Welcome to a new lesson.
Today we are going to analyze the correct me to be the IEEE so before it has to do some housekeeping
did it easy far and you don't need anymore and rename this folder to zero 3 followed by the rest of
the name.
Me too and inside it we have how can we do so to analyze this file.
The FDIC just opened it.
FDIC
and as you can see it's a compile the Microsoft.
We shall see 2 0 1 7 and link the Microsoft link and the entry point offset is at address 0 1 3 d 8
an image bases 4 0 followed by 4 zeros in a day.
So these are the things we need to know.
The entry point so the entry point should be 4 0.
1 3 the 8 and we can confirm that by opening correct me Do you know a 64 BBG
so we can click and run or have 9 to go to the entry point.
But before I make sure that your options preference yes go back and check and make sure your assumptions
are also not.
So if you forgot how to do this is uh simple.
Let me show you again.
Click can range typing eight zeros
and with it s
click OK.
That's how he idea exceptions.
I'll give you DNA.
We cannot press F 9 or click on the run button to run to the entry point.
So we know the entry point to confirming the entry point addresses 4 0 1 3 8
which we got from the analysis.
Did take the easy 4 0 1 3 the 8.
That's it.
So if he ran the program now
you see that this is where we get we'll get a window showing up and leave a message inside the window.
So you reach reach unregistered software please correct me and any of you to click OK.
You were just close so let's run it again.
You click but you say register in the title bar and in the content he will say unregistered software.
Please correct me.
OK.
So this is the behavior of the program.
So in an experiment I'll show you how to start cracking this software.
But in the meantime we do think about how you're gonna push it.
Obviously this always manage to check his status before he starts.
There is at a time he starts he's already checking his status who it is registered on.
So do think about it.
How does it check his status.
See you in the next lesson.
Thank you.
40.