Hello and welcome back.
Now I will introduce you to our next project.
And this is the project we are going to do.
So it is known as Patch Me.
That means the objective is to patch the file.
Now this is a program which will show many message boxes including recurring message boxes.
So we have to identify where to patch those message boxes in order to prevent them from showing up.
So as usual, go and download the version I provided for you.
After you unzip it, you will find these two files, this file and this file.
Immediately make a copy of it and put it here so that you have a backup in case something goes wrong.
So in this lesson, we are going to analyze the behavior.
So before we analyze the behavior, scan it with Detect It Easy
first to determine if it is a, whether it is a 32-bit or 64-bit.
I've already done that and determined that it is a 32-bit program.
So let us run the program now and see its behavior.
But before we run the program, I want you to fire up your Process Hacker.
So for me, my Process Hacker is over here and I will now run the Process Hacker.
Do the same thing for yourself.
So run the Process Hacker now and then,
now run your Patch
Me.
So double-click on this to start it.
And immediately you will see the first message box.
And then open up a Notepad folder and copy down the message box that you see.
Welcome
to Nag Mania 2009 is the title.
And then the string,
the message is "We hope that you enjoy our software" over here.
So that is the first message box.
Then click OK and wait for a few seconds for the next one to show.
Then now it shows the second message box. "Nag Mania would like to introduce" is a title and I copy down here.
So you do the same for yourself.
And then the message: "Its third nag window.
They just keep coming and coming."
So put it here as well.
So this is the second message box, although it's written here
third nag.
It's actually the second message box to show.
And then now click OK and wait for another few seconds to see what happens.
After a few seconds, you should be able to see the main window.
This is the main window.
There's a title there, so copy it down as well in your Notepad.
Then the message itself:
"If you manage to eliminate the nags before and after this window, congratulations, you did it."
So just copy that down as well and put it here.
So now we have copied down all the three message boxes: one, two, and three.
And there will be another, the fourth message box, which is this message box here.
So this message box will only show when you attach your debugger to it.
So now you click OK.
And then when you click OK, you will notice in here, if you scroll and look for the program name,
you should be able to find it here as well.
OK.
In this case, it has exited.
Sometimes it doesn't exit, so you need to close it using Process Hacker.
So for example, when you are running it like this, it will show up here.
See that?
Patch Me.
So this is the program that is showing up that is in the memory now.
You click OK.
It is still there.
OK?
OK.
It is still there.
Then you click OK.
Sometimes it doesn't go away, OK.
But this time it goes away.
So in those situations where it doesn't go away, it refuses to quit.
You can use Process Hacker to monitor and kill it.
So let's say, let's say you want to kill it.
Let's say this is running now and it won't go away.
After you've clicked all the OK buttons, it still refused to quit.
You can come over to your Process Hacker, scroll and look for the name of the process.
Patch Me to Revamped.
Right-click on this, right-click on this and then click Terminate Tree.
And then click on the Terminate button.
And it should be, it should be gone.
So this is how you use Process Hacker to terminate the program, OK.
So if you were to run this with x64dbg...
So I've already done it before.
So I'm just going to refresh.
I'm going to remove all my breakpoints,
disable all my breakpoints.
OK.
If I run it now, it will show you here as well. I click OK.
Wait for a few seconds.
Then you show the second message box.
Click OK.
And after a few seconds, it will show the main window.
Just wait for it to show.
And this is the main window.
Click OK.
And there is,
you see this?
This is the other message box, which will only show up if it is attached to a debugger.
You see that?
So this is the message box which won't go away.
So you click this message box here.
Make sure you also record it down here.
This is the one which will only show up if you are attached to a debugger.
So if you click OK now, wait for a few seconds.
It keeps on showing.
You see that?
It's the same message box.
It keeps on showing because it detected that you are attached to a debugger.
So click OK.
Still, still won't go away.
Click OK.
It still won't go away.
It keeps on coming.
The same nag: "Removal Attempt Alert."
So in such a case, that's where, this is how you can kill it.
You can either kill it by closing this button here.
You can go to this button here and you will kill it.
The other way to kill it is, of course, to use Process Hacker.
All right, so this is how we can kill it.
This lesson, we already looked at the behavior.
We have studied the behavior and we made some notes.
So make sure you also make the notes like this so that you will know what to expect when you are doing
your patching or doing your tracing.
So that's all for this video.
Thank you for watching.