Hello everyone.
Welcome to this lecture.
The iPhone here.
And in this session we are going to get hands on with Ghidra and learn how to set up your first project.
You will also see how to import the binary and understand how Ghidra organizes and manages your data.
This foundational walkthrough will prepare you for more advanced reverse engineering work later on.
And here we have the GitHub project folder.
Right?
And one of the core differences compared to other reverse engineering tools is how it structures analysis.
Now if we run this ghidra.
And here, you know, active project here what you will see that it's called project.
And so rather than opening files directly like most other reverse engineering tools do, GitHub uses
a project based system.
Now this is a huge advantage when dealing with large project multiple binaries or collaborating with
other analysts.
Now to create a new project, we will go to the top menu on the file and new project, or simply use
a shortcut for Ctrl n this control and N here.
And after that you will see two options.
Also remember if you Google or DuckDuckGo.
Uh ghidra.
Cheat sheet and you will see the lots of keyboards here.
Oops.
Wait.
Yeah.
Now here.
Here.
Yeah, there's lots of options.
On keyboards and lots of information on that page.
And here you will be prompted to select between a non-shared project or a shared project.
Now for this example we will be working solo.
on.
So we will choose a Non-shared project and click next.
Now you need to give your project a name and names have to be descriptive like in programming.
We'll open the GitHub projects, select Project Directory and we will name the project as Hello World
and click on finish.
And here we have the Hello World project.
And if we go to this file and get our projects hello world.
Here you have you can see that we have one directory, two log files and one GPX file.
Now this is GR file like as the name implies.
Hello world that.
Is this is the main project file.
We have the folder directory.
If you come from the Linux side I use arch by the way.
So in this ref directory we have uh, this which stores all related metadata and analysis, uh, data
basically.
And this folder will get bigger as we analyze our project file or executable.
Yeah.
That's basically it.
And this log files, uh ghidra prevents simultaneous access to the same project by using this kind of
lock mechanisms where you can see also in the, uh, VMware virtual machines here.
Um, almost same.
We have that log file and we have the dot log file.
Um, but if we open this you will see the time a lot of information about how this work, uh, log file
happened.
Now, if you try to open this GPX file, log files are there.
Ghidra will detect this.
Lock and lock some symbol file and block duplicate access.
Now this ensures that your data is not accidentally corrupted during multitasking or teamwork.
And yeah, that's.
We have opened our project.
Uh, ghidra created project files and so on and so forth.
We have the active project hello world.
But we are missing something.
We need some executable file or binary file.
It doesn't matter.
Ghidra analyzes everything.
We need some file to analyze.
And now we will write some code with Visual Studio.
Like doesn't matter.
You can even use the text file of course if you have.
But of course we will need to firstly install the MinGW from the sourceforge download.
This will download the five seconds.
We don't have five seconds.
Life is short.
Yeah, I have deleted, but don't worry.
Yeah, we will open this.
Okay.
Here.
Run.
Install.
Continue.
Already in use.
Uh.
Run now.
So that's it?
It is installed.
Click on update catalog.
It will update it.
And what you need to install from this catalog is g, g c g plus, plus bin and dev two of them.
You don't know where you will need that.
And GCC.
This is the most important right.
That's it you know.
Or you can if you have a storage problem with you.
But you shouldn't because it will just take ten megabytes max.
You can install this GCC only.
It will work as well.
Now after that mark all upgrades and that's it.
This is installed.
So what you need to do after this installation process is you need to add this GKE to your environment
variables so you can run the GKE whenever you want like I did here.
And in order to do that we will go to system properties environment variables path.
That's it.
This is how easy this is as easy as it gets in installing GKE.
You don't need a 10 minute or 15 minutes lectures understanding or explaining nonsense.
This is like one minute.
I think that's it.
And what we need to do here is we will open VSCode Main.c in, and we will write some program now as
after installation.
Of course, you need to make sure that GKE is working on the CMD here, and you can check that by quickly
pressing GKE on CMD And version, you can see the mean.
GW.
Uh, this is a free software.
Nice.
And that's it.
So include, uh, we will write some hello world program and integer main and printf.
We will just print Hello world and New line.
And to compile.
Yeah we don't we don't want to return here.
So to compile the program using newly installed gcc we will save the code here.
Oops.
Hello world.
Yeah we will save the code and make GCC hello world dot c fatal input.
Yeah.
No this is a main dot c of course main dot C and output is going to be hello world dot exit.
We have error here.
Of course.
This.
Last line brought the Python code, so that's why I forgot here.
Hello world and exit.
That's it.
Now we will open this.
See, here we have hello world.
If we run this, it will quickly show the HelloWorld.
But what you need to do is open a terminal and hello world desktop.
Hello world dot x and you can see Hello World is written here without a problem.
That's the easy thing to do.
Don't worry.
And what you need to do then.
Now, now git run will.
We will go to here.
Open the git run.
We will click on file import file.
And that's it.
Now what you need to do you will know that we need to import this hello world dot exe file.
Uh, select file to import.
I will go up now and you can see it.
It automatically detected that it is a x86 32 bit windows PE which is basically means portable executable
and once detected.
You'll click on the okay to confirm the input F yeah that was quick.
And after that you will see the summary here.
Yet this might sometimes be problematic but yeah here we are.
And you will see the summary here.
Um yeah.
This will give you insights into the file structure segments and metadata.
You can see project file name read only.
It's not read only we can write this also.
Language ID windows endian is little.
Address size 32 bytes.
Memory blocks.
Instructions define data function symbols, data types.
Yeah, so on and so forth.
We have some lots, lots of information here, lots of executable location data created.
And yeah after this is just the import result summary.
Nothing special here.
But in some cases you will get pretty easy information here.
And that's it I will go down.
Unlike tools that focus on a single file analysis, Ghidra lets you work with multiple binaries at once.
Now you can import a main executable along with its supporting DLLs, configuration files or even firmware
images.
This is incredibly useful for complex projects where understanding across binary relationships is essential.
Now you can search across multiple files.
Link symbol references.
And organize your work in a modular, scalable way.
Now this project based design is one of the.
Greatest strengths compared to other tools, especially when compared to more like traditional tools.
And that's it.
In the next lecture, we will take our first steps into Getter's disassembler and Decompiler.
Now you will learn how to initialize, uh, initiate analysis, interpret the results, and begin navigating
a binary from a reverse engineer's perspective.
Thank you for watching.
I'm Typhoon and I'm meeting you in the next lecture.