Welcome back.
So this is where we stopped last at the Virtualprotect breakpoint.
So now we want to see what is happening.
So at this point in time, let's step over the virtual project and see what it's trying to do now.
Jump to watch and protect.
Step over.
Jump again to watch.
Protect and continue to step over.
Now is pushing the five parameters of virtual protect.
And now look at the second parameter.
40130.
So currently you go to the memory map.
Look at 40130.
It has got the executable readable and writable.
Earlier on, if you recall, it was only executable and readable and then it virtualprotect and change
it to writable.
So now I suspect it's going to remove the writable.
So let's see.
Let's step over this call now.
And now we go back and we see through enough, it has removed the right word.
So this tells us that it has finished unpacking the code inside this region of memory.
So it might do the same for the other regions of memory.
So for the 4001 is already finished unpacking.
Let's see if it has also finish unpacking for this region of memory.
So we'll continue to run and see what happens.
Again, cause we should protect.
So now we step over.
Step over, step over, step over.
And now we jump to virtual protect.
Jump again.
And then now we step over.
Step over.
Let it push all the five parameters of virtual protect to the stack.
Now we have pushed the file.
Look at this.
So now it is going to change the permission for this region of memory, which is this one.
So let's see.
Currently, if we go to memory and look at this region of memory, it is executable, readable and writable.
Now I think it's going to remove the writable.
So let's step over.
And go back and check.
Yes, it has removed the retable.
That means it has finished unpacking the code into this region of memory.
So that is the significance of why it keeps changing the permission bits from readable to writable and
then to readable again.
Right.
So now we go back.
We can be sure that it has finished unpacking in this region of memory.
So it is quite safe maybe to dump, but we don't know where to dump because we don't know the entry
point.
So we have to hunt for the entry point by continuing to execute.
So this time we are going to keep running.
Run again.
We already know that.
I already done this before, and I know that this is one we are looking for, so we're just going to
ignore this future project and keep on running until we see the Getprocaddress.
So now we're just running freely.
Let it hit the Getprocaddress.
You want to see an indication that he has finished unpacking and is about to run?
This will take some time, so let it run.
And he has hit getprocaddress.
And now if you look at the parameter for Getprocaddress, it says get thread preferred language.
So this is a give away.
This indicates that it is completed running and now it's going to execute it.
But we don't know where is the entry point, so we can't dump it yet.
So now we have to find the entry point.
The entry point for an iPad code is also known as Oaep, which stands for original entry point.
We can what we can do is we can go back to the user code by clicking on this and then keep on following
the return.
That means we continue to run until it hits the return for each function.
Why?
Because we want to return to the outer layer of the code.
We are inside the unpatched code now running, but we want to return to the outer layer so that we can
know where is the entry point.
So what we do is we keep on following running each function until it hits return, and then we step
over so that we can go up to an outer layer.
Right.
So now we click Never run, execute to return.
And now we get progress.
We don't need this anymore.
So we can go here.
Getprocaddress.
Press the spacebar to disable this breakpoint.
We are not interested in this anymore.
We just want to step out of every function until we get out to the outer layer.
So now we can go back to the user code by clicking this.
Do we do the same thing?
The same trick?
Never executive written.
So it hits the return step over it.
So now we are at this .12871287.
So we are close.
Could this be the original entry point?
We're not sure.
Right.
We can dump here and see whether or not Sila.
Sila is this plugin?
We can do that.
Try to see whether Sila can detect the web or we can continue to run to return and step out further.
Right.
So if we suspect this is the original entry point, we can actually dump here, but let's go further
and see what happens when we hit this return.
So if we are wrong, we can always come back and reset the virtual machine and try again.
Right.
So there is always some element of trial and error when you're unpacking.
So now let's debug.
Run to this return.
Step over.
Again.
Step over.
Scroll.
We are outside.
So this is definitely not the entry point because we suspect the entry point is 01287.
Right.
So we can.
Debug executed to return.
So which are a lot of again, go back to user code.
And then debug executed return.
Step over.
Repeat, keep on repeating.
Rinse and repeat.
Debug Executive written.
Step out of this.
Step over this.
So we are going outer and outer and outer, layer by layer.
So now we debug executive written.
Step over.
All right.
We are going to go until step to the outer and outer layer until it comes to this region of memory which
has been unpacked.
So debug execute to return.
Step over.
Still at 004.
We are waiting for it to come to 012.
So we repeat again debug.
Security return.
Step over.
Do the same thing.
Debug executive return.
Step over.
Continue stepping over.
After the return step away to come out to another layer.
Execute.
Return.
Step over, Come here and step over again to go to another high layer.
All right.
Same thing.
Debug executive return.
Come here.
Step over.
All right, Come here and step over.
Step over.
Step over this.
Come down here and step over.
Keep on doing this until you get to the outermost layer.
So there's a loop here you can quickly execute to return to come here and step out to the outer layer.
All right.
So I think we are close.
We are close now.
We are in one, two, eight, seven.
All right.
So we should look for a push push IB which marks the start of the function.
So there's none here.
So this is not the correct entry point.
So we continue to debug execute to return.
Step over.
Okay, we are back to the 004, which is the wrong one.
We're looking for 012.
Continue.
Debug.
Execute to return.
Okay, we go back to user code.
And security return.
Step over.
Debug.
Execute the return.
Step over.
In the back.
Executive return.
Step over.
Keep on doing this.
All right.
Just click run this time.
All right.
So it's still watching.
Go back to user code.
Okay.
Debug the return.
Step over.
Keep on doing this?
Never asked to return.
Step over.
I ask you to return.
Step over.
Okay.
He is way off.
So you just run virtually run to user code
to return.
Step over, debug, execute, return.
Step over.
Same.
Were.
Continue to step over.
Okay.
Let's see.
All right.
So the is written.
Now it is freely running.
Let it hit the breakpoint.
Go back to user code.
Continue executing.
Written.
Step over.
Keep doing this.
All right.
Let's see.
Okay.
Not likely the one.
Continue to debug because we are not in this memory is going to return and then step over.
Step over back, executing return step.
All right.
So we are close.
See that 08C, which is close.
Step over.
Continue to step over.
Right.
You
executing returns, take over new security return.
Step over.
All right.
I think we are close.
Yes.
Finally, we found our EVP and this address.
So this is the original entry point, because this is the one which comes after this.
Right.
So we can put a comment here.
To put a command is press a semicolon.
Original entry point.
And okay, now over here we can dump the code by using sila.
So go to plugins.
Remember the address?
0128074.
So plug in sila.
And change this to
0128307474.
Click it or search.
Yes, he found it.
All right.
Now we try to get the imports.
If 128 valid APIs, but miss 16,000 APIs, that is okay because this is a Delphi code, so don't worry
about the ones that it missed.
Yes.
So we can just ignore the one which he missed and click on dump and we can now dummy dump it.
Click on Save.
So now we can close everything and click Yes.
And we will continue in the next video.
Thank you for watching.