Hello and welcome.
We are not going to use the term any way to solve crimes.
And Judy two ways to do the Teddy One way is to unpack it first and then do the spear fishing on the
backfire and the other way is without unpacking.
Go and do a serial fishing so the difference between serial fishing and fire patching is five.
You don't care about this zero key you passionate file to bypass this hero key.
So in here you are actually trying to find out the actual security.
So generally this is more difficult to do than the previous two methods.
So let's try not
less open the back file.
I'm not going to unpack it just hoping that my file actually see for BBG
and over here quick plug in scalar height options.
Make sure that you alluded the basic fact so that you can hide in debugger from the program.
So now let's run it and key any Hiroki Cleveland check.
And now we're going to find out the memory address who a string is being compact so to do that we are
going to use the call stay method.
So parsing here and once the debugging is passed to on the contact and look for the WHO may address
where they're using multiple makes a call to the system to show the telephone box.
So this is the location rightly and click follow from and if it is corrupted no so this is a location
that calls me to show that that unlocks and if you look out further you will find there is uh chum here
and this is a gem which these sites rated show the good message or the message.
So this is a comparison being made here just before the jump.
Will always be a test or compare in this case it is a test.
So the result this test determines whether or not to jump in here we can put a breakpoint to see the
result results on the test.
So now you can run
over here OK.
And now it has hit a brick point oh here and he can see the result.
Yes is negative 1 remember.
O f means negative 1.
So we can put a remote here that yes I should be zero because that's ESEA.
Yes I am.
Means you are testing whether the value of hearsay is zero.
If the value of hearsay is zero then he will jump off the radio.
Hearsay is not zero.
This was not done so and that is why.
Here we can put him up.
So here you can put remarks here.
Yes I should be zero.
K K so no.
EDIT As it stands yes I is not zero since he's ninety one so our glue is CSI.
We need to hunt down CSI to see which instruction sets it through a negative one so if you look up here
you will find it.
Yes I being set by this instruction.
Yes so a here says he.
So now we put a brick blindfold up and then we run.
And I now.
Okay.
And click check again.
Be sure not to reset if you reset you will lose all your break points because this fire is a backfire.
So now we are hitting a new brick point and we examine each scene we find that he is negative one or
so.
So now our new target should be X.
So put a commander and see it should be zero.
So now we managed to trace the radio.
Yes I do.
Yes it is.
E exhibition ultimately decide the value of CSI.
So now we're here.
We can trace what says.
Yes.
So you see stay so calm call just before this and normally the result of a is time Heene.
Yes.
So there is a good place to raise I mean so we can put the big point here.
And now we run again and then we are going to enter this call to see what happens inside here to send
the ACLU sort of running in and then come here.
OK.
Quickly changing.
So now he has hit our new break point and we can press F seven to step into this car.
Do is I mean what sets the value of x to negative 1.
So let's press F seven now and we are inside the car.
And now you guys I mean the value of the ice and keep pressing it to see when it becomes negative.
One keep pressing f it
now is one f it again.
Now he's negative.
Negative one.
See this whole f Miss negative one so it is had this line that he becomes negative one and just before
it there is a cartoon comparing.
Yes.
So this is a good place to be is I mean what happens.
And this obviously is API so we can select on this part here correctly and then select s analyzer and
in isolation is easy.
This is API call and the API accepts all these parameters any notice and there are two strings shall
be used to convey to each other and you can look up and this thing is in Google Chrome browser.
Compare strings
so negative as a result and you see compare strings compares two strings the string the district and
then returns the result here.
So the result is normally he acts as you recall from previous lesson.
So comparing will compare this string and in this string and then return the result in e x.
And so this is a good place to put our new breakpoint here.
And we're running in
here OK.
Check in.
Now we hit our first break point.
So if you enter this car run you know we hit how can you break point.
So we're here.
Now we can examine the state as it is being pushed for us f here.
Now here.
Press heavy she has pushed the fostering into this day and you can see the string is ABC the one two
three four five six.
Now if I had to guess I would say that this is the zero key then now is here he is going to push a come
which is he.
There's a method and you have to worry about that.
Now he's going to push another string.
Press F it and you see then a string is pushed so it is going to compare this string industry but keep
on pressing every And now if you press again f it he will start the result of the comparison in here
he s so presenter and the result is one.
So what is the meaning on one.
So let's go and examine the MSE in the return value of the dysfunction you scroll down to see.
He returns a value describe for this sort of thing on it.
And then here hold onto to the return and look for the return value.
So he returns one of the following various successful either this value is value or this value.
So these are constants.
So it seems that it is returning one.
One could be this or this all this.
But I didn't think this is because this is this means equal.
And if you recall you say to maintain the C 110 convention no comparing three very two can be subtracted
from the non-zero return value.
So if you subtract two and you will get the same result as the standard C program.
Now this is Microsoft comparing Microsoft comparing there's no return zero.
If the string is equal here returns to.
How do I know that.
Because you're supposed to deduct two from the nuns none none zero return value.
So if the string is the same it will return to.
So let's at I.
No matter how good it is retaining one there I the string is not the same.
It is a sin.
It is a positive return too.
So now if you go down here let's see what happens.
You press hate effort and you see the it is going to minus negative 2.
It is going to minus two from X had a negative to do here.
It is the same as minus two from here.
So this f f f ending.
He means negative too.
So this is consistent with the amnesty in any CIC the very two can be subtracted from a non-zero return
value
so industry was equal after you minus negative two you should get zero so you press added he will see
that he will not be zero he'll be negative when he goes to negative two plus of one will give you negative
1 right is a simply one minus he negative too.
So now you know that he is said over here definitely this is to pacify the zero G all right we can test
our theory we can run the program again and try to enter this hierarchy and come back here and see what
happens so this hero keys ABC dash one two three four five six so we can compare copy this up by selecting
any in the previous line this continuous string and this compute is like copy line and paste it in your
note that
and get over here is DV
and this one is he uh zero g g run again.
Okay now we entered the zero key getting one and then you check in over here.
Now we are here to enter the clock and over here and now you press F it here we see now he is pushing
the string.
This is a C string the that is to be compact and you push not a string.
So now both stories are the same.
And then keep on pressing effort and after the call to the contesting you will find the Yankees too.
So that confirms I some I missed the n he says that he has this crazy quilt issue written to
right.
So now we keep on pressing he is going to minus two from two and that should give us zero.
Right.
So press heavy tuna has minus two from two and you give us zero now.
So now he's giving pressing have it remember that when you're heading you take the source at the destination
and start it is result in the destination.
So that is the reason why and you take negative two and you've to UK zero you start zero back in the
destination.
So now you press F it continue to press it.
Come back here.
Yes yes no zero.
And that confirms our common wifi reason we wrote earlier Q1 pressing effort and now yes I should be
zero and through inaccuracy.
Yes I.
It is zero.
It's not if you keep pressing f it he will jump to the good position.
Now you can just click Run and you will see.
Yeah.
Shown a message.
Correct.
So this is how we do zero fishing to fish out his hero key.
Now in this example the.
It so happened that when you're running the 0 keys only being detected.
So far moving.
And then I run you again if I put in a wrong zero key
If I were to put in a wrong zero key I say
and then come here should you notice that it's Iraqis ultimately do take that and shown here.
So in this example we are so lucky that we hardly can see this Iraqi being detected by excessive force.
Sometimes you insert in the software you might not get so lucky.
This Iraqi may not be so easily detected over here.
So that is why I went through the trouble explained to you in great detail how to hunt down the 0 key
and a strength.
So that's all for this lesson.
Thank you for watching.
See you in the next on.