Hello and welcome back.
In this lesson, I will show you how to store string constants in memory.
So let's open up our template first.
And then we'll hollow out the .EXE file.
So just select all this.
Right-click,
select "Binary," "Fill with NOPs."
Click "OK."
Next, we are going to put a string in memory.
So since it's going to be a constant—constant meaning that initialized already, preset—go to "Memory
Map."
Before that, make sure you select Dump 1.
It's already selected by default.
Then go to "Memory Map" and look for data, initialized data.
So double-click on the data segment and it will take you to the memory showing in Dump 1.
Then look for an empty space in the data segment, for example, this one here.
And let's say we want to put a string in this memory location, so we can select all the entire
bytes here.
So we have 4 times 4 is 16 bytes.
So 16 bytes means you can store 15 characters.
You need to reserve the last character for a null terminator.
The last character of the string must be 00.
So you can store 15 characters here maximum.
So right-click on this now and then select "Binary," "Edit."
And now over here, go to the ASCII—ASCII text box—and type in your string.
Let's say I'm typing a string: "Hello World."
And then click "OK."
And so now "Hello World" is here in this memory address starting at 403000.
The first character is "H."
So "H" is at this memory address.
If you hover your mouse, you can see the address: 403000.
And then "e."
"e" is at this address.
If you hover the mouse, you can see it is 403001, and so on.
And then 20 is a space.
If you hover your mouse, you can see the address: 403005.
And the last character is "d."
And then there must be a null terminator, 00, after it.
The 00 acts like a full stop in the sentence.
This lets the program know that you have come to the end of the string, so always make sure you allocate
one byte for the null terminator.
So now you have this string inside your memory here.
So how can we use it?
For example, we can move this string into - or any register that you like.
So let's say we want to move this string into -.
So now we select this address here.
To copy it, copy the address.
Then we select this line, this address, press the spacebar, and then type "MOV."
Move into -.
The string itself: 0x and paste, within like that.
So I guess—click "OK."
And then you see this is actually -.
But x64dbg changes to -.
It doesn't matter.
It's OK.
It's still -.
So now that you have moved this to here, you can now execute the breakpoint and see it.
So let's run.
Here's our breakpoint.
Step over, step over.
And now it's going to move this string into -.
Step over.
And you see now the string is there.
It has the address 403000,
which is this address here.
All right.
So what it's actually doing is moving the address of the first character, which is the hex value 48.
48 is ASCII code for "H."
It's moving the address of the first character.
It cannot move the whole string.
So it's OK.
When you move the address of the first character, it means you are referencing the whole string.
This is the convention used in assembly code.
So it has only the first character, "H," here, but it knows—it's smart enough to know—that this is a string.
So this is how we can create the string constants in memory.
Now, you want to patch this, you can click "File" and then go to "Patch."
These are all the patches that will be applied.
Click on "Patch File" and you can give a new name.
Let's call it "02_String_
Store," let's say.
".exe," and then click "Save."
And now you can open it.
You can open this new file in your x64dbg.
And scroll down and then you can go to your "Memory Map."
Before that, always make sure you select which dump you want to show your memory map.
So select Dump 1, go to "Memory Map" and look for data segment and double-click on it.
And if you scroll down, you will see your string still there.
"Hello..."
And then you can put your breakpoint.
Right-click, "Breakpoint," "Toggle," run to the breakpoint, and then step over.
Step over.
And now it's going to move—
it's going to copy the string into -.
So let's step over.
And you can see now - is there.
So in this lesson, we have learned how to create string constants in memory in the data segment,
also how to move a string to the register,
and also explained that when you address—when you put the address of the first character
of a string, you are essentially referencing the entire string.
So that's all for this video.
Thank you for watching.