Forum Discussion

kevinh's avatar
kevinh
Silver I
1 hour ago

DFIR CTF: LightNeuron DLL - Question 8

In relation towards finding the decrypted email. I am wondering about what I am getting wrong from the conditional breakpoint in order to expose all the decrypted strings after the return function

After searching up the XOR key location

I went to 

 

from Ghidra

Through the RET function

which I thought would expose the strings 

I ran

going to the ret function

 

then after following the process in order to go to the DLL malware

and got into the ret function

 

I set the breakpoint 

 

and debug restarted 

However, it kept saying memory address unavailable.

such as 

this also includes setting the CF flag to 0

I am wondering about what I am doing wrong here and where should I dig deeper?

Note: used Gemini to help look into possible solutions however, refered to https://www.youtube.com/watch?v=Tc8Wl37uwYc for aid

1 Reply

  • Gemini also helped in dealing with offset memory issues as well and slight syntax adjustment as well using @ instead of :