Welcome back.
Typhoon here.
Now that we have successfully imported your binary into Ghidra, it is time to begin the most crucial
part of reverse engineering, which is the analysis here.
In this lecture, we'll explore how Ghidra analyzes binaries, explain what each analysis option does,
and truly break down the code browser interface so you can confidently interpret and manipulate the
results.
We'll click on the Hello world!
At the.
You can see the launching tool, and once you import a binary ghidra prompts with the question hello
world has not been analyzed, would you like to analyze it now?
Always say yes.
This is where Ghidra begins to shine.
And this analysis process in Ghidra is not just the background tasks, it's a critical step that automatically
identifies The functions and their calling conventions.
Function parameters and stack variables.
Strings and constants.
Control flow structures.
Cross references between functions and memory locations.
Now with this analysis option windows appear.
You will see the long list of analysis modules, each one responsible for a specific type of analysis,
such as instruction decoding like the data references and symbol references and symbol recovery, and
so on and so forth.
Now you can enable or disable individual analyzers.
If you can see we have disabled the function start search after code analyzer and it also has description
here.
Now you can click on any analyzer enabled it right now.
So we can click on any analyzer and you see a detailed description in the upper right section of the
dialog.
And yeah, it also has the uh, we can also configure the advanced options such as heuristic behaviors
like the create local variables, create param variables, use new function stack analysis, and so
on and so forth.
So every analyzer has description and has its own options.
Now if you're not just getting started the default configuration is safe and effective here.
You don't need to change that.
But however, understanding these modules allows you to tailor guidry's analysis to suit specific binaries.
Now, for example, stripping symbols in a malware or non-standard calling conventions in an embedded
firmware will definitely help you.
And once satisfied, click the analyze to begin now.
You will now be redirected to Code Browser interface.
You can see in the loading file loading.
Here is loading I can I can make me smaller right now.
Yeah because I will use the almost whole window here.
Now you may ask what if I have like forgot something in the Analysis and analyzer page?
Now you can by rerun anytime navigating to analysis.
Auto analyze hello world detects in this case.
And you can see the same pain just appeared.
So don't worry about that.
And after analysis, you drop manchester's code browser your primary interface for exploring and interacting
with binaries.
Now, at first glance, the interface might seem overwhelming, but every component is there for a reason.
Now let's talk you through each part of the layout here.
Now at first we have the disassembly view.
This is your world.
Now this is your command center for raw machine level insights.
The disassembler shows instruction level output letting you follow the program's logic exactly the process
of the textbook.
We also have comments here.
And at the right side we have the compiler rule, which is one of the standard features.
Now this window provides high level of c-like pseudocode generated for the disassembly.
Now you may notice something weird.
Here it is synced with the disassembly window.
So selecting an instruction one will highlight its counterpart in the other.
This is all good right?
So this view is essential for simplifying complex assembly logic.
At the left side we have program symbol and datatype manager trees.
Now program tree we have this panel organizes the memory layout of your binary sections like Text data.
Our data and others are shown here.
Now use it to quickly jump between code and data segments.
See?
The lines here.
Learn more in the next lecture.
We have the symbols tree as well.
So we have I have back pain here.
So we have the symbols tree here as well.
This is a hierarchical listing of all symbols recognized in the binary encoding functions imports labels
and namespaces.
Also classes.
It helps you to locate specific code artifacts such as imported application programming interfaces or
global.
Oh.
This hurts.
Right?
Yes.
That makes sense, considering that our code is just up here.
And we have datatype manager at the bottom of the symbol tree.
Now, DataType manager allows you to manage and define the data types like structures, enumeration
types, typedefs and unions.
Now these types can then be applied to memory regions or variables for clearer analysis.
And here this here is our script console.
And this panel here houses few features.
How those two features.
The first is it acts as a script console which where Python or Java scripts run.
Now what?
JavaScript's not JavaScript.
Here it is a Java and script JavaScript.
It has nothing to do with reverse engineering.
And.
It also has the function of bookmarks, which lets you mark the address or name or category, which
is perfect for recommending malware behaviors or return points and functions.
And here also I want to get this end so I can explain it better.
Here.
So here.
We have the current address here.
Yeah.
This is our current address field which displays the address of the currently selected instruction or
byte as it changes in the press.
We also have another.
Yeah this is current function.
You can see it changes every time we go to different Functions here.
So go here.
And also here.
And here you are seeing the instruction contents of both here which shows the complete instruction line
including others mnemonics like keyword pointer and some others here.
Band capacitors and references as well.
Basically the instruction context here.
Now this field is context sensitive and updates dynamically as others are here as well.
And lastly we have the main toolbar.
Which is basically you are classic dropdown menu bar with access to our drop modules, file operations,
edit tools, analysis settings like so and understood in the previous lectures.
The beginning.
But it also has a search activities and search for the string school in this case and see how it goes.
But I am sure we have something called Hello World because as you remember, we have seen or we can
also filter it.
Hello!
And here we are.
We found the string.
And yeah, that's basically it.
So we also have the Google toolbar which provides access to those tools.
We have the creation commons and data changes and search.
But we can also search from there.
So what we have now together these components form the complete analytical environment.
And the more comfortable you become with navigating and organizing these things, the more efficient
your reverse engineering work for building.
Now in the next lecture, we will go beyond the default layout and learn how to customize it for for
for specific workflows including scripting support, plugin interaction and configuration.
And.
Now thank you for watching.
I'm peaceful and I'm meeting you in the next session.