So in this video will be seeing how to obfuscate the function names that we use in the program.
So what we're going to do is we're going to use some random names.
But shouldn't we get the code execution from the function?
So we're going to execute the same function with a different name.
We can build that using that sheesha better yet.
So we have already seen the benefits.
So there's other function pointers where we can execute.
Chain of functions are one function as well.
So we are going to execute the message box function without using the actual string message box.
Because in the static malware analysis, the my release will see the P about the inputs.
Then we can get an idea that what functions that your table is using.
Then it he can analyze that it's master and it's connecting to some address and sending the data using
this function names.
So what we're going to do is we're going to declare a delegate.
So it's a public delegate and same function signature as the text message box.
So when you do see, let's say there are messenger.
You can do whatever you want.
So the first one is the Gucci handle.
So it's just the normal.
And the second one is the next.
We can use measures about the value so we can set parameter.
Martial arts managed to, but.
Our long term Unicode character Unicode string.
Spring text.
And copy the same.
And rename this to caption.
And the last one is the type of the message box or to create, whether it contains or care button,
yes or no, cancer, etc. So that should be one party to the type of this message box.
So we have one function signature that matches exactly as the message box.
So what we're going to do is we are going to find the address of this message box function in our process.
When we run the process, automatically it will input some basic builders and then function.
So we going to search in those real space at the space for these functions so you can get module handle.
So we are going to bring this.
So let me just put this.
The return date is the handle to the market.
So.
And we should get behind the bill.
And we need to pass that handle to this.
Get brokers.
So the first one is the handler.
Actually, the pointer to the handler which you get from the get my 200 year.
And the second one is the actually the function there.
So it can be just bring.
Function them.
So let's go and get my junior year off, Colonel.
Sorry, that is user 32 because the message box W is in there.
If the deal is not important by default, you can load that.
We're using the load library function so we run to get the address of.
User tactic to address.
And we need to pass this address to this.
Get put our cadres.
User 32 address and such for the function m message box w.
And we'll get the address of this.
Function sort of to fund cadres.
So Vanguard responds to the function.
And what we need to do is we need to marshal this to the end of the year.
So we have this marshal that will get the delegate search function.
So we need to pass the function pointer.
The functional does come up a.
Which type you want to delegate.
I want to get the delegate for this mess and get so far with this.
And the Republicans in the.
So messenger young music learns to love messenger.
Now we do just call this function, but we need to pass the parameters because the message box functions.
Signature content parameters.
So the first parameter is null.
And the second one is the actual hello world and the caption of the message box and it's testing.
And the second one, the last one is the paper.
The message box begins at zero.
So now we can actually run this one.
And now we can see we've got the materials and we can see we are good at the message box function without
actually having that spring message box in this function.
So like this, you can execute, you can obfuscate the function and execute those functions without
having the actual name in this function.
So with the help of the benefits.