Hello and welcome to a new video in the previous video, we have use reverse engineering technique to
damage the memory for the Chalco and save it to a fire.
And that's how we managed to extract the Ishak from the MLV.
And this was where we stopped.
The user has Ed to open the two versions of income, one being done from the done.
The other being done from memory.
So in this video, I'm going to show you how to do dynamic analysis on these two by executing them,
running them to see how to see this behavior.
So actually, we already know that his opening is supposed to open and not back.
But assuming we don't know.
And we want to use the dynamic analysis to find out other things about this show.
So we can do a dynamic analysis by executing the shell.
To do that, we will have to this into a format which we can we can certainly say see program.
We need to write a C program to put Nesha queenside, run it to see what it does.
To do that, we can use either shown this or this also can.
So you just pick one.
And then we select using a.
So all these hex values here.
Up to here like this.
And then you go to the file menu and then click on a spot and select C, just click on C.
And now he's going to save it up to a file extension.
So just click save.
So we save it in our folder.
Since the malware one over here is fine, we just see from this file.
So if you use right, click and open the notepad.
We can see that he has nicely formatted our Chalco v f t o x prefixing front, making it ready for testing
in site C program, and then also conveniently listing the size of these shellcode, which is two hundred
in base.
Each of these is one by.
So the two hundred eighty bytes over here.
So now we are ready to put this in site C program and run it.
We can use a template here which I created for you.
Reversing payload.
And he comes here to compile that, to compile better be used to compile this bill.
But before we go on, you're going to put this shellcode, which we are extracted into this CP and run
it.
So erectly this epifano openi not bad.
And here there's a template.
So all you need to do is go through this, uh, file which we extracted from here.
Copy the entire thing from here to here.
Select fogeys.
Right click, copy.
Come back to the waiting period and then put it down here.
Base like that.
Next thing we need to do is change the name, change his name to this chocolate bill so we can just
copy this one shellcode payload.
And who write these?
After that, we don't need this anymore.
We can either Commenee now or, yes, DVD.
Next thing we must do is change the Chako payload to to our area, because here is a Whittenton in it.
So to a highly dangerous, always ready to go.
So this is actually the same SARS-CoV-2 we use in our earlier license when you are learning about how
to embed Chalco in a data section.
So it's the same piece of C program.
So it's very useful program.
You can use it for testing shirkers, which you have done from Melby.
So now we are already ready.
We have put our Dharmesh, our Chalco in here.
We are ready to compile it and running.
So Ecevit first contract is safe and then go to the for the way he's found.
Here to confirm, we are going to compile this using these COMPAR script.
So these Kompass script is also written for compiling these reversing payload CP file.
You can right click on this, an opening to take a look at the contents.
As you can see, here is when you use this script is going to take this S.P. SARS-CoV-2 path and build
an output file, reversing Batel EIC, which contains our show.
So now we are ready to compile.
Let's type compile back.
And he didn't he doesn't want to compart because you're in the wrong environment.
We need to open a native environment.
So go down here, find UTF eight and select city for native command from.
We can close this.
All right, over here, I mean, if you change the directory to how shellcode you can close in the hex
editor spell.
So select right click copy and then here they see this space right click to paste this path into.
That Deare do list the contents and be sure they can pass through this day.
You know, CBP, sourcecode Father's Day and we can give it needs in the meantime.
This is from a previous test.
So now you can believe that compile the best he enter in is supposed to be how SFA.
And there you go.
You find then.
And now you can run this SFR and see what initial court test.
So just type the name of the CFR presenter and you get this hinter.
He opens here and.
OK, so this is how you can test Cherkasky, which you have done from memory.
So any time you want to extract Chalco, you can use the technique I showed you in the previous lesson
to reverse engineer the malware using whicher in which to protect down memory, continually chocolate,
and then use hex editor to extract nicely formatted hex code like this.
Put it inside your C program and then build it and run it.
And then you can now you can perform any kind of DNA in this one.
So that's all for this video and this action.
Thank you for watching.