Hello and welcome to a new section.
In this section, we are going to learn how to use the memory.
So let's open our template.
To use memory, you will have to go to the memory map here, click on it.
And then there are two kinds of memory.
Here you have the initialized data and you also have the uninitialized data.
So the initialized data is called the data section.
The uninitialized data is called the BSS section.
So if you are going to store constants, you put it in here.
If you are going to create variables, then you will put it in here.
So for this video, I'm going to show you how to create constants by storing in here. We are going to store
numbers—
number constants.
So just double-click on this now, and below here you will see the memory dumps.
You can use 1, 2, 3, and so on,
but Dump 1 is selected by default.
When you click on the memory map like this, it will show you the memory in Dump 1.
So this is the data segment of the memory where all the constants are stored.
Constants are nothing more than initialized data.
And you can see here there are already some initialized data here.
So we are not going to touch those.
We look for some empty space down here.
For example, from here onwards you have empty spaces.
You can even use this.
So let's say use this.
So to create a constant here, you can right-click on this.
Let's say I want to create the number 1234.
So I will select two bytes.
Here I'm going to store the number 1234 here.
So I right-click this two bytes,
and then I will click "Binary," "Edit."
And I will key in 1234,
but I need to key in reverse order.
So I need to key 34 and then 12.
This is because of what we call the little-endian convention in Intel processors, where you would
store the lower bytes first on the right-hand side and the higher bytes on the left-hand side.
So remember that.
So just click "OK" now and you will see—
now 1234 is stored there.
So remember, whenever you are storing numbers, it needs to be in reverse order.
I mean, the most significant number bytes are on the right and the least significant bytes are on the
left.
So 1234 will be reversed like this.
So now you can make use of this.
Now over here, for example, let's go to our code and hollow this section.
Here you can hollow everything under here.
And fill with NOPs.
And it's now coded.
So we can actually move this number from memory into register -.
So let's try to do that.
Now remember, when you want to assemble anything, press the spacebar first.
Then type "MOV -" and then "DWORD"— "QWORD," sorry— "QWORD PTR,"
and then "0x."
And now you copy this address and put it here.
So before we do that, let's copy the address
first: right-click, "Copy Address."
So we just copied this address.
So let's repeat that.
Press spacebar, "MOV -,"
"DWORD PTR"—
sorry, it should be "QWORD PTR."
And then in brackets, put "0x" for hex,
and then paste the address there by pressing Ctrl+V
or just right-click and paste, and close the bracket.
So these square brackets here means that you are accessing the value stored at that address.
And you need to put the "QWORD PTR" to tell the program that this is actually a quad word.
The value stored here is a quad word, and "pointer" is just another name for address.
So what it's saying is that, go to this address because of the "WORD PTR,"
you know this is the address.
And then because of the bracket here, you know that this is a quad word.
So "quad word" means quad word,
that means it's eight bytes here.
So it's going to access all these values: 00000000001234.
So quad word is from here to here: eight bytes.
And then, so access the value stored at that address and then store it in -.
Click "OK."
Close.
So now let's put the breakpoint.
If you have not already done that, to toggle a breakpoint, just right-click and "Breakpoint," "Toggle."
I've already done that.
Now I run and it will hit the breakpoint.
Then I step over until I come to this line.
So now watch what happens when I step over this.
What it will do is it will go to that address,
fetch the value
00000000001234
and copy it into -.
So let's step over now.
And you see now - has got 1234.
So it has inverted the bytes here.
It was in reverse order: 3412,
but when you copy it into -, it is in the correct order: 1234.
You can also copy values into memory, for example.
For example, you can move a register value into memory, assuming you want to move the value
one from a register into memory, into this memory here, let's say.
So we copy this first—copy this address.
Come to this next line and then press spacebar and type "MOV."
Then you type "QWORD PTR 0x," and press Ctrl+V to paste this memory here, and then close
the bracket.
And then here you need to put the
-.
Because you are moving one to this memory address.
So let's close that now.
OK.
And close.
Now you see.
So now it is going to execute this.
So let's step over this and see what happens.
It's supposed to move one to this location here.
So let's step over.
And now you see one is there.
So it has actually moved all these zeros and one and copied here in reverse order.
That means from here, 01, to here.
So this is how you can make use of memory by copying memory to registers or copying the register
value to the memory.
Note that you can also move register to register.
So you can do stuff like this.
For example, "MOV"—
uh, let's say I want to copy 1234 to register -.
So I will do it like this.
-, -.
-.
So I "MOV -, -."
So I step over that now and I will see—
now - has also got 1234.
After that, I can copy whatever is in - into memory if I want to, just like what I did here:
- followed by memory,
like this.
All right.
Or I can even move something directly into a register.
For example, "MOV"—
let's say I want to move 4568 into -.
So I will do this: -.
Then
hex 4568.
OK, so I step over this now.
And you see we have 4568 in the - now.
After that, I can move whatever is in the - into this another location in memory.
Let's say I want to move—
I want to move whatever is in -.
OK.
So here it changes to - because the value is small: 4568. But actually it's -, not -.
Here it doesn't matter.
It's OK.
So over here, now let's say I want to move whatever's in - into this location here. I can do that.
So I right-click this, copy the address,
come over here.
"MOV" to - into the memory location, so it should be "QWORD PTR 0x,"
paste the address, and put your -.
So - has got 4568,
so all these 00004568.
This will be quad word—sorry, quad word.
Yeah.
OK.
All right.
So now I'm going to step over this.
See what happens.
We know that - has got the value of 00000—
all this—4568.
So let's step over and take a look at this location now.
Yes,
got 00000000004568.
So this came—all this thing here,
this quad word came from -.
Yes.
And before that, you moved from a constant to -.
And then now you moved - to memory.
So these are how we can intermingle registers and memory and register and register and constant
and register, and so on.
So these are what we can do using memory itself.
So now I'm going to show you how to save this file.
So when you have already made alterations by hollowing the .EXE and then injecting your own code inside
here, you need to patch it.
So when you patch it means that you are saving it.
So how do we do that?
We click on "File," "Patch File."
And then here are all the patches that will be made.
Click "Patch File," then—
now give a new name, so you can call this maybe "01_MOV_
Memory."
And click "OK."
So it has already saved your file into the new file name.
Now if you go to the location where you saved it, you can open it in x64dbg.
And now you can scroll down and see your new code over here.
See that?
And then you can put a breakpoint.
And run and step over.
If you inspect memory, select Dump 1,
go to "Memory Map,"
inspect the data segment.
You will see all your values there:
1234
that you initialized was there.
Yeah,
it's there.
All right, so step over.
1234 to -,
and then - is equal to one.
So you're going to move it to this address here.
Step over.
So now this address has got 01 which came from -.
Now we're going to move to -.
That means it's going to move 1234 into this -.
So step over and you can see 1234 in -.
Whenever something has been changed, it will be in red.
Now it's going to move 4568 to it.
OK.
Let's step over that now.
And you see 4568 now in -.
Now it's going to move - to this memory location, 403F0, which is here.
So let's step over this there.
So one thing you need to note: that even though this is the initialized data segment, you can still
write to it.
You can still write to it,
so it's OK.
Right.
But normally when we want to write something to a location, we will use the BSS segment.
But it also works for the data segment.
OK.
So it's fine.
So in this lesson, you have already learned how to access the memory itself,
and you also learned there are two kinds of memory: the initialized data segment and the variables, which
is BSS, the initialized data, and how to access it, and then how to also modify the memory itself directly,
and also how to use the instruction to write data into the memory itself, how to move values from one
register to another,
how to move the values from the register to the memory.
So that's all for this lesson.
Thank you for watching.