So we first run the debugger.
To check where is the location of the address we are interested in.
We could use x64dbg
and then attach to the running program.
Simple Serial.
Go to Symbols.
Select the Simple Serial, double-click and run.
Then right-click here and search for strings.
Current Module String References.
And then filter out the "sorry key," sorry, string, and you will find it here.
Just double-click to go to that location and we want to select all the functions.
Look for the -,
so the "sorry, wrong key" is shown here and "correct key" is shown here.
So just, grab, look for the key,
which will denote the start of the function.
Here is the push -.
So the function starts at this address, 004013933.
So right-click and copy this.
Copy the entries and put it in a
Notepad.
All right.
And then the end of the function should be the ret.
Which is at this address.
So right-click on this and copy the address.
Okay, so now I'll show you another way to get these interesting addresses using Cheat Engine.
So let's fire everything again and then run Cheat Engine.
By the way, I will give you the links where you can download x64dbg and Cheat Engine.
So click on this and attach to Simple Serial, open.
Then Memory View, and go to View.
Look for referenced strings, and click Yes, and it will search for all the strings.
Now look for,
click on Search, look for "sorry."
And then hit on the button
Find.
And that's a hit.
"Sorry,
wrong key."
And this is the address.
So double-click on this.
And there you are.
And you want to go to the start of this function.
You can just right-click and hit on "Select Current Function."
And now you can see the start of the function is also push -.
And this is the address.
And just compare it with what we found with...
It's the same, 004013933.
And the return should be this one.
So then, look for the, scroll down and there's your ret, and there's your another function.
Compare that with the...
It's the same.
Okay, so these are two ways you can use debuggers to find interesting addresses to decompile.
So now you have these two.
We are ready to decompile the code, to decompile the function.
So we head back to Ghidra.
We can detach Cheat Engine from this by closing, closing this directly.
Now we are in Ghidra.
So we are ready to decompile the interesting addresses.
And for that, I will show you in the next video.
Thank you for watching.