Okay.
Let's continue from where we stopped.
This time we are going to enter a longer secret code, which is 15 characters long.
So let's restart and run.
It hits our breakpoint.
So we move this to the right, and then we graph it.
We step over until we come—
We just run, click run, and then it will ask for secret code.
And this time, maybe we put the breakpoint somewhere, somewhere here. Put another breakpoint there
so that it won't run away.
So we enter 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14.
Hit
Enter.
So there's a breakpoint here and bottom here.
So now we can continue running.
So now it's going to step over compare.
Its code is 14, less than 15.
So our hypothesis was correct.
So this one is actually the length of the serial code.
Earlier when we put six, this thing was six.
Now we put 15 characters long,
so now this one shows 15 is 15.
So this is actually measuring the length of the serial code.
So is it, uh, above?
So this implies that it should be less or equal to 15.
So it's not going to jump since it's less than 15.
Our code is only 14 years, so it's not going to jump.
Step over. Is going to the right.
Continue stepping over.
Step over.
Follow the arrow.
If you—so is here now. You can step, then you do that. Now is comparing
then 15, 18. Not happy to go right.
So, so much comparing.
It's now comparing 14 with 14.
14 already.
So it's correct. Earlier on, when we put six, is comparing 6, 14?
Yes.
Now we put 15
character code. Is comparing 15, 15?
That means our hypothesis is correct.
So now, because we entered 15 characters long code, therefore we satisfy this requirement.
So it's not going to jump. Take over. Step over.
And you see it's not going to jump.
So it's going to go to a different path.
It's going to go straight this time.
Earlier on, it jumped down here.
This time it go straight.
So continue stepping over.
And now it's going to call a function called memory compare.
So go to internet and search for memory compare.
And you'll come to this website.
And memory compare is a function which has three parameters: one, two, and three.
The first parameter is the first string. Second parameter is the second string.
Pointers are how you reference strings back.
So ptr1 is referencing the first block of string. Pointer 2 is referencing the second block of a string,
and then num is the third parameter—is a size of the—of the compare. We have studied before in x64 calling
convention.
The first parameter is -, -, and then you can see from here -, -.
So this is called x64 calling convention.
So when you click—when you come to the call here—by the time you come to the call, the parameters
have already been set up for this call.
So we need to know what parameter is used for this call.
We just look under this window here, and you know.
Right?
So from here we know that the first parameter is the first string.
Second string is second parameter. Third—third parameter is size—size of the number of characters.
So you can see the parameter is size of the character is 15.
So it's going to compare 15 characters long.
So to know what is the first parameter, you can put this in the right.
You can see it there.
Expand this window.
You can see first parameter is our input string.
Second parameter—
This is the secret code.
Another way to see this is to inspect the memory.
So select dump one, and then right-click on this.
Follow this address in dump. This address is here.
This address, follow in dump.
And you will see this is what you entered,
what we entered.
Now select dump two and repeat the same thing
for the second parameter. Right-click, follow dump.
Follow this address in dump, and you can see this second address contains the actual secret code in memory.
And then the number of comparisons is the third parameter: 15.
So this is 15 characters long.
So this is the secret code.
So now we can fish this out.
We can right-click, copy, copy the selected line and paste it here.
Pull it down here.
And this is our secret code.
All this from here until here,
not the dot.
The dot is the null terminator.
Null terminators are how you end the string.
So don't copy the null terminator here.
Every string ends—is not—the only copy this.
So this is 15 characters long.
So we fished it out.
We suspect that this is the actual secret code.
So what we do is we test.
So we go here. We open a cmd prompt here.
Right-click, search for cmd, command prompt, and then change to this directory.
Right-click, copy this directory.
Paste it there. Enter.
And now we run the backup,
copy that we had earlier.
So now we copy the secret code and paste it there.
See where it works?
Copy.
Right-click and paste.
Enter.
And we successfully—access
granted.
So this is how we can fish out the serial code,
the secret code, by using tracing.
So this is a two-step process.
First step is you trace the length of the serial—of the secret code.
Once you know the length, you satisfy the length by creating a secret code that is of that length,
in this case, 15 characters.
And then after that, you trace the function which compares your 15-character-long secret code with
the actual secret code.
And once you've done that, you manage to get out the secret code itself.
So that's all for this video.
Thank you for watching.