Forum Discussion
DFIR CTF: LightNeuron DLL - Question 8
In relation towards finding the decrypted email. I am wondering about what I am getting wrong from the conditional breakpoint in order to expose all the decrypted strings after the return function
After searching up the XOR key location
I went to
from Ghidra
Through the RET function
which I thought would expose the strings
I ran
going to the ret function
then after following the process in order to go to the DLL malware
and got into the ret function
I set the breakpoint
and debug restarted
However, it kept saying memory address unavailable.
such as
this also includes setting the CF flag to 0
I am wondering about what I am doing wrong here and where should I dig deeper?
Note: used Gemini to help look into possible solutions however, refered to https://www.youtube.com/watch?v=Tc8Wl37uwYc for aid
1 Reply
- kevinhSilver I
Gemini also helped in dealing with offset memory issues as well and slight syntax adjustment as well using @ instead of :