So in this video we'll be talking about the technical data harrowing.
So it's similar to the process ring.
So in this, we will load the legitimate deal into the process and then we will hollow out the text
section with our shell code and then at the checkout we will create the thread to run the shell code.
So first, let's get the handle to this process.
So there is an API called Steam API, which is a legitimate steam dealer.
So let's say stirring the pot is equals to the pot.
We'll be using the open process function to get the handle and then we will allocate some memory to
write the this spring.
So why we need to write this thing because we will be using the function load library, uh, to load
uh, Canada to do the deal and then finding the load function and then we'll, uh, run the function
load library with this parameter.
So with this as a parameter, so the data gets routed in the remote process using create remote read.
So first let's get the handle.
So open process, so desired access is process all access.
So I have just copied from this.
Uh, or.
And the process ID so let's say period is equal to zero for now.
And in return we get the.
Prague.
And now we are going to allocate some memory that is, uh, this one, uh, we can also convert this
into bytes byte by it.
The other part is equals to encoding dot as key dot get bytes.
And the other part.
So let's, uh, irrigate some memory using water locks.
This is prog handle and the bass address will do zero.
So the operating system will allocate a memory region for us and the size is this one by part dot size.
That rent and allocation type is a ma'am commit and resolve.
Our production type is, uh, read, write, execute.
Uh, you don't need, uh, execute because uh, we are scoring only the spring at that.
So I think rate, rate should be fine.
So we will get the, uh, best address.
So this pacer does.
We are going to write using right process memory.
Baroque Handel and the bass addresses this bass address and the bite above, uh, betrays, uh, bite
the other part and the sizes uh, by it, the other part, the length and how it's written.
So let's create a variable by it's written is equal to zero and we can say out by it's written.
So the.
Um.
The string will be returning to the process.
Memory, remote process, memory.
Now, what we going to do is we need to, uh, load library, uh, of the kernel that it would deal.
So this will load the specified data into the memory.
So it's a deal.
And so we we get the hang of this deal.
And in this deal, we need to find the function that is allowed.
Library.
Uh, e.
And the function name is road library here and we will get the functions address.
Function address is equal to this one.
Now we have the function address and we have the string address so we can create the thread to execute
this road library with the argument as this one so that the error will be loaded.
So it's nothing much, it's a legitimate error.
Later we will, uh, replace the text section with the actual code.
So create a remote thread.
430 attributes null stack size zero start address is this function address.
And the function parameter is the base address in the creation flex zero.
So that thread will start immediately.
And the return type is the thread handle.
And I hope to read it.
So let's put the breakpoint here and let's start the notepad.
So there is this double click on this and go to modules is here.
See there is no steam aviator dealer.
So you can click on this name to sort according to the, uh, alphabetical order.
So there is no steam API.
Now, let's, uh.
We can also print this address dart to string.
So let's run this one.
So we got some error.
Okay because of the PID.
So we do not give the correct process I.D. so copy this one and paste here.
So let's put the breakpoint before this remote read function.
And now we got the place address.
So way to read.
Right?
Right.
So we can do like this.
236.
900.
236 E.
So this one?
I guess.
So here we can see that the little, uh, uh, string or let's cross this and let's go and run this
one.
Now we should see the data if it's loaded on a go to modules.
And here we can see where they later.
So let's, uh, call this one now.
What we're going to do is.
So we are going to find the loaded dealer's names and their based addresses so we can do that using
the function create to her particular snapshot.
So we have seen this in the previous videos, how to load that, how to find the details, uh, name
and, and their based addresses.
So, uh, it will take the snapshot of the process.
Uh, processes, uh, uh, are the modules, threads, etc. at that point of time.
So if you, uh, run this, uh, after 10 minutes, you may get different values.
So the first one is the, uh.
The facts.
What what type of information do you want?
So we, uh.
We want the information and the process ID the second parameter.
So now create.
So I have already declared this, uh, because I don't want to waste your time by creating this so you
can go to paint work and copy this.
So these functions are there.
It's.
So one eight.
Uh, two four.
So, one, two, four, eight.
And then we need to pass the pad.
So we will get the snap and the snapshots handy.
So let's call this, uh, snapshot handle.
So this snapshot handle should be passed up to this module first to function.
So this will use this use the information about the first module so you can see the first parameter
is the snapshot handle and second parameter is the string.
We will get to this one.
So a pointer to the structure module that you do structure.
Here we have the size and the modularity process ID belongs to and here we have the base address, base
address and here module.
We also have the handle of this module and also this module part and that module module name.
And that module is absolute part.
So this, uh, structure can be copied from being work.
So, uh, I have already copied this one.
So here you can see, uh, before copying, I thought it was, uh, by value area.
So it's not by value string.
So entire area will be converted into the string.
So you don't need to worry about that.
So let's call this one module 32 first snapshot handle.
So we will be creating a new module and data, data, let's say me new module and the data and we need
to define the size.
So it will take the information in this, uh, structure and we need to declare the size.
So Yami dot size is equal to ma shall dot size of type of module and 332.
Uh, we got some error.
So it is unit and this one is int.
So.
Now we can pass this as a reference to make.
Now I can print me that, uh, module is that module.
So that module is this one name.
You can also rename this one, uh, so that we can read, uh, clearly.
So what we can do is we can use the, whenever this, uh, function is called the module 32 next.
So it will be like a, uh, link, which it will move on to the next one.
So what we can do is while a meet dot.
I am made out.
But as a side note, is equal to zero.
Uh, we'll be calling more data to next snapshot handle reference me.
So, uh.
Okay.
This should be fine, I guess.
Now, let's go and print these, uh, module names.
So again, once again to the notepad and.
Copy the process.
I'd.
Based here.
So let's go and run this one.
So at this point.
So.
So let's also run this remote read.
At this point, we should have the.
Uh, steam rolled into the.
Process.
Uh, so here we have this TV right here.
Now, let's go and run this one.
Well, we are getting some.
So let's stop this and.
So that more immediate is that module.
So since the IPA team IPA, they'll already run it, so we can, uh, just comment on this one.
Commander up to this.
So since we are getting error, so let's run this one.
Okay, we, uh, we got this, uh, deltas, so fine.
And we can also print the meter module based address dot to string.
So that's gonna run this.
And we should have a very rigorous, uh, based address.
So it's, uh, it's not sorted out.
So what we can do is if your meter is that module is equal is equal to or dot contains steam.
And then only we can.
We are going to print this one and here we can see we got the one dealer with the name Steam in it and
the base address.
Now at this base address, there is a dealer.
And what we need to do is we need to find the offset of this, uh, entry point.
So I have this function, uh, we have seen this in the, uh, p passing videos.
So this is similar, uh, where we have found the size of header offset.
So here it will be 80 years and I change this to 40.
So P offset plus 40 which gives you the entry point.
So you can just change this for D and you will get the, uh, entry point.
So we can, uh, do this one.
Uh, we can create.
Let's, uh, we need to store this, uh, value based address.
Military bases equals to zero and dealer bases equals to.
So we are saving this to a variable database.
So we can put a check if.
And pointer dot, uh, size.
Is equal is equal to eight, then the other base is equals to a dot base address dot point 64.
Else the other base is equal to your made out base at the start to end the data.
So you don't need to worry about changing the 64 to 32 when you compare for 32 bit architecture.
So we have the database.
All we need to find is the entry point offset so we can get our image entry point off.
So it takes the white area.
And it gives you the entry point.
So whenever, uh, you can add this one database, an entry point, so that gives you the first instruction.
So we need to first write the, uh, this.
Uh, the actual content.
So we have, I have already copied this one, uh, the previous, uh, period, that is calculator period.
So we're going to write into the into that based address database and then two point.
But our candidate and the best actress is Taylor Bass.
Plus, uh, entry point.
And the buffer is our calculator payload and the size is payload length.
And now.
It's written.
Okay.
Let's delete this one.
So we are writing that, uh, our share code into that, uh, database based press entry point.
Now, what we can do is we can.
Create a remote read at that.
Uh.
Uh, address where our record resides.
There.
So you can just copy this one.
Creation flags start immediately.
How did.
So I think we have missed or something.
So function parameters or.
Okay.
I think we are good to go.
So let's put the breakpoint at this.
Let's also print the other base press.
And three point.
Not to string.
So let's, uh, cross this one.
So let's run this.
So we have this, uh, address.
7ff.
So here we can see the data so we can search for our of ideal.
Okay.
Here we have the director's memory.
7fff, 7ff.
Eight F.
And if and for so.
So when an F rate of 40 and 70,000, I guess this one.
So if I go and double click this, uh, not this one.
Well, yes, at this one, we have, uh.
And then three point.
Uh, we should have the record.
Uh.
We got some error, so let's see that.
Okay.
So, uh, we need to read this, uh, file that, uh.
Read our bytes.
So we are, uh, actually parsing the string instead of, uh, reading the contents.
The content.
So let's copy the process already.
And now let's put the breakpoint at this right process memory.
So let's run this.
Well, we have this address.
So previously this is the base of this, uh, database.
So I guess our, uh, after this point, uh, it should write, uh, correctly so.
So let's go and run this.
So if I go and run this, our categories should pop up.
And here we can see the calculator.
So that's, uh, about the they're hiring.
So we, uh, loaded that barrel and then we hollowed out the tech section and the place that we shall
code.
And we also used the script to help that to Snapchat, which is, uh, very helpful in finding the best
address and address at the same time.
And then later we created the thread that shortcode, uh, address.