Hello and welcome back.
In a previous video, I've already explained to you the source codes and the files that I need needed
to be how when you know, they find this desk, then I'm going to show you how to compile it and also
build EIC.
And also how to analyze it.
The easy one thing before we start, I'd like to invite you to examine these shellcode.
If you do rightly, iesha and openi people, that you will see that he's junk like this because this
was generated is a real output.
However, the only string you can see where we do not bet here.
See it back here.
So if you wanted to see the actual content of this in a more meaningful way, you should use a hex editor
so you can open flayer.
And then here on the fly, there is a utility hex editor call here, actually.
So he said hex editor, which you can use to examine the binary files.
Yeah.
If all of us.
So in this case, you can look at ISO Sherkat to his editor and examine the code.
So on the right here right column is the ASCII representation of the hex data.
And the last thing you can do this is not backed by the AC Flotek by DOT, which is not correct.
And here you can see F.S. for itri e for everyone.
All these are the hex values for these Chalco.
These are all for me.
Now we shall try to compile this.
So go to the bottom left corner and in search for the native command from that native and EIB, and
then select X default and IT tools come on from four.
We see two of my nine click next.
You are going to change you in this project for this.
So just click on the project folder, right click and then copy.
Come back to your xixi for native tools.
Common problem.
We are going to create actory by using this click on mindspace rightly in based upon.
He can tell that there are four directory listing and presenter to confirm that you are in the right
folder.
And then now take a look at the Kompass script.
Rightly compile script in OPENI.
We note that Usplash look at the last line the last nine years is going to take this S.P. file, which
is called.
He starts from here as RC below CBP and then built to produce this for our SIRC, and he actually soon
that's come back here now and call decompile back home and enter.
Presenter.
And now the bill has started in completa.
And you go back to our folder, you can see this new file resource in the.
Yes.
So now we can run it back as our RC press attack a few times.
And do you get the correct file and impressing to do executing.
So now you just execute it in print out the address of the shako, which came from the resource section,
as well as the allocated memory address, which came from what you are.
So now you can attach our digital back to this process and by opening 64 bit version now here.
Click on the options preferences and make sure the only entry point is check living all the present
check and click on file attach and select resource bill in memory and click attach.
Often go to these involve and in select resources, you know, EIC and click run in order to synchronize
with debugger.
We have the running process.
So now here you can see that the bill addresses one tree and so on.
We can try to examine this insight, your memory and see what we have there.
So go to your memory map here.
The address is one tree f you should be in a recession or here one tree.
Fine is the.
So just as we expected, we put our Sherko in the recession and do not get dressed.
Show us the recession in the memory map, which is here, resources.
You can actually go to this address.
In select this right, click your copy and go to C.P.U, to go down to Gunawan directly here, select
go to expression and Paysite here.
Control Veck PC and click OK.
And now you can see this is the Chalco, which is in the resource section.
This is a resource section intranet.
And notice, the last string is not back here.
Now, the next address is this one.
This address is the locator memory, which came from Chala.
So we can also copy this one.
The address is C, followed by four zero.
You can also see then we see further for you is here.
And you notice is a private type is private because these are allocated by what you're ALAC and protection
is executable, readable and previously was readable, writable.
And as I explained before that the only thing we foure what you we the RGV set it to readable, writable,
and subsequently you was changed by what you protected, become readable, executable.
Here and here.
OK, so now this one, we can follow this in memory design.
So we select this erectly copy and then come back to C.P.U and then go to Danjuma to Reichling the anywhere
here.
And instead, like go to the suppression control to paste and then click, OK?
And you will go to this virtual memory location.
So we can look into this reading and memory for you to copy your shellcode.
And what is the Shockley's over here?
And the clustering is not that easy.
That number one.
And number two, exactly identical in content that no.
One is the recession Danjuma do is to allocate to memory.
And what your life has given you.
And then we have successfully copy the sherkat to help memory using move memory.
That's why now this bill here is done.
Then the one this Hellerman here is done the math, too.
So this confirms that whole shellcode has been successfully copy.
And now he's about to execute this.
If you press and 30 creation is going to execute it because of this many present.
You come here and create a train.
You execute this region on memory.
So you can actually put a breakpoint there by going to that location.
Right.
Click this and follow in this assembler.
And this is the address you allocate to memory, which which has given this.
And this is our shortcut.
So we can do this correctly here.
Put a breakpoint selling breakpoint together.
And now we are ready to run.
So come back to our terminal here.
You can press center now and then you will hit big.
Fine.
See that?
You see our breakpoint because it is cocreator.
It creates this region in memory and trigger point.
So now you can remove this breakpoint correctly and breakpoint toggle to remove it run all the way.
So if you weren't supposed to run, not that easy.
So at bottom, you can see knockback is not open yet.
So let's see what happens when we running at nine.
And see here, I'll bet it's open.
And then in this case, the minute the program.
And now we're estimating.
So he sees how shellcode has worked successfully.
So this is how you can.
And then he chako in the recession.
Thank you for watching.