Welcome back.
So far we have traced up to the ninth character.
Now we'll continue with the tenth, eleventh, twelfth, and so on.
So let's restart this.
Go to full screen.
Let's restart this.
And run to our breakpoint main, and we start over until we come to this call, and then step over this
call.
And now it's waiting for us to enter our password.
And we fished out nine characters from the password.
So we type in what we have got so far.
L-I-L-2-2-8-1-3-3.
But we don't know what's the tenth password.
So we're just going to put A, B, C at the back here for 10, 11, 12.
A, B, C, hit Enter.
Okay.
So now we're here.
Let's step over until we come to this line.
And then we step into this call.
Step again.
And then now we right-click and graph it, and we trace it.
So we trace it.
First character, L.
Second character, I.
Third character, L again.
Fourth character, 2.
Here is going to loop up.
Step over.
So now we are here. We are at the fourth and the fifth character again.
It is 2, as you can see here.
So we are now at the fifth character here, 2.
So let's continue.
Click on this.
We are now the sixth character, which is 8.
And this would be the seventh character, which is 1.
So we are now here, seventh character, which is 1.
Click on this, and this should be the eighth character, which is 3. Eighth character.
Continue stepping over.
Now we're going to loop up again.
Step over, and this should be the ninth character, which is 3.
So we are now here at the ninth character.
Next one we are going to target is the tenth character.
So then continue to step over.
Okay, so now we are tenth character, which is 7, but we entered A. We entered A, is it A?
So we know that the tenth character is 7.
So we can now put 7 over here.
All right.
Continue to step over.
And because we did not put 7, is going to come to this part here and going to set a bad value, which
is negative 1.
So let's restart again and run to our first breakpoint.
And let's step over it until we come to this call.
And then we click on this, and we enter the password characters that we have fished out so far, which
is L-I-L.
L-I-L-2-2-8-1-3-3-7.
So we don't know what is the eleventh character.
B, C, B. So we just put B, C, D at the back.
Okay.
Just put B, C, D, hit Enter, and we are back.
Now we continue to step over until we come to this call.
Then we will step into this call.
Click again, then right-click and graph this, and continue to trace.
So we will trace.
First character, L.
Second character, I.
Third character, L again.
Fourth character, 2.
Loop, loop back up.
This should be the fifth character, which is 2.
So we are now here.
Fifth character.
Click on this. Sixth character is 8.
We are now here.
8.
And over here.
Uh, this will be, uh, seventh character, which is 1, over here.
This 1 over here.
And now this will be eighth character, which is 3.
So this is eighth character.
3.
Okay, now it's going to go back up, loop again. Step over, and we are back on the loop on top.
Continue stepping.
Come over here.
And this should be your ninth character, which is 3 again, this one.
Now notice that when comparing characters, you will have a single quote over here and a single quote
over here.
Remember that.
Okay.
So let's continue.
Now here is comparing -, which is whether is zero or not.
In our case, it's not zero, not end of the string.
So it's going to go to compare.
Now the eleventh, the tenth character. Tenth character is 7.
So we got it right.
Step over.
Now it's checking whether you're end of the string or not.
If you're end of the string, it will be a null terminator.
That means - should be zero, zero, but it is -.
Is this two bytes here, 3, 7?
But it is not zero, zero.
- is 3, 3, - is 3, 7.
- is the first byte, first-level byte of the register.
- is the second byte of the register.
So in this case, it is not zero.
So it's going to go straight.
Step over.
And now it's comparing the eleventh character. Eleventh character is not a character. It is a null terminator.
See that?
Remember I told you just now a character will have single quote like this, but in this case it is not
single quote, it is just the value zero.
So this is called a null terminator.
That means it is expecting your eleventh character, which is B here. Eleventh character should be a null terminator.
And in programming, when you input something to insert a null terminator, you press the Enter key.
But our Enter key was at the back here, after the D.
So our null terminator is at the back here, not here.
So it is expecting your null terminator to be in this position.
B. That means the password is only up to 7.
Then after that will be an Enter key.
When you press Enter, it sets the null terminator.
So that suggests that the password is simply L-I-L-2-2-8-1-3-3-7.
That's it.
Okay, so to test our hypothesis, we can just directly now double-click on this and enter
L-I-L, L-I-L-2-2-8-1-3-3-7.
And press the Enter key to insert the null terminator.
Nice job.
Password found.
So this is how we can fish the long passwords using deep loop tracing.
Why is it deep loop tracing?
Because we have to loop multiple times, I think at least three times before we fish out the entire
password.
Each time it loops, it adds 4 to the counter.
- is your counter.
As you can see, this is - counter.
Okay, so that's how you can perform deep loop tracing.
That's all for this video.
In the next one, we are going to look at how to patch this to show the correct password.
No matter what the password is revealed, try that on your own first, and then watch the next video.
Thank you for watching.