Hello and welcome back.
In this video lesson, I'm going to outline the workflow.
So the workflow is like this.
I will provide the files for you to practice on, and you can download the file.
After you download the file, you will have the files named C1, C2, C3, C4, and C5, and there will
be more as we go along.
We will then copy all these files.
Every one of them.
Cut it, and then create a folder inside the desktop.
And then inside here, we call the folder Session One.
And then inside, we paste all the crackmes.
Next, we head over to Kali and then go to the shared folder.
This contains Session One.
We will then cut
the whole folder and put it in our home directory here.
Paste it here.
So now we have Session One in our home directory, and we can close the Linux folder.
So these files are crackmes written by somebody called Robert.
And this is the website where I got it from.
Robert.
And these are the files that I downloaded from his GitHub.
So to start off, we are going to try to reverse C1. Before we reverse anything,
we want to try to run it, so we can right-click here, open terminal, and then we can try to run C1.
Okay.
If we LS, we can see there are five files there.
To run C1,
just type C1, press Enter, and it asks you to supply the password.
So this is a command line program. To supply the password,
you must type C1 followed by the password, and you get the answer: wrong answer.
Wrong answer.
If we use one, two, one, two, one, two as the password,
so you have to keep on going until you get the right password.
Still wrong answer.
So now we are going to reverse it.
So to reverse C1, we open our Ghidra.
Click the terminal, go to the Ghidra folder, which is in the opt directory.
And you can see ghidraRun is there.
Then type dot forward slash ghidraRun.
And press Enter, and it will fire up.
Ghidra. Once Ghidra starts, you can close the terminal, leaving this terminal open.
Click on Close.
Now we create a new project file.
New project.
Create a non-shared project.
Click on Next, and the project home directory,
click on the three dots and navigate to our home.
Click on Home.
Click on Session One.
Click on Select Project Directory.
Session One is our project directory.
Then we give a name,
project name:
Session One.
Click Finish.
Now we can import the files into Ghidra.
So the first file we want to try is C1.
So you just go to the location of C1, drag and drop it in here, and Ghidra will import it. It has detected
that it is an ELF file.
ELF file is a Linux binary, similar to Windows PE file, and it has detected this file, and program name is
C1.
So now we click Okay, and it will load it.
It will import it. After importing,
it will show you a summary.
The name of the file,
the name of the program, the language,
and then over here, processor, and so on.
Now click Okay to dismiss this result summary.
Next thing we want is to analyze it using the code browser, so we can double-click on this or drag it
and drop it in the code browser.
It will then try to analyze the file.
C1 has not been analyzed.
Would you like to analyze it now?
Click on
Yes.
And you will use the scripts in this list here to analyze.
So no need to change anything.
Just click on Analyze,
and you can see on the bottom right the progress.
And it has finished analyzing.
Now, this is the Ghidra code browser, and you have a few panels.
Top left hand is a program tree.
The program tree shows you the entire summary of the binary itself and the various sections.
The second panel is your symbol tree, which contains all the functions as well as other symbols,
libraries, imported libraries, exported libraries,
functions, labels,
classes, namespaces.
And the bottom panel shows you the data type.
And we can use this to make sense of the various structures inside the binary itself.
And in the center panel, we have the disassembly listing.
And this is what it looks like, the disassembly for the binary itself.
And you will notice that it contains the first column will be your memory address, followed by the bytes.
And then you will have other information like symbols, as you can see from here.
And all of this can be renamed as you analyze it.
You will rename so that it makes more sense and easier to read.
On the right panel is your decompiler window.
This will try to decompile the code in here into C language, and bottom is a console for scripting.
To start off, we want to look for the main function.
So we go to the functions symbol tree,
the functions folder, and expand it.
And then we scroll down and start looking for function main, function main, and click on it, and it will disassemble
and show you the result here,
the main function.
It will even give you a C function name, and on the right here is a corresponding decompiled version
in C language.
This main here refers to this main, which refers to the entire code starting from here until the return
at the bottom here.
Then you start another new function here, all the way to the end of the code here.
Then start another function
here, and on and on.
So each function that it has detected, you can click on it and view it
in the decompiler view.
So basically, this is how you use Ghidra.
And on top here, there are other features which you'll be using as you go on.
So that's all for this lesson.
I just want to introduce you to the workflow that we'll be using when doing reversing, and after doing
the analysis, if you want to close it, you can click on the X here to close it.
This will ask you whether you want to save. Click Don't Save or Save.
It's up to you.
So you click Save, and now your project is saved.
So this is how we use Ghidra.
So we will continue with the reversing in the next lesson.
I'll see you then.