.
Now what is the difference.
We didn't call and jam call also does a jump but he doesn't show you if you want to see jump you need
to press another key but I will show you how should that to you in another lesson for now I just want
to introduce you to jumps.
What jumps so we do call and a lesson so no let's press f it
OK.
So a jump here feet again this angry job because it's Ray.
Yes is mistaken
call John Jim so each year so all of the assembly code is just about jumping in calling this it jumping
calling Coco Coco.
Jim no jump taken.
All right fine.
Jump OK.
So this is going Abbott's effort.
He even jump because the arrow didn't read.
OK this we jump with it and red.
And he also says jump is taken.
So he jumps up
hub again.
So this is a loop.
So it would keep looping until a sitting condition is met OK so we can keep on pressing and pressing.
F f f it.
And eventually he will terminate the loop.
And where do you think it is.
Where do you think in the loop with only
you can give on pressing and keep trying.
Okay.
This is one way to make a.
You even go out of the loop up here all right.
So there is one we
all we can press f it hold press area and key one hole and using it will go faster eventually you leave
the loop.
Once they lift a loop released the key have it.
Now I'm holding it.
OK.
It has come out of the loop and now it is somewhere else.
OK.
So now he's over here and the jam is not taken so press ever it again and you can see he keeps on going.
So this is how you step through the.
OK so eventually if you keep on pressing f ed you will reach the point where the message try harder
will be shown here but you might miss it if you press given pressing and releasing and you missed it
sooner because of you.
CORNISH pressing f it without releasing so it missed it.
So in the next lesson I will show you a way in which you can boss the program using break points.
So that's all for this video.
How to see you in the next one.
Thank you for watching.