Welcome back.
In the previous lesson, we already managed to fish out this password: "pineapple."
And if we wanted to solve this, you just need to patch from here to here with a NOP.
So let's try the patch and see if it works.
So now let's see.
We are going to run this four times.
Make sure your breakpoint is there.
This one.
One, two, three, four, and then go to VirtualProtect, Run to User Code.
And then here.
Now we run until the password is shown, and then we type one, two, three,
four, five, six.
But before you press Enter, let's go to our breakpoint and enable this one.
Enable, and then go to that location in -.
So here's where you are here.
And graph it up here.
All right.
We want to come to this location, so we can run that now.
We press Enter and you hit a breakpoint.
So now we are here.
We want it to go straight.
We don't want it to jump here.
Right.
Because currently it's going to jump.
You see, this jump is taken, so we can NOP this.
We can also prevent the memcmp and this jump by NOPing all this line as well, so that
it eventually just goes straight and shows the good message.
So let's try that.
Right-click, Follow in Disassembler.
So we want to NOP all this from here to here.
This is what we want to NOP.
Correct.
So we can actually select all this from here to here—from here to here.
And NOP it: Binary, Fill with NOPs.
Okay.
So now if you—if you continue to run, it's just going to go straight. Watch.
So step over, step over, step over, step over.
Eventually it will come here.
Then it is coming here, and now it's constructing the good message. See this?
As you keep on stepping over, it says "Correct."
Right.
That's it.
So we managed to solve it by NOPing all these few bytes.
Let's go back to disassembly view.
We can manage to solve it by doing this NOP.
NOP.
But the problem is, when you try to patch it, it fails.
Try to patch.
And we try to save it as "crackme2."
"crackme2."
Please save.
All right.
Patch.
Patch applied.
Fine.
All right, so now we try to run it.
"crackme2," Enter password.
Incorrect.
See that?
Why?
Because when—
after you patch it and then you
quit the program, the program collapses back into a packed state.
So the original file has not been patched at all.
That's why it fails.
So this method cannot work.
You cannot patch a file
which is packed.
You cannot patch it.
So the only way to solve it is to find a way to patch the memory itself
after the program has run.
That means after the program has run, you enter the password, but before you hit Enter, you patch
it.
You patch the memory itself.
Then hit Enter.
Then you'll find that you'll be—correct.
Correct.
Password.
So that is called memory patcher.
Another—
another name for that is called loaders.
Loaders.
Loaders are those programs which allow you to patch the runtime process memory.
Instead of patching the file, you are patching the memory itself.
So to know what you want to patch, we have to restore selected first.
Restore selection.
And then the bytes that you want to patch are all these.
So let's see.
So let's go and open a Notepad.
Search for Notepad.
Let's record down the bytes to patch.
The bytes to patch is here to here.
So we select all those bytes, right-click, Binary, Copy, and then come here and paste it here.
So there are 15.
All of them.
You can count: one, two, three, four, five, six, seven, eight, nine, ten, eleven, twelve, thirteen, fourteen,
fifteen—15 bytes to patch with NOP.
So you want to patch those bytes with 15 NOPs.
15 NOPs.
So when you patch these bytes with 15 NOPs, you replace it with ninety zeros.
So let's try that now and see.
Binary, Fill, NOPs.
Okay.
And you see, now it has become ninety zeros.
So you can copy this.
Ninety zeros.
Binary, Copy.
Come back here and put 9-0-9-0.
So this is NOP.
So you want to replace this original bytes with these bytes.
So we can write a Python script to do that.
And I have written that for you, so you don't have to do it.
So the Python script is shown here.
Open your crackme.
And this is a Python script.
So all you need to do is open the Python script in your favorite editor.
I'm using Visual Studio Code.
And then in this line here, fill in the bytes you want to patch.
So I already copied the bytes here.
So all I need to do is copy this and replace it here.
So just copy and paste it here to replace it.
And I've already done that.
Next thing is you copy the bytes that are being used to replace those bytes there and paste it here.
And I've also done that already.
So if you find whenever you want to use this program to patch memory,
just put the bytes that you're searching for on top.
And the bytes you want to use to replace it at the bottom here.
That's it.
That's all you need to do.
The rest you don't need to know.
And I'm not going to explain this because it's beyond the scope of this course.
I just wrote this program and it will work to patch memory with any bytes you want.
So now you save this, and then you're ready to run this Python program.
And I also assume that you already installed Python on your computer.
If you have not installed Python, you go ahead and install it.
And after installing Python, you also need to install some Python libraries.
I think you need to install
psutil.
Okay, I'll give you a quick hint on how to do that.
Go and download Python.
Like this.
Download Python 3.12.2.
And then when you install Python, make sure you install it globally, not for individual users.
You need to install it globally for all users.
And also you need to set the Python path to the environment variable, so that—you can Google it
in Google to know how to do that.
Then to install the Python psutil, you need this.
You just need to open a—pip install.
So search for cmd.
You need to type—
you need to run your command prompt as—you need to run your command prompt as administrator
here.
Run as administrator.
And then you need to type "pip install
psutil."
psutil like that.
That's it.
Then after that, you should be able to run this Python script.
So let's close the Python script and go to this location.
Open the command prompt here, and let's put this to the right.
And then we open another command prompt to run this program.
And you put this on the left.
So now we run our crackme.
And enter the wrong password.
It says "Incorrect."
Yes.
So we run it again.
We're going to patch it and run it and see what happens.
Again, open the command prompt.
Put you on the left.
And run the crackme.
But don't enter a password yet.
Run your script.
So your script is—what do you call your script?
Let's run the dir to see the name of the script.
The script is called "patchmem.py."
So to run it, you type "python
patch-
mem.py"
and the name of your crackme: "crackme.exe." Hit Enter.
So it says "Successfully wrote data to it."
So it's managed to patch it.
So now if you enter any password—any wrong password—hit Enter.
It says "Correct."
So the script works.
Now another way to use the script is instead of providing the name of the crackme here, you can provide
the PID.
The PID—process ID.
So let me try this again, this time by entering the process ID.
So this time I'm going to rerun—open command prompt here.
Put it on the left.
On the left.
And then I'm going to use my Task Manager.
Look for the process ID for the crackme.
Okay.
I haven't run it.
I'm sorry.
So I should run it first.
Crackme. Then come here and look for it.
I think this is the one.
This is the one.
Yeah, this is the one.
So to get the PID,
so this is the one here.
If you double-click, you will see "crackme."
So to get the PID number, you just right-click and then go here to "Go to details."
Go to details, and you can see—yeah, there you go.
The PID is 5336.
So here you can run your—earlier—earlier—earlier script.
But this time instead of the name of the crackme file, you supply the PID.
So the PID is
5-3-3-6—5336.
Hit Enter, and it successfully patched the file.
And now you enter anything you want.
It says "Correct."
So there are two ways to use this script.
Either you supply the name of the process, which is "crackme.exe," or the PID.
So the PID is a bit troublesome.
You need to open Task Manager to look for the PID.
Okay, so that's all for this video.
Thank you for watching.