Hello.
Welcome back.
In the previous lesson, we've already managed to trace the username successfully.
Now we are going to trace the password.
So I'm going to reload what we did in the previous one and let's run it.
So let's run again until it prompts for the username.
So now it's waiting for the username.
We key in our username which we have discovered.
Press enter.
And now let's run until it prompts for the password.
Being run again.
Looks like it's hitting all our breakpoints, which we were.
We left.
We did not remove our breakpoints.
So it hits our breakpoints.
Run again, run again, run again.
So now the password prompt has appeared.
So let's key in any password.
So I'm going to key in the long password.
Cracking lessons.
So this password has got 15 characters.
Hit enter.
Now you see in this one.
So previously we saw that the password was being checked in the function call.
String compare.
So click on, keep on clicking the run until it comes to the string compare inner function.
Right-click and let's graph this.
So this was where we stopped in the previous lesson.
So now it's going to, it's going to compare the length of the password.
So let's let us run until it comes here.
So we will step over line by line.
Now it's going to compare - with this - plus 14.
Previously these two were comparing username.
Now they are comparing password length.
So let's see what is - is -.
- is 15.
So this is the hex representation of the number 15 which is the length of our password.
And it is comparing that with the stack.
So what is in the stack?
This will be the actual length of the actual password.
So to find out what is the length of the actual password we can come down here and print it out.
So we are going to print out - plus 14.
Remember to put the square brackets which means dereferencing a pointer.
Pointer is an address.
So when we dereference the pointer it means we are dereferencing the address.
And dereferencing the address means to print what is the value stored at that memory address.
So let's click enter now and we see the value stored at that address is 07.
That means the length of the actual password is only seven characters, right?
So we, we keyed in 15 which is too long.
So we are not going to restart this program.
And key in seven, seven will be CRACKINâ€”1234567 cracking, seven characters.
So let's restart now and then let's run until it hits the, the user input.
So run, run again.
So let's key in our username Nick.
Hit enter and let's run until the password prompt appears.
Click.
Run again, run again, run again, run again.
So password prompt has appeared.
So let's key in the seven characters.
Crackin which is seven characters.
Hit enter.
Now let's, let's keep on running until it comes to the function for string.
Compare this.
Keep on running.
Now we are here.
Let's do a graph. Okay, let's see now.
So now let's step over.
Until it comes to this line.
String.
Compare.
Now check -.
- is now seven characters and - plus 14.
Press up arrow key to retrieve the previous command.
Hit enter.
- plus 14 is also seven, so the comparison succeeds.
That means we have entered the correct length password.
Then now it's not going to, to jump because the password is the same length.
So it's going to go straight instead of jumping over here.
So let's step over and let it go straight.
All right.
So now it's going to come to the function which checks the actual, actual password.
Previously this function was used to check the actual username.
Now it is used to check for the actual password.
So we can step into it to see what is the actual password.
Click stepping to 72 again.
So now we can, uh, resync.
So we right-click and resync to go to the location where it has stepped into.
And we are going to run until it comes to this function.
Because in the previous video we saw that this function is used to compare the actual username.
Now it's going to use the actual to compare the actual password.
So let's, let's step over until it comes here.
Okay, now it has reached.
This call is about to call.
Now, what are the parameters for this call?
Take a look at the stack.
The parameters for this call are our password cracking and another string.
So it is trying to compare this to.
This suggests that this is the actual password.
So now we have already got the actual password.
So open the notepad and type this in here which I have already done for AC00F.
Now we already fished out the actual password.
Let's give it a test.
We can close everything now and run our program directly with this password.
So we key in the name.
Username is Nick and key in this password 4C00F, 4C00F.
Hit enter.
And there you go.
Good job.
Keep going.
We have successfully fished out the password using the deep tracing method.
So this is how we do deep tracing.
Stepping into the calls recursively one by one and following the values in the registers, the - register
and the stack.
So this skill is useful if you are going to do more advanced, uh, more advanced techniques later on.
Now, I know that this crack me can actually be solved easily by looking for strings inside a hex editor.
But when it comes to more complicated programs, that will not work, right?
So that's why you need to do it the correct way, the long way, using a debugging method with an x64
debugger.
So that's all for this video.
Thank you for watching.