Now.
Welcome back everyone.
Typhoon here again.
Now in this lecture we will explore how you can personalize and expand Guitarist Interface to suit your
workflow as well as uncover some of the more powerful, but sometimes hidden features of the guitar
offers.
By the end of this lecture, you will be able to unlock parts of the tool that many users overlook or
don't know, setting you apart as a more efficient and capable reverse engineer.
Now, guitar layout is well organized as you've seen in previous lecture, but it doesn't have to stay
that way.
You can fully customize the interface to match your preferences.
Now let's start with the basics here.
Now if you go to window and choose your desired pane.
Now this menu basically allows you to toggle visibility for different windows such as for example,
function call graph or Decompilation graph or console.
Now your workspace is your design basically.
So if you click on console and it will sometimes like shake it a little bit and tell that the console
is already here.
But if you close this now you can say console is gone.
Now click on Windows Console.
And here we have the console here.
That's as easy as it gets.
Now this menu also allows like um we can see the PC code.
We were like the register view and so on and so forth.
So let's actually open the register manager.
Yeah.
Now Ghidra also lets you tweak the disassembly listing itself.
Now look to the upper right of the disassembly window.
You will find this small icon that opens the disassembly Layout editor.
And if you look at this, the you will you can see here that you can add or remove fields like this
address.
If you want to add this address here or opcode settings, you can move it like that.
Or like we can also choose the operands to make it more on the left side of the bytes.
Yeah, but this is best.
The default is best.
Always uh, is best.
But it's good to know.
And this, uh, feature is, uh, particularly useful for users who want a streamlined view when analyzing
deeply nested or repetitive assembly logic.
And as you can see here, that's it.
And we also have the PC code here.
So, uh, one of the most powerful internal tools is its use of intermediate representation, known
as p code.
Some call it p c code, but it's not a PC code, it's a p code.
Now this allows Ghidra to abstract away architecture specific syntax and analyze binaries in a normalized
format.
Now, to enable p code or PC code in the disassembly view, open the layout configuration again.
Let's actually close it.
Open the layout configuration again.
And here.
Oops.
Yeah.
Here.
Functions plate adds to the brick.
Now we can instruction and data.
And here in the P code we will let's make it the left side of this File.
And here we are.
Now, P code isn't the most human readable format I can say that, uh, but it is ideal for scripting
and tool development, especially when creating platform independent, uh, logic.
And we also have the graph view, uh, which is basically.
Like uh supports control flow visualization through its graph view.
So this feature helps you see how code branches like loops and inter interacts at the function level.
Now to enable it navigate to the function here and click the graph Icon here.
Now you can see it's location is not defined right now, but.
Let's make it P squad button here.
Close it.
Make it smaller.
For the data part and graph.
Yeah it's undefined now.
So here we have found the string.
It is also undefined.
And here we have the graph basically.
Now this here opens visual node graph where you can follow paths and call relationships.
Now it's particularly helpful for malware analysis obfuscated code or just understanding complex logic
here.
Now you can see it's a callback.
And this will be useful in our next lectures as well.
So we will use it a lot.
And we have a world of features which you haven't touched yet.
So what we have shown here is only a portion of what Ghidra can do basically.
In fact, we have barely scratched the surface of Ghidra here.
So it has plugin support, version tracking, collaborative projects.
It also has API for scripting in Java and Python.
So these advanced tools will be introduced aggressively as we explore particular use cases like we can't
do much with the Hello world application.
It has no sense, right?
It just gets the variable source in this printf and just prints it.
There's not much we can do about this, but this code will help us to understand the how GitHub works
better.
But in the next lectures we will use it with real world examples on the malware analysis or general
reverse engineering codes.
Now in this lecture you haven't learned much compared to the first two lectures of our course.
Um, but um, you see that you saw that Ghidra is customizable, customized, customizable, uh, which
will be useful in particular cases.
You also learned how to modify the disassembly listing and enable the p code.
And, uh, we used this graph here you can see.
And here you can see we have a lots of graph.
So if we make it now you can see it's a divot.
Basically print gets this hello world print.
And.
Here it's a signal call.
Yeah.
Now these features are the building blocks of your personalized, uh ghidra workflow.
Mastering them will allow you to reverse engineer with more speed, precision, and insights.
Now.
Thank you for watching.
In the next lecture, we will dive into the Ghidra scripting.
How to automate tedious tasks, build your own tools, and level up your reverse engineering game with
Python or JavaScript, not JavaScript.
Again, Java based scripts.