DFIR CTF: LightNeuron DLL - Question 8
In relation towards finding the decrypted email. I am wondering about what I am getting wrong from the conditional breakpoint in order to expose all the decrypted strings after the return function After searching up the XOR key location I went to from Ghidra Through the RET function which I thought would expose the strings I ran going to the ret function then after following the process in order to go to the DLL malware and got into the ret function I set the breakpoint and debug restarted However, it kept saying memory address unavailable. such as this also includes setting the CF flag to 0 I am wondering about what I am doing wrong here and where should I dig deeper? Note: used Gemini to help look into possible solutions however, refered to https://www.youtube.com/watch?v=Tc8Wl37uwYc for aid I have also tried to run to the function but for some reason it the instruction keeps catching it and making a return away from the malware by setting breakpoint towards there but I keep getting lost on how I could actually breakdown the return and evasion techniques. Wondering where should I be digging more to learn how to investigate this process despite the amount of returns stopping the function
Microsoft Defender for Cloud
Anyone having issues with the collection? I am receiving messaging that I am not licensed for it, but as a "Super" admin, I am thinking that the collection is actually down for maintenance. I have checked with a few others who are also at Admin level and they are seeing the same thing. Just making sure I did not consume too much eggnog yesterday....
