Welcome back.
Today we'll look at hot brick points and memory patching.
First some definitions.
What is the difference between honeybee break points and soft fabric points high red brick points brick
points on memory addresses.
It means we set a breakpoint on a location which is in the RAM memory read so that we can keep track
of which process or which instruction is assessing those the REM and the relocations.
On the other hand some fabric points separate points on the instructions a cell so this the difference
between the two so into this lesson.
The objectives are as follows.
First we are going to learn how to set red brick points on RAM memory and then the two we are going
to learn how to modify data in RAM memory address directly.
So let's get started
open the creamy Heath existing for the G.
Make sure your option preferences are set as follows.
Check System break point and deal has callbacks and make sure that you are exceptions.
Not
note that you are now at the entry point.
And that's run the program by clicking one button.
O F nine on the keyboard.
Immediately the program opens and it has already detected that it is unregistered so the objective is
to fine the memory address location where this unregistered isn't being accessed to determine whether
it's a registered and so you should find the correct address to patch to make this software become registered
so we are going to use the first method to search which is a search for strings you'll be looking for
this string to see Ray it this being a used in the instruction so it is rightfully
search for carrying my new another beast an issue in Nairobi.
You can also do this to make sure you're in the correct use a my view and not in the system.
Mind you you can either make sure you are in the point the offset by comparing the detailed easy offset
address which we did earlier or we can go to the symbols there and I really click on incredibly here
and you can see here the base Rice Condi looking on the.
So now you can be assured that you are in the user module space.
You can start looking for strings so rightly search for current more you string references
let it do a search.
We are looking for this string here unregistered and now it has finished searching.
If this is too long we can just search it in in the search box here.
But it is in this case is quite not annoying.
The idea saw the result here and registered and above it is registered.
Interesting.
So let's go through this address.
I registered there clicking it to go through the assembler so here.
We see the string I registered and just above it is registered.
So this is a string of bad message.
This is a stream for a good message.
And how do we know which one to be shown.
Sure you should look for Jan up here.
There is a gem in gem is a one which decides whether he will show this or this message.
So we should put a break point here.
And then restart
run to our fine and now you can see the other breakpoint and he is showing red meaning that gem is taken
so he will jump over the good message and go into the back message.
Sure this that is here.
So now our objective is to analyze and try to make it not done so we don't want it to jump so issued
in John previously what we did was we just modified this by putting not like this.
Should anyone jump in into this lesson.
I'm going to show you another way instead of doing this.
We are going to modify the memory location where the comparison is being made some way up here no.
Every time we see a jam session it is testing the Flex.
In this case J.
He means he will jam even the zero flight is one.
So Jamie in jam.
Equal means equal to one.
So in this case is zero phrase one.
That's why is jumping and earlier lessons have you learned how to toggle is fly by double clicking into
it said it to the opposite and now you see it is not going to jump.
But like I said we are not going to use this method now we are going to use the memory patching method.
So in order to find out where the zero fly is being set we should look for either compare or a test.
So let's look for this either a compare or a test.
Whenever they say jump you can be sure that just before it's somewhere nearby there will be a compare
or a test.
So for example there's a test here.
Then laser John so the tests here with set of Flight 0 like 2 1 0 0 and ending jump would be to and
a zero fly to decide whether to Gemini.
Same thing here.
Whenever there's a jump just above it there'll be a test or a compare.
So in this case it is a combat.
So this comparison here says you're zero fly either 2 1 0.
So in this case here the zero flight is set to 1 when you set C0 flight is set to 1.
It means that whatever is being compared is seen this very dress is being compared to zero so if that
is same then zero flight is set to 1.
If they are not the same then zero fly set is zero.
So in this case zero fly set one we can confirm it by putting a breakpoint here or maybe just before
it and remove this breakpoint then reset.
Now we jump to a break point and the next instruction to compare this to so let's press F it.
So now it is about to compare these two and what will happen to the zoo reflect when a press F it.
It is one.
Yes.
So that means that the whatever is in this memory location is also zero.
That is why this zero is said to 1.
So 2 This is the memory location that we need to put a brake point on if you want to observe it.
So just click on this memory location and then you will come here select this memory location rightly
follow in them and they select your address.
So your address may be different from mine but whatever it is the address here should be this address
listed here which is this.
So this right click on this follow in them address and then you will jump here.
So you can see the address here for my guess now is 7 2 6 0 0 is referring to this address.
So in this address they start data some value by which is at the moment zero.
So you see it is comparing this zero with this zero.
So in this case zero complexity zero is true.
So when it is true is the same in this is the same then it will set a zero effective one if this was
one.
Let's say you are comparing one with zero then the comparison would be false and the zero flag is zero.
He will not be one does it reflect will only be one if this is one and it is one this is zero this is
zero.
In other words both must be the same.
He can be 10 and 10 20 in 20 or 30 and 30 whatever as long as they the same zero effect in the one so
in this case it is the same zero.
That is why zero is set to 1.
So because this reflects at the one when it comes to this line the jump would take place.
See is going to jump because as you reflect said 2 1.
So what we need to do now is to put a brake point here just to demonstrate to you that indeed we can
set breakpoint.
Actually we do set the breakpoint.
We just frankly here and then go up to that point had event says by what.
I'll do what I do and so right means you understand breakpoint point on only 1 by what is 2 bytes diva
is 4 bytes so this is 1 by and then this is what and this is deal with.
So it's either 1 2 1 2 how for this.
Okay.
So at the moment you can choose anyone to decide a D would be fine and you would you just click like
this rightly break point how they assess new so do you work is for bites were these two bites.
This is one bite.
So we are going to set a break point on view.
So you're watching this for bites here.
You.
So now we are going to remove both big this break breakpoint and desperate point need to remove if you
don't remove the bait points you will interfere if he'll leave your heart to everyone.
So let's reset and run and now you see the heat and I have a big fine at this address so we can just
go directly to this address this address here my clicking this one rightly and you can go to follow
in follow done follow in done this address.
So there we go.
And other ways you can click on this line.
And then from here rightly following them address.
And there you go see so the break point has been hit all right.
So now we can press heavy this devil we like this.
OK.
All right.
So now we know that this is the location where the memory is being read to compare whatever is store
in this location.
This zero.
So if we want to modify the code modify the memory so that it changes to any number of other than zero.
We can do it here.
Another fun way in which you can do it is now before that why would you want to modify this to any number
other than zero.
For example we can put this as one.
Why do you do that.
We do that so that this comparison will fail.
So when you feels the Zero flag will be zero when he's in a phrase zero.
This junk will not be taken as a high year.
All right.
So now let's put a breakpoint before this thing and solve every point just for testing.
So we put a solvable fine before this and now we restart and run to our solve every point.
And now the next step here his it is going to read this memory address.
But before he does that there is modify the data are stored here.
So the modified I click on this.
Come here.
Directly following them.
This address.
So let's change this to one so we can regulate how do we modify a memory directly.
We can modify the memory daily by selecting the part of the memory we want to modify.
In this case you want to modify only this one by here so that we can change it to one.
You can put frankly this go to binary had it.
And then here click check on it give size because we do want to override the next device.
So we just click here and change this to 0 1 0 1 9 0 1.
Thank you.
Okay.
And now watch what happens here.
So we are modifying this data in memory itself directly.
So now it is going to let me press F it.
It is going to go there and compare 0 1 0.
And guess what happened.
What do you think will happen with the zero flame.
That's right.
So we're going to press f it now we are going to press it again so that you execute it and wash it off
like zero flat zero early on it was one.
So you see compare takes whatever is stored in this memory which is 0 1 and compare 0 and then because
0 1 and 0 is not the same.
Therefore the comparison fails.
So the zero flame is not set to 1.
So this is how it works.
All right.
So now if you just press f it to keep on going it is not going to jam.
See this is a very gray arrow means I'm going to jump.
So you press I have it again and you just go right ahead to show you the good message.
So what we have just done is to create the software to make it become registered by modifying the memory
directly or here.
This is called memory tracking the memory directly.
All right.
So what do you mean.
OK.
Now if you would continue to press have it in sign or not eventually you would just pop up the window
to ensure that it is registered
PAYGO register.
Right.
So now we need to bash these to make it permanent because if you restart again this memory reset to
it is zero value.
So to make it permanent we patchy file batch file and is wanting to be back so quick batch file and
give it a new name
patch click save.
OK.
All right.
So now we open the batch file
and run it and is registered.
So this is how we do memory patching.
We analyze the memory first by putting high rhetoric points maybe test our theory whether it is correct
to test that memory address and it is correct.
Go ahead and patch MVC works.
So thank you for watching.
I will see you in the next one.