WEBVTT 1 00:00.770 --> 00:01.100 OK. 2 00:01.100 --> 00:01.820 Welcome back. 3 00:01.820 --> 00:04.550 Now we are going to kill the second nag. 4 00:04.550 --> 00:08.060 So make sure you make a copy of this and put here. 5 00:08.060 --> 00:16.340 So we delete this, make a copy of this and put here, and rename this to become the original name so that 6 00:16.340 --> 00:20.090 we can use back the database for our debugger. 7 00:20.750 --> 00:22.760 So we restart this now. 8 00:23.450 --> 00:24.080 Um. 9 00:25.420 --> 00:25.870 OK. 10 00:25.870 --> 00:26.470 Restart. 11 00:26.680 --> 00:30.310 Make sure you hide the debugger and debug on. 12 00:33.970 --> 00:35.020 And then you run. 13 00:35.020 --> 00:42.520 You hit our first breakpoint, right-click, graph it and Step Over until the second nag shows. 14 01:00.050 --> 01:01.850 This is the first nag we've already patched. 15 01:08.500 --> 01:14.890 And now we are coming to our -, is running for a moment. 16 01:14.890 --> 01:16.090 Let it come back to us. 17 01:16.090 --> 01:21.100 It is coming back now, so continue to Step Over. 18 01:26.710 --> 01:31.090 OK, so this nag was shown after I stepped over this line. 19 01:31.360 --> 01:32.440 This is the second nag. 20 01:32.440 --> 01:38.320 Sorry, I didn't manage to capture that on the video, but if you keep on stepping over, it will come 21 01:38.320 --> 01:38.920 to this line. 22 01:38.920 --> 01:41.440 And when you step over this line, it shows this nag. 23 01:41.440 --> 01:46.060 And I put a comment there. You should comment out, you should patch this one. 24 01:46.060 --> 01:46.570 All right. 25 01:46.570 --> 01:53.470 So what we do now is we right-click, Follow in Disassembler, and we just patch this line. 26 01:53.470 --> 01:59.620 If you try to patch these three lines, it won't allow, it will say that's an error because of some 27 01:59.620 --> 02:03.070 relocation error. 28 02:03.070 --> 02:05.230 So I just patch this one line. 29 02:05.230 --> 02:05.830 Let me show it. 30 02:05.830 --> 02:08.890 Let's say I try to patch these three lines, see what error we get. 31 02:09.730 --> 02:11.590 Binary, NOPs. 32 02:12.130 --> 02:15.910 And when I try to patch it, I get this error. 33 02:16.150 --> 02:17.860 See that? I click Patch. 34 02:17.860 --> 02:19.000 You see all the blue ones? 35 02:19.000 --> 02:20.620 They are the errors. Don't allow. 36 02:20.620 --> 02:22.270 It doesn't allow you to patch those. 37 02:22.390 --> 02:28.540 So what you do is Restore Selected and just patch this one line, this one line. 38 02:28.990 --> 02:30.580 So select this one line. 39 02:30.580 --> 02:33.130 Right-click, Binary, Fill with NOPs. 40 02:33.130 --> 02:34.120 Click OK. 41 02:34.240 --> 02:35.560 And this is the second nag. 42 02:36.820 --> 02:38.230 Now we patch the second nag. 43 02:39.360 --> 02:41.700 And we call it dash two. 44 02:45.730 --> 02:46.660 Dash two. 45 02:46.660 --> 02:47.650 Click Save. 46 02:48.370 --> 02:49.180 Click OK. 47 02:49.210 --> 02:53.350 Now we can close everything and make sure Process Hacker is running. 48 02:53.350 --> 02:55.060 And now we test our second. 49 02:58.920 --> 03:01.500 OK, running, as you can see here. 50 03:02.160 --> 03:10.500 And wait for the window to show, and it goes straight to the main window. 51 03:10.530 --> 03:13.170 The first nag and second nag is already done. 52 03:13.170 --> 03:14.730 We have already defeated those. 53 03:15.270 --> 03:17.490 That means we have successfully removed these two nags. 54 03:17.550 --> 03:20.370 Now it's showing this main window. 55 03:20.700 --> 03:26.070 Now, what happens when I click OK here in the main window, it goes to show the third nag. 56 03:26.070 --> 03:30.210 So this is the third nag here, which only shows up after you have patched it. 57 03:30.780 --> 03:32.970 So this third nag will not go away. 58 03:32.970 --> 03:38.070 If you click OK, it will come back after a few seconds. As you will see, it's coming back. 59 03:38.070 --> 03:43.230 So we need to use the Process Hacker to kill it. 60 03:43.830 --> 03:44.670 Terminate Tree. 61 03:44.820 --> 03:45.390 Terminate. 62 03:45.840 --> 03:49.830 So now our next, next video, we are going to remove this third nag. 63 03:50.400 --> 03:51.750 So I'll see you in the next one.