Welcome, back.
Let us now continue.
In the last lesson, we already found the array of bytes that we want to scan.
So now let's open our Python script that I have written for you.
I open it with my Visual Studio Code.
You can use other code editor if you want.
So over here, these are the instructions.
Use x64dbg, x64dbg, to determine the target area of bytes, array of bytes, to search for, and this will become
your data defined over here.
And then the bytes to replace it with.
This will become your, your data to replace, which is here.
Make sure your array of bytes is long enough to be unique.
You don't have to replace the entire array of bytes.
So in this case we are only going to replace 74.
We, we don't need to replace the entire thing.
So what you need to do is, I've already done it,
but if you haven't, you just copy this and put it in here.
And copy this and put it here.
So now you're ready to run this program,
this script.
Notice here that the usage for this script is different from the previous script.
In the previous lesson, you have to run the program first.
That means you have to run the Crackme first before you run the script.
But in this script, this program, the loader.py, you don't have to.
This loader will automatically run the program for you.
So the usage is you type this command.
So the file name, you need to replace it with the name of your Crackme, then it will automatically run
the program, and then you wait five seconds for it to start, and then it will patch.
So there is a delay here of five seconds which you can adjust accordingly to your liking.
Time sleep optional.
Add a five-second delay to ensure the application has started and unpacked itself into memory.
So it's necessary to have this system.
Otherwise, uh, if you don't have the delay, the program won't have time to unpack,
and the,
and the patch will fail.
So that's why you need to put a delay.
If you feel five seconds is too long, you can reduce it to four seconds,
or you can use, uh, fractions, for example, 4.5 seconds and so on.
It's up to you.
I, five seconds just works just fine.
So now we can run this.
So what we need to do is we right-click here,
open in terminal.
And then straight away we type the command "python."
Loader.
Press spacebar.
It will auto-complete the name of the script for you, and the name of your Crackme that you want to start.
Make sure these two are in the same folder, so you type in the name of the Crackme.
Press spacebar and it completes the name for you, but you will have to remove this backslash, otherwise
it won't find it like this.
This one is optional.
If you want to remove this first layer, you can go ahead.
Now you're ready to run.
Press Enter and it takes five seconds for it to, for it to unpack itself.
So there's a message "Waiting for it to initialize."
That means it needs to wait for it to unpack.
After five seconds it will flash.
It will scan this array of bytes and then it will patch it with your byte.
It will scan for this.
Once it finds it, you patch the first byte with -.
If it's successfully patched, you will get a message "Successfully wrote data" to the address that it
patched.
So now you can enter any wrong data, wrong key, and you click on "Check" and it says "Correct key."
So we have successfully patched the memory itself.
So this is the power of memory patching,
and, and potentially it can be used to bypass, uh, software protection or packing.
And this is easier than unpacking because in unpacking you have to go through a lot of tedious work
to unpack and dump and then fix the IAT table and the PE header and so on.
But using this method is so much easier because we just let the program unpack itself.
Then all you need to do is just patch the memory after it has unpacked itself.
So that's all for this video.
Thank you for watching.