Hello and welcome back to a new section in this video, I'm going to show you another way to get your
chanco Paille.
This time we are going to embed it in the resource section.
So go and download this new project from the air resource section of this lecture, unzip and put it
in the same folder which you did previously in the zero imbedding built for the insight, this new project.
You will find the shark, which we generated using Metasploit on Kali Linux, which is a fake icon.
Call not back.
I see.
Oh, the name doesn't matter.
You can choose your name.
You can change any name you want.
But if you do change your name, you also need to change the other files.
Be references to name.
So do you guys use fake icon because you want to fake the recession so that any analyst who you were
to analyze our malware will not think that this is Churko because of their dizi.
And moreover, resources normally the place in the section where you will put your icons.
So you appear very normal.
That's why we put a fake name for the court case.
Not that that I see.
Oh, right.
Click on the Kompass, create and open it.
But you will notice something additional here on line tree.
On line tree.
We have a RC compiler and RC compiler is a resource.
Compiler resources also needs to be compiled.
That's why you need to use this name and the quote know the script.
Yeah.
Aracy uses e court resources dot housei Bekasi extension.
So what else he does is takes in this file and compiles it, compiles it into a resource file which
has a.
Arias extension.
And then after that, another program called CBT Harriot also means convert resource.
So this program, this tool will then take the resource that you have compiled and then convert it into
an object file with a dot.
Always tension.
So any father has or extension object files.
What object files?
Those Monteux, which are needed to build your finer EIC program.
So the reason why we need to convert the resource into an object is because the next line we are going
to use the compiler to link together your object file.
Into the objec file folder, the main you to produce, you'll find your EFC font.
That is why we need to convert the resource for into an object font.
So let's take a look now at what insight the resources to RC.
If you open the resources to RC, this is something you hear these two fast and you, Rackley, in fact,
you would be able to see because it is mehndi playing test fire.
So inside here, all it does is it tells the program there is a task compiler that you are associating.
This resource called My Icon is the RC DataType.
And the data for these are the kind of thing is contained in this far gone back that I see, oh, now
are all these treaties here?
Our data is constant is a key word.
You cannot change that.
You have to use this.
But this name here, my icon.
You can give it any name you want.
Same thing with the last parameter here.
You can also give a different name if you win by whatever name you give for the fund, constant symbol
and also the bank name for your chocolate.
You have to also be consistent to make the necessary changes in the other fast, which I explained to
you in a while.
Now, let's take a look at.
Ressources notational.
So if I erectly resuscitator Hajj and hopefully not back, not here, she's ahead of our use by the
compiler in order to link together different components needed for building final e.c.
So normally, Donghae Hadifa who contain all the defense.
So in this case, you are merely defining that this symbol, my icon has got a constant two hundred.
This is needed by the program.
Later on, when you open this program, you be able to see that we need to.
Right.
What is the number, the constant for this symbol?
So now your programming, knowing that whenever you see this symbol, my icon is actually referring
to the constant two hundred.
You can change this number here to any number you want.
One hundred, three hundred, four hundred, one thousand, whenever it doesn't matter.
So now in the final father.
OK, is the SARS-CoV-2 far?
So that's Reichling and open this week.
Not in this S.P. SARS-CoV-2 file will be almost similar to what we have used before.
Then we were trying to name that.
I shall close.
The difference now is this additional API functions which I use in order to retrieve the Chako built
from the resources section.
Now you can refer to the notes which I provided for you by downloading this file here, which explains
to you all the necessary things you need to know in order to use these APIs.
So these are the MSD and references.
All you need to know about using the API functions for loading a resource.
You can read it from here.
Find resource, find resources.
You hear her purse or find resource is to determine the location of a resource if they specify that
minimum in the specified for you.
So the two parameters are sinking in that one.
Those are the important barometers where you specify the name of the resource and the type from the
resource.
So if you go back to our source code, this API, the name of the resource is my icon.
The debt parameter is a tank that we rescore Haraszti data.
Find the source function.
Look inside your resource file for anything that has given this my icon name and also is for type housing
data.
So once he finds that, he will return the reference and stored in this variable called Arius, which
we define up here, this variable is merely to store the resource information lock that you get by calling
this function.
Then after that, we pass this parameter into the next API function call resource, not resource, except
to parameters that the Monju and Resource Commission type.
So here you can see the two parameters.
The first note, normally we put zero so that you automatically look at the resource for you.
So all we need is the second parameter.
The resource information means we've got it from three sides.
You will again extract the.
The resource mortgage reserve and return it to variable, which we will start in the resource handle
which we declare here.
So now we Hangul is a reference to the actual resource itself.
So now that we've got this resource handle, we can link to the data in safety resources.
So by using LUCKE resource, once you have a lot of resource, you can point to the first buy in the
memory where the Shockley's through that, that turns as an address.
So here Chako payload is a very bullish to address the first byte or to start after byte for the chocolate
chip bureau is defined here Shako.
And I could add the hefty what you have up here.
This is all the same as all your previous program.
The only difference is this spot here.
So so we still need to convert, you know, to reserve memory location for us to write our show, too.
So in this case, we also want to specify the permission for that region.
And then we to be readable and right over the next two pronate.
We will print the address of the Chakotay bill, which is from here, from the resource section.
And next, Pinnaroo pin, the address of the allocated memory, which which airlock has located for
us.
Hockaday the RTL memory will copy.
They shall value to the allocated memory region.
The length of the Chako payment has been calculated when you call this function, size and resource.
So the SACEUR resource, the Passy, the resource information block from here.
And he will calculate the size of your shankle and save this variable called Lancashire Kapela, which
would subsequently be passed.
It took parameter half move memory.
Yeah.
So after that, this API function completes your allocated memory.
We have the shellcode, which is copy from this variable in order to make to Sherko executable.
We need to change it protection for that region of memory, which we have copy nekako to.
And we want to change it to readable and executable previously was set is readable, writable by your
majola.
And if you were to protect succeeds in changing the permission to become readable and executable every
10 non-zero value in stored in this variable.
And then from a message to the user and ask to use the press enter key in order to create the tray.
And then the next function gitche will wait for the user to press the key.
Once a user present the key.
You proceed to test the return value of a checkpoint that you will jeopardize.
Our return value will be non-zero.
And if you go ahead, call the trick API function, Nicoleta Abkhazian, we then create a trend how
to name the L'Occitane region of memory, which came from you.
So now this ties in to the method of creating the sherkat earlier on in the previous session.
Remembering that there is a parameter called the exit function, which we need to set.
And remember the function, we set it to be trick.
So this is the reason why.
Because we want to execute our hellerman by using a create function.
Therefore, the exec function, which we specify when we created the Chakwal mismatch.
We must also choose trick after it in line for the tree.
You call the reforesting object and pass it.
Then you check, which we create it so that the program will not exit.
He will wait for the train to run.
So this is the explanation for all the source code and scripts which we have in this in this new project.
So in the next video, you are going compiling and also doing something that is using action DVD.
Thanks for watching.
I'll see you in the next video.