Hello and welcome back.
The first thing we are going to do is to defeat the anti-debug.
So we run this now, reload the program.
I've already done this before, so I just reload.
So now we are going to kill the debugger, the anti-debug, by clicking Debug.
Go to Advanced and under here, click Hide Debugger.
So once you hide debugger, it doesn't know that it is attached to the debugger.
So if you run it now, you see the first nag.
Wait for a while.
It should show the second message box, which is here.
Click OK, then it should show the main window.
In a while, you should see the main window.
There you go, the main window, and when you click OK, it quits the program.
So this is how we can easily defeat the anti-debug.
So now we are going to kill the first nag.
So the first nag is this one.
We want to kill this nag.
So let's reload again.
Remember to click on Advanced and hide the debugger.
And then now we want to search for all the strings in this program.
So you right-click here and click Search For, Current Module, String References.
And there you have a list of all the strings.
And we are looking for this string.
"And we hope that you will enjoy our software" is here.
So we click on that and we find it there.
So let us now scroll up to the start of this function, which is here.
And you see I already put a comment there to indicate this is probably the main function.
So I'll right-click and enable a breakpoint there, toggle the breakpoint and run.
Now I will come here, right-click and graph it.
And then I will turn on the tracing to both.
And then I click on Step Over until the first nag window shows.
So just click Step Over and wait for the first nag to show.
So Step Over.
And after this call, see what happens.
The first nag shows.
So I put a comment there:
"Show first nag."
So let's click OK now.
And now it continues to the next line.
So now we know that this is the first nag. We can defeat it by NOPing
one,
two,
three,
four,
these four lines.
NOP these four lines.
So right-click, go back to disassembler.
We are going to NOP these four lines.
The first two lines is the push for the parameters for this call.
So we need to NOP them.
And then the last, then the call itself.
And then the last line here is "add -, eight" is to clean the stack.
So we need NOP as well.
So remember when we have a call to a function, the, if the called function doesn't clean the stack,
then it will clean it after the call.
Sometimes you see, sometimes you don't.
If you don't see this, that means the call itself has cleaned the stack.
But if the call did not clean the stack, then you see it out here.
So that's why we need to NOP it as well.
So we select all these four, right-click, Binary, Fill with NOPs, click OK.
So you have now NOPed those.
Now we can patch it. Click File, Patch File.
See, everything is black in color.
If you see any blue in here, then you have problems.
But all is, all is black.
So click on Patch File and give it a name with dash one at the back to indicate the first patch.
Dash one and click Save.
OK, so now we can close this and test our patch one to see whether we have killed the first nag.
Now remember, the first nag is this string here and this title here.
So let's run it and see.
Make sure you run Process Hacker.
All right.
So I'm running Process Hacker.
And I'm seeing it's running now.
And now my first nag has, has, has disappeared.
It goes to the second nag.
See that? There is no more first nag.
All right.
So that means we have killed the first nag.
Now we got the second nag.
Click OK.
And it should be showing the main window in a short while.
Anytime now.
It should show the main window.
There you go.
The main window.
Then when you click OK to the main window, it shows you the third nag.
But this third nag won't go away because you have already patched the file.
So it detected the patch, and that's why it keeps popping up this third nag.
If you click OK, it keeps coming back again.
Just wait.
Wait.
There you go.
It comes back again, and you can see that it keeps showing up in the process.
In memory.
It doesn't go away.
It doesn't, it doesn't end.
It doesn't exit.
It's still there.
So the only way to kill it is to right-click here and Terminate Tree.
That's why you need Process Hacker.
OK.
So now our next target is to kill the second nag,
this one.
So in order to do that, we have to remove this file and rename this file to become this file.
The reason is because we want to preserve the database for x64dbg so that we can use back all the breakpoints
and comments that we have set.
So in order to rename the file, we are just going to make a copy of this first.
We delete this first, and then we make a copy of this and rename this back to the original name.
That's it.
So now we are ready to go to the next lesson where we will patch the second nag, which is this nag.
So which is this nag.
So I'll see you in the next lesson.
Thank you for watching.