Hello and welcome to this course.
In this lesson, I'm going to explain to you why we use a debugger to learn assembly programming instead
of the assemblers like FASM, NASM, or MASM.
Firstly, by using x64dbg, you will be familiarizing yourself with the debugger itself, which you'll
be using for reverse engineering.
Secondly, it also teaches you how to hollow out an
.EXE file to insert custom instructions.
Number three:
You'll also be able to know how to inject added instructions using code caves.
Code caves are those areas in the
.EXE file which are having blank instructions or null bytes.
Number four: how to modify existing .EXE programs to alter flow instructions.
And number five: you also have direct access to process memory.
This direct access allows you to hack and modify process memory itself, which you can't do if you're
using an assembler.
Number six: you'll also be able to modify existing functions to create or add new functionality.
So these are all compelling reasons why you should be using x64dbg for learning assembly.
In order to do that, you need to have an .EXE file that you are going to mod.
So I've created an .EXE file, a 64-bit one called "x64_template.exe."
And this is actually compiled from the source code here, which you can take a look at using any text editor.
It is a simple program in C which has got one include library and it has got one main function.
It creates an integer variable "a" and it has a printf, scanf, printf,
printf,
and then pause and return.
So you don't really need to know how C programs work.
But this is just to inform you how I got the template.
I did it by writing this program, I compiled and built it into an
.EXE file,
and this is your .EXE file.
If you prefer to use your own compiler, you can take this source code and compile it into an .EXE file
and use that instead of using my example .EXE file.
So let's take a look now at how we can open this x64_template and take a look at the content.
So to do that, you need to have x64dbg.
There are two—
there are two.
When you install x64dbg, it comes with two debuggers.
One is the 32-bit, one is the 64-bit.
Since we are learning x64 or 64-bit programs, we are going to use the x64 version.
So double-click on this and then open the program which is on your desktop.
This program here.
You can open it by dragging it in, and then it will run in the back.
And now you can see, if you scroll down, you can see the instructions, the entry point, and you scroll
down.
You can see over here this is your main program.
The main starts from here.
Every function starts with a push
-, mov -, - and every function ends with a pop
- and return.
So this is actually the main function itself.
And inside the main function, you can see here this is where you load the string and then call the
printf.
And then here is where you create the parameters for scanf.
And this is where you have the parameters for printf, and you have a parameter for putchar.
And over here you have a parameter for pause,
and finally you return.
So all these details will be taught in this course as you go along.
And we have already seen this actually in the earlier course,
but this is just a refresher.
So if you want to use an existing .EXE file, you can now modify this file.
That means you can take out all this part here,
remove it by right-clicking and then "Binary," "Fill with NOPs."
So when you do that, then you click "OK."
You will get all NOPs.
So now you can add your own code in here.
So you can use this to insert your own code.
So this is how I created the template file.
So we will be making use of this concept throughout this course.
If you don't want to use this template, you can create—you can use any other .EXE file of your preference.
But I use this template because it's the simplest .EXE file that you can create.
So that's all for this video.
Thank you for watching.