So let's continue.
We open this with x64dbg.
So we drag and drop it here.
Open the x64dbg.
And now we search for this string.
Access denied.
So you can maybe expand it a bit to the right.
More space.
Right-click, search for current module string references.
And here you can see "Access denied."
So we double-click on that.
You can also see "Enter
secret code" is there, and "Access granted" is also there.
So let's go to "Access Denied."
Double-click.
And here is where you find the string "Access denied" over here, this line.
Try to look for the start of this function by scrolling up.
You find "Access granted" here.
Then go up some more, and let's see.
Continue to go up.
"Enter
the secret code" is here.
So, like, looks like this is one big program.
And here's the return.
That means the start of this function is over here.
So over here we can make a comment.
Main function.
Then we can graph it. Press G.
Put a breakpoint.
Now we start tracing.
Trace coverage mode to turn on the syntax highlighting.
And then now we put this thing on the right.
So we can notice what happens as we step over.
First, we run, let it hit the breakpoint.
Then we step over.
Keep an eye on the right.
We enter the text space.
So this is the first text it appears, but it is not waiting for your input yet because the state is
still paused.
We need to step over until it goes to running state.
Continue step over.
There you go.
It is running state.
That means it is waiting for you to enter something.
So we will enter
one, two,
three,
four,
five,
six.
And then hit Enter.
So now it's going back to the paused state again.
You can continue stepping over.
So now we are going to do tracing.
The code that we entered—the secret code that you entered—is 123456.
Let's convert this into hex.
So we copy this, go to the built-in calculator, paste here. In hex, is this value: 1E240.
So this is equal to hex 1E240.
We do this because when the code runs, it converts all the digits into hex.
So we convert into hex first so that you can notice it
if it appears anywhere inside the memory or the register.
You can—if ever we see this in the register in memory—we know that it is referring to 123456.
That's why we convert it here.
So let's continue the step over and notice any compares.
Here's one compare here.
It is comparing 15 with 15.
So not useful.
Let's step over that.
Now it's comparing six with a huge number. Six
here is a hint that it might be the length of our—our input.
Six—it might be the length.
All right, so we're not sure whether it's a length or not.
We are just assuming. It's like, if you want to be sure if it's the length or not, you rerun this program
and you enter seven or eight, then
and then, if this changes to eight or seven, then we know for sure that this is comparing the length of our
input.
For now, let's assume that it is the length of our input, which is six characters.
Step over. Is comparing it whether it is bigger than this because of "jump above." If is bigger than this,
then jump above is true, but it is not.
So jump is not taken, so it will go to the right.
Now it's comparing this with the 15.
So let's make a comment here: cmp six with 15. F is 15.
So does this mean that the—the secret code should be less than 15?
We don't know.
We just ask the question. After putting a comment, you notice it doesn't show. You have to function F5
to see the updated comment.
All right.
So now we are guessing that the code should be less than 15 because here it is telling you "jump above."
So is the code less than or equal to 15?
To open this comment, you can press semicolon on your keyboard to open this comment box.
So just update it.
Is it less than or equal to 15?
Press function F5 again to update the comment because here is testing whether is above or not.
If it's above 15, then it goes to the left.
So that implies that it should be less than or equal to 15.
Right? Since ours
is less—and it's only six—
so it's definitely less than or equal to 15.
So it's not—it's not going to jump above.
So you click on this, step over, and you click on this.
You see it is not going to jump.
So it's going to go to the right.
Continue stepping over.
Okay.
This is an unconditional jump. This step over,
follow the blue arrow.
Another shortcut to follow the blue arrow is to zoom out.
Press Ctrl and use the scroll wheel of your—of your mouse to scroll up.
Then wherever you see the black, that is where you're at now.
So just drag this to the left and zoom in again by pressing Ctrl and scroll view.
Here is where you are now.
Continue to step over.
Now it's comparing F with F—15, 15—so that is not helpful.
Let's continue.
Step over. Is comparing 6, 15. E is 14.
So this is important.
So it is comparing six with 14. E is 14.
So we make a comment here. It says: So your code—code length, code length
should be equal to—
colon—should be equal to 14.
That's a question mark; you're asking.
So let's function F5 to update the comment.
Step over.
So because it is not equal to 14, so the jump will be taken.
See that?
So this suggests that the code length is actually 14,
but we entered six only.
See that?
So it's going to go to the left.
So this already fails the test already.
So it's going to go to the left and continue.
Step over.
Now it's comparing 15 and 15.
Not helpful.
Just continue.
Continue.
So where are we?
We are now here.
And then continue.
Keep a lookout on the output as you continue to step over.
And here is where it is going to—
Suppose you happen
step over this, and you see "Access denied."
Right?
So this call here shows the banned message.
So this is where you show the banned message.
So put the comment there: shows "Access denied."
All right.
So you know that we are on the wrong path, right?
So now we are going to restart it,
but this time we are going to enter the length to be 14.
Why?
Because if you look at the comments here, code length should be 14.
This is what we suspect,
but we entered only six, right?
So we try to enter a code which is 14 characters long.
So how would you access this?
You click this here: comments.
Then you can see all the comments that you write.
And to go to that comment, you just double-click, and you can see the comment here: code length 14.
Then you can graph it to see where it is. Press G.
So the press G is to switch between the graph and the linear view.
This is graph view.
This is linear view.
Press G to toggle.
So now we are going to restart,
but this time, our code—we are going to increase the length.
We are going to put 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14.
We are going to put this in.
Okay.
So, so with that, we will continue in the next lesson where we will put in a longer code.
See you in the next lesson.
Don't close this yet.
I will see you in the next lesson.
Thank you for watching.