Original subtitles

Hello and welcome to a new section on intro to Software Protection.

We are going to look at what is software protection.

Yes, faking purpose, how to defeat software protection while he's unpacking how to detect Charvet

protection.

I think it is he program, he said that process of unpacking and EIC and some entity backing plug ins,

civil protection, his protection of Saffet against piracy or use and reverse engineering.

And the two main ways to protect software is using entity Puggy, which is to prevent debuggers from

attaching or analyzing or the second way is by packing, which is to compress the software whilst retaining

his ability to execute Issie.

Packy is rarely executable, is compressed to a smaller size, and ECAC protecting using anti debugging

techniques to prevent reversing and reversing will go back and protect is commonly referred as Peca.

Examples are backing up.

Yes, protect, armadillo, then protect, etc..

The purpose of backing is is to prevent reverse engineering, to extract the correct sense of security

and to defeat the static assembly or to dynamically modify the packing.

Yes, you also reduce the executable file size.

How to defeat self-protection first.

Not that easy to use, and backing and backing is where you let the program uncompress itself into memory

and then the original EIC from memory and jumping into a New York fire, then to create a patch for

the new reality.

Another way is to use.

This is also known as runtime betting here, you processing memory instead of putting a file we used

in order to start the program and wait for it to Uncompress itself into memory, the we the process

while is still running in memory.

What is unpacking and packing is very, extremely harsh and binary from the pack of five automatic on

package sizes for popular package by mean of different versions and not also available for complex packages.

And this also involves life debugging by defeating entity bugging techniques, detection of PACA, the

aperture detectors, PIV and the IED detectors can detect popular packages and also show the version

of the packet and also believe you were to be added to and give you two examples of screenshots of package

detected detected in the net and by on the right.

It is a structure, the people.

This is stretching before, Becky, we have to always an entry point and program is still running here.

After he has been back.

The.

Always an entry point, and all the instructions here are compressed in the entry point now is inside

you, the package will put a new entry point.

So when your program run, it will jump to the and technical possible stop.

And again, Uncompress, a backed original file into memory so that he becomes like this, only then

he execute.

So there is a way we have difficulty getting the backfire because the profile is in a compressed it

and several types of peckers, that one is the simplest pick up.

For an example, you type to contest multiple backing.

The three is similar to type two.

But he was more complex structures like loops and also different codes like integrity checks and debugging

and so on.

Example will be Beacom back year by year protection aspect and so on.

That fall by the wayside.

A single Mardele, a package in which a portion of the package could not responsible for handbagging

is intended for the execution on the original program.

Example is E.S.P.

Protect that five package is an entirely PACULA million taking to live with the original program.

Example is Veria Taxi Spica most complex where the attacker and fragments of the code at any given time

during the execution example is Armadillo.

That's seven Paca is very visualisations is being used on a Russian translation to avoid the obvious

from the ice post in memory, Hasan, Boza, Timyra and PVM predict the assassination of a bank program.

It's like this assassination.

We start from the new OEP, which is the OEP of this company, Ambedkar, and then you push the SBP

and some of the registers to this technician on the taxations are unpegging memory.

Then you rizza a progressive ideas on how executable file.

It is the use of time in libraries which is being used by the program.

He will restore her status using U.S. pump Russian, and then finally you would jump to the OEP to begin

the actual execution, a single push against Russia is equivalent to only squishes the most important

CVP, a single Russian is equivalent to how these instructions and the most importantly, AVP.

Probably BP is a way we can when Wendy Packer is about to return to the instructor.

Now, this is what it looks like when the PACULA is about to return instruction to the backfire.

When the program first starts, you will start with the instruction for the better before the battle

starts.

You push SBB to the side so that he can return to it.

Once you strike that the original file and then just before he goes to the instructor, fail to execute

it, he will pop up.

So this is how you can make use of this characteristic to track.

When the linebacker has finished unpacking and is about to return to the instructor, he has to execute.

You can put every point on SBP now.

The standard process of unpegging AICTE like this, he would not be easy to find a real or OEP.

And then once he found you, you dumb the and program to disk.

Then you fix the part-timer anniversary of Sleepyhead now unpacking, using excessive force.

Look into for the big.

Then he starts racing until you encounter a pushy 80 or pushy instruction.

Then you could have a big point on TV address in the stack next to you press F nine to continue the

execution, you would break on the obstruction, which is immediately after the head.

On instruction, then you press F seven to start raising as soon you encounter a jam a jam session,

which will jump to the entry point any way, once you have found and you already have done the whole

program using C for the biggest skill applied in.

So dumping is a process of extracting the easy fire and setting into a separate fire.

After you've done that, you need to fix the ingestible, said the new SFR.

We know where to look for the DNA library study needs.

Now, indeed, developing plugins and debugging is where the software itself detects that Bagley's attention

and their therefore refuse to execute.

And two very popular bloggers we can defeat is.

Dessau, thank you for your lesson in a nice lesson to stand our practicals, Houdin.