Hello and welcome back.
In this lesson we are going to get started with three with me to buy Lina.
So let's open it I see bugger
and now we're the entry point in my setting is as follows often preferences objectives and breakpoint
in DNS callbacks and in all these exceptions and my plugins analyzer as follows me show the first two
is uncheck so now you can go ahead and select the positive one to analyze
and end so like all of those and then right click X analyzer analyze selection
and now we can take a look at a quote as you can see it has already feeling the function calls we know
API has her eyes the parameters so let's stick around it and see what happens we have a pop up message
box we cease evaluation beta hot on the purchased new license click on OK and the program 10 minutes
then you click.
OK so let's restart the program
and let's see.
So now if you go to
all right let's see.
So now you either step through by pressing it we can see that he is calling all these functions like
on both closer and they create file and it seems he's looking for a file.
Now look at this as you recall from the earlier lessons clarify is a Windows API function to open to
look for a file or to create a file and you can read up from MSD in or here why the SDM create file.
You can also refer to the earlier lessons on this.
And these are the meaning of all these parameters
so create file so the father is trying to queries code key file is looking for this Kieffer so far does
not necessarily mean creating a file it will also mean looking for a file so that you want to read it.
So as you can see here the parameters generally read and write that means it is opening looking for
this file for reading and writing.
The rest are pragmatists.
Uh uh not so important it is this one which you are interested in.
Key find on that.
So it is looking for this key far on that.
And here is a cause the function and the result of this call would be starting.
Yes.
As you recall in the previous lessons every window function will start the result of the call in X and
you can read.
Here's where the result the call is known as the return value.
So if you look in the windows uh MSD n documentation you can always scroll down and look at the return
value
the return value.
So the return either function succeeds the return value is an open handler to the specified file or
if the function fails the return value is invalid and the value we have seen this before in the past.
Okay.
So now the return value knowing that we are over here so let's call this represent Effie now the easiest
is a value and press have and see what happens to it and we get a negative one as you remember in your
previous lessons we saw that when you get it upside is a means negative one and this is bad it means
that the forest is not found in the file is found it will be a positive value with some no positive
number.
So the file is not found.
So what we need to do is create a it.
So it's going create a file.
You can just do it here rightly you file and the name of the file is uh key found that
key file on the net and remove the THC anyway.
Now if you don't see the extension at a bank you have to make it invisible.
I am going to review options change for the social options under review.
Make sure you
uncheck this high extension for known time should be uncheck so if yours is checked just uncheck it
and apply then you can see the extension so if he put uh he restart and come back here restart and we
step through again.
And when we come into this here see what happens when you call this and now it is not a negative one
anymore.
Right so so now issue
issue champ award is a bad message.
Earlier on in the event he was negative.
He will not come all this very message.
Let me demonstrate that to you.
If I needed it in this file came it closes first.
Okay I did it this far.
I stepped through again if I deleted the file when it comes to this and he compares it and whether it
is negative and you find it is true so because it is true the Zero flag is one and therefore evil in
John Jan evil angel.
So you displayed a bad message.
I said keep stepping to issues a bad message which is raging before our day.
By now if I were to create no file
key file the death
and I restart this effort go too far and now the E S is not a negative one.
So this comparison will fail and therefore you will set the 0 5 2 0 so the 0 5 0 0 therefore this junk
would take place.
So will you jump over these this very message so let's press F here and now it goes here.
And now he's trying to read in your file so is opening the file is when you read so in an s lesson I
will show you how to analyze this refund.
So I'll see you then.