Welcome back.
So in the previous lesson, I showed you how to use VirtualProtect breakpoint to locate the original
entry point.
So we're now here.
This is where we stopped last lesson.
So now we are going to trace this and see what happens.
So we turn on trace highlighting.
And then we step into it.
Just step into it.
You see, the output is being shown character by character as we step through.
It's creating the string.
So this is why we can't find the string in memory, because it is dynamically creating the string.
Right.
So all these calls are a method of hiding the string from memory.
So we know that this entire code block here is just to create this prompt:
"Enter password."
So we continue to step over until it waits for us to enter the password.
And that will happen when this paused state becomes running state.
So let's watch this bottom left-hand corner until it becomes a running state.
Now it is now in the running state.
That means it's waiting for input.
So we can type one, two,
three,
four,
five, six.
We hit Enter and control comes to—
comes back to the debugger.
Now it's in a paused state.
Again, we continue stepping over.
So now here, it's done a comparison.
And it's going to not jump because the comparison is expecting a one.
But you're not getting a one.
We're getting a -.
So let's step over and observe the behavior.
Okay.
So over here, it's going to jump unconditionally.
And over here,
it is not going to jump.
It's going to go here.
I continue to step over.
Continue to step over.
It's still jumping.
Continue to step over.
Okay.
One thing interesting here: if you look at the Symbols here under crackme, you will see that it
makes use of this memcmp.
memcmp is used to compare two strings.
And this comes from the Visual C++ runtime library.
So we can keep a lookout for this function.
memcmp.
So so far, it hasn't called memcmp.
But you can see that it is constructing something.
Through that code.
It then is constructing a string in memory.
All this code somehow is constructing a string.
This could be the password.
Pineapple could be the password.
It is constructing.
As we step over, you can see the string being constructed here.
There you go.
At this point, the entire string has been constructed.
Pineapple.
So this, I suspect, is the password itself.
Okay.
Let's see.
So where are we?
Okay, we are here.
All right.
Let's continue to step over and observe.
Just observe for now.
So it's jumping.
It's jumping over here.
Now it jumps over here.
Still no bad messages coming up, and still no use of the memcmp function.
Okay, it is here now.
Just continue to step over and observe.
The first time I debugged this, I had to do it slower than now.
But since I know where to look, I don't have to go so slow.
Okay, now you can see there is a memcmp here.
See that?
So you either go straight to do memcmp, or it will avoid it.
And if you click on this now, you will see that jump is taken.
That means you will avoid the memcmp.
If it avoids the memcmp, it will go to the left.
So let's put a breakpoint on this.
Breakpoint.
Toggle.
All right.
So now let it go to the left and see what happens.
So it's going to the left instead of going straight and doing a memcmp.
Compare.
And you see, it is constructing the bad message: "Incorrect."
So all this function is constructing a character to show up.
That's why the string cannot be found in the string search.
See that? It's creating the string.
As you continue going, watch.
Here it comes.
The string is coming up.
So by this time, we already know that we have a wrong password.
And so now we can restart this and try to come back to this location and make it go straight and do
a memcmp instead.
So let's restart this.
Okay.
Let it hit the—our breakpoint. I've already set the breakpoint on VirtualProtect.
So let it run four times: one, two, three, four.
And then go to the breakpoint.
And then here, Run to User Code.
And so now we are inside our—press G to graph.
So now we are here, right?
So let it hit our second breakpoint,
which is this breakpoint here.
So let's go there now.
Run!
And now it has a breakpoint.
Zoom out.
Oh, we have to enter a password.
One, two, three, four, five, six.
Hit Enter.
All right, we missed the breakpoint.
No worries.
Try again.
Go to breakpoint.
Run four times.
Hit four times.
Go to VirtualProtect.
Run to User Code.
And then—
Now,
by now, we are ready to output the prompt.
So just run until the prompt comes up.
And then one, two, three, four, five, six. Hit Enter.
So now we should be in a breakpoint.
Let's go to our breakpoint.
Okay, we missed it again because the breakpoint was disabled when we reset.
So we have to enable it when we rerun.
I forgot to do that.
Sorry about that.
So now, let's do this again.
So this is the problem with doing packed code.
The breakpoints will be disabled when you restart.
You have to re-enable them.
That's what I forgot to do.
So let's run four times.
One, two, three, four.
Go to VirtualProtect, Run to User Code, and go to breakpoint and re-enable this one.
Enable it again.
Okay.
So now—okay, you notice the VirtualProtect was not disabled when we restart because this is not packed.
This one is an external library, but this one is packed.
That's why when you restart, it is disabled.
Because when you restart, it goes back into the packed state.
That's why you have to re-enable it manually after you restart.
Okay, so now you are here.
You can run until the prompt comes up.
Then you enter one, two, three, four, five, six.
When you hit Enter, you hit your breakpoint.
So now press G to graph it.
And you can see here is where we are.
So now what we want to do is force it to go straight instead of going to the left.
If you click on this, you will see that jump is taken.
So we just toggle the flag, make it go straight.
So you click on it again.
You will see the jump is not taken.
So now we step over it.
We go straight.
So now it is ready to call the memcmp function, which we discovered from here.
See that? memcmp is being used.
So we want to examine the parameters.
We look at this part here.
Just pull this to the left.
And you can see, as you know in Win32—Windows—inside x64 programs, the parameters to a function are
being called by setting up the parameters in registers instead of pushing parameters to the stack.
So the four parameters are -, -, -, -.
So we have already studied this before.
So to know what parameters are being used by a function, you look at these four registers. You will
know what the parameters are.
So four parameters for memcmp is -, -, -.
So you want to know what they are.
You go to memcmp. So MSDN memcmp.
And then you can look at the parameters.
So memcmp has got these three parameters.
This is -. Only use three.
So -.
-.
So what do they mean?
So you are comparing string one with string two, and count here refers to the number of characters
to compare—number of characters to compare.
That's the count.
That means the third parameter is the number of characters to compare.
So six in this case.
Why?
Because we entered six characters.
That's why I think that it is only comparing six.
So from here we can guess that it is trying to compare our input, which is one, two, three, four, five, six, and comparing
that with another string, which is "pineapple."
So from here we can guess that the password is "pineapple."
So we can test it out.
You need a copy of the crackme.
And run it.
Make a copy and run a copy.
Open a command prompt here and run the copy.
Enter
"pineapple."
Incorrect.
We solved it.
So this is how you can fish out the password using this method where we put breakpoints on the VirtualProtect.
Okay.
So that concludes this lesson.
But next lesson, I will show you how to patch this file.
So as we all know that packed programs cannot be patched.
Why?
Because if you try to patch this to make it go straight, it won't work.
Let me show you this example.
Now to solve this, you might want to patch.
Okay.
Let's graph it further.
You might want to patch it so that this thing doesn't execute.
So you NOP all of this, and also you NOP all of this.
So if you NOP from here to here, it should go straight.
Correct.
But the patch will not be able to be saved.
I will show you that in the next lesson.
All right.
See you then.