Hello and welcome back.
In this lesson, I'm going to show you some preliminary skills for this course.
All of my crackmes are provided for you to download.
Every one of them is a zip file.
For example, in this lesson, the crackme is 01_easiest_crackme.zip.
So go and download this from the resource section and then put it in the folder. For me,
I put a folder on the desktop called Crackmes.
So to unzip it, just unzip, extract.
And you can open it, and you can see there are two files inside it.
One is the executable, and the other is the credits.
So open the credits, and you will see where I got this file from.
So this file was originally downloaded from a website.
So let me show you the website.
Crackmes, crackmes.one.
And so I give credit to the author, which is gen246.
This guy wrote it.
Now, I won't advise you to download from here because in future this website might not be available
anymore.
So instead, always use my copy that I provided for you.
So this is how you get the crackmes into your computer.
So the first thing you want to do before you perform any kind of analysis is to go and find out this
crackme.
What is it written in?
Is it an executable file?
Is it a Windows program, or is it a Mac
Mac program, or is it a Linux program?
Whether it's 64-bit or 32-bit.
So that's where you need to use a tool called
Detect It
Easy.
So you use Detect It
Easy to open the crackme.
And then it will tell you whatever it is, whether it is a 64-bit program or 32-bit program. It will
be shown here.
So in this case, it's a 64-bit program.
So if it is a 64-bit program, you need to use x64dbg, this one.
If it's 32-bit, then you use x32dbg.
So now we can go and open it,
x32dbg, sorry, x64dbg.
Go to your desktop.
Crackme.
And you will see it is open.
Once you open it, it is already running, as you can see here.
All right.
So this is how you open it.
Normally, before we open it with the x64 debugger, we will want to run it first to see what it does.
So when you run it, it will give you this prompt.
So can you guess the password?
If you don't know,
if you don't know the password, you just press any key, any number, and press Enter.
It says wrong.
Try again.
Right.
So this is the steps that you will do when you are trying to reverse engineer: analyze the behavior first,
then only you will open it with x64dbg.
So when you open it with x64dbg, you will notice there are a few panels here.
The center panel is the disassembler view, where the binary has been disassembled into assembly code.
This one is the binary view.
This one shows you the raw binary code.
It is in hex notation, and this one has been translated from here.
So every one of these hex notations, when you translate it into assembly, you can see the text.
So this has got meanings.
Each one of these has got a meaning, like JE is 74, and 46
is probably this.
And then and so on.
The most important is this one.
This is what we're interested in.
Next most important is comment.
So this comment here is where you can find some clues or hints to tell you about the program.
As it is running, this thing will change.
On the right would be a register view.
Now in 64-bit programs, you have these registers: -, -, -, - all the way to -15, and then
you have the instruction pointer.
Instruction pointer points to where the program is running at the moment.
You can click on it, and you can go there.
Pointing to this address.
So it is the entry point.
So whenever you are lost, just double-click on this, and you go back to the location in the code where
it is currently running.
Then you have the flags.
The most important flag is the zero flag.
It stores the status that controls the jumps.
Later on, we'll take a look at that.
You have jumps, for example, JE and so on.
And whether it jumps or not will depend on the zero flag.
And this column
here is the address in memory.
So this is the address at this location.
You have all this code at those various addresses.
Now, in the 64-bit program, the addresses are quite long.
It's a QWORD, QWORD.
QWORD is, I think, eight bytes, eight bytes, 64 bits.
Same with this.
This is also eight bytes, a QWORD.
On the top here, you have some of the commands that you can execute.
If you click on this, it will run a program.
And this pop-up.
And you can press anything.
Press Enter, and then it says wrong again.
If you want to rerun the program, you just click on this button here to rerun the program.
And the program will rerun again from the beginning.
Then you click this button to run.
It will show you this prompt.
So now,
if you enter anything wrong, any wrong password, hit Enter.
You will see a wrong,
try again message.
So now we are going to learn how to find out the real password for this program.
There is a technique called serial fishing.
Serial fishing means to try to fish out the serial number or the password or the flag.
So serial fishing is same as password fishing.
And flag fishing, they mean the same thing.
So in the next lesson, I will show you how to go about doing serial fishing.
Thank you for watching.