Welcome back.
In this video, I will show you how to analyze the binary.
So double-click on this to open the C1 binary, and it will show you the code browser.
Go to the functions folder of the symbol tree and scroll down and double-click on main.
So now we can drag this and resize so that we can have a better view.
And you can see from here that this is the main signature for the main function of a C program.
The main function will accept two parameters, argc and argv.
Let me just refresh your memory about C program functions.
This is how a main function signature looks like.
The first parameter is argc.
argc means how many parameters are there?
For example, if you were to run this program, you can click on the tab up here for the window that
we initially opened.
So when we run this program, C1, there are two arguments.
C1 is the first argument, and the parameter is the second argument.
So argc is two.
That is the meaning of argc.
The second parameter is a list of strings.
So it contains a list of the arguments.
So in this case, example here, the first argument is the name of the binary, which is argv[0].
And the second parameter is the first parameter to the argument to the binary itself.
So if you were to use the example just now, argc and argv,
okay,
argv[0] will be C1.
argv[1] will be three, two, three, two, three.
Okay.
So this is how it works.
So over here, we can see that the signature is wrong.
It's supposed to be like this.
So we have to edit it to change it.
Just right-click on this, Edit Function Signature, and we can change the signature directly to argc, argument
count.
And for the second one, we will change it to
char
*argv.
So the two stars,
that means that this is an array of strings to correspond with this.
So these two are equivalent.
We can't use the square bracket in here, so we need to put two stars in here.
So now it's correct.
Hit Enter.
Click
Okay.
And you can see now it's correct.
And then over here also, you'll notice some other changes that reflect this thing.
Now, if I undo this, you can undo it by Ctrl+Z.
You can also undo here.
And redo here.
So before I renamed the signature, it was like this, hard to read and makes no sense.
But when I
added the signature to become the correct main program signature, this name makes sense.
So you can see here, the program here is comparing whether there are two arguments, right?
If there are two arguments, then it will enter the loop,
enter the block here, and the first thing it does is to get the length,
get the length of the password.
So this is the password that it is looking for.
So we know that this is a length, so we can rename it. Right-click, Rename Variable.
The shortcut is the L key.
Then we can rename it as length.
So now it's easier to read.
Then after that, once it's got the length, it's going to strncmp.
strncmp,
so if you don't know what this means, you can always refer to the Tutorials Point
and search strncmp.
And you can click on the first result, and you can read all about it.
strncmp
compares two strings, string one and string two, up to the N number of characters.
So if you specify three characters, it will compare three characters here and here.
And this example,
so in this case, we have two strings, string one and string two. String one is lowercase a, b, c, d,
e, and f. String two is uppercase.
So when you call strncmp, it is comparing the first four characters of string one and string
two.
So it is comparing a, b, c, d from here with A, B, C, D from here and returning the result.
If the two strings match, it will return zero as a result.
So zero means the strings are identical.
If the strings are not the same, it will either return less than zero or bigger than zero.
So this is how strncmp works.
Now, applying this knowledge to our analysis, the strncmp here is comparing the user input
argv[1] with the password and is comparing for the length.
So the length of this password is provided by strlen.
So the length should be 1, 2, 3, 4, 5, 6, 7, 8, 9, 9 characters, nine.
So it will grab the first nine characters of your input, argv[1], and compare it with the nine characters
from "hackthis".
If they are identical,
then the result will be zero.
So we know that this is the result of the strncmp.
We can relabel it by right-clicking and Rename.
Then we can call it result.
Straightaway, it's easier to read, and if the result is zero, that means the user has entered the correct
password, and so it will print, "Correct! The password
was %s this whole time."
All right,
this is a format specifier in C language.
So whenever you see percentage S, it means that it will substitute this variable inside here and print
the original password in here.
So let's try it out now, so we know the password must be this.
So let's go to our terminal and try it out.
So now they're going to enter this, "hackthis".
hack
this. Then you hit Enter, and it prints out,
"Correct!
The password was hackthis this whole time."
So this string is coming from here, and this %s is coming from here.
So this %s is the password itself, which is argv[1], which you entered up here.
So argv[1], argv[1] is the argument to the binary.
argv[0] is the name of the binary itself.
If you had two parameters, then the second argument would be argv[2], argv[0], argv[1],
argv[2].
This is how the second parameter works.
All right.
So now we have solved C1, and this is basically the technique of analysis in Ghidra.
We will try to analyze the decompiled code and rename the labels until it makes sense.
So now this is almost like the original decompiled code of the original C program itself, and it's
much easier to read than the assembly version.
And so that's all for this video.
Before you close, click on Save.
Click on Save,
Save All.
Okay.
So when you close this and reopen again, all your relabeled items are still there.
It has not lost it.
So if you go back to the functions, main,
and reopen main, you will see that the renamed labels are intact.
Right.
So that's all.
I'll see you in the next one.
Thank you for watching.