Hello and welcome back.
In this video, I'm going to show you how to reverse C2 and also how to configure Ghidra to highlight
all similar selected labels.
I have my Ghidra open, so I'm going to drag C2 into the Session
One.
It has detected the format to be ELF file and also 64-bit program.
Let's click
Okay.
And this is the import result
summary.
Compiler ID: GCC, little endian,
and size 64-bit.
Let's click
Okay.
I am now going to analyze it.
Just drag C2 into the code browser and release.
Ghidra
asks, "C2 has not been analyzed.
Would you like to analyze it now?"
Click on
Yes.
Ghidra will use all the listed scripts
to analyze. Click
Analyze.
No need to change anything.
In the bottom right corner shows you the status of the analysis, and it has completed.
Now go over to the symbol tree panel.
And look for the functions folder.
Expand on the functions folder.
And scroll down to look for the main function.
Click on the main function.
Ghidra will show the disassembly view in the center panel.
And in the right panel is a decompiled view in C language.
The parameter for the main function is wrong.
The signature is wrong.
We are now going to correct it.
Right-click on the main function and select Edit Function Signature.
Change the param1 signature to argc
for argument count, and for param2,
let's change it to an array of strings.
char *
*
argv.
Click
Okay.
Now we will notice the updated changes propagated to the parameters as well.
Over here,
in this line,
we see that it is comparing
the program command line
to see whether or not there are two parameters.
So let us try to run it first and see what it does.
Click on the terminal to open one.
Close that.
We will use the
file manager over here.
Right-click on this.
You can reach this folder by clicking on the home button on the home icon and then selecting the Session
One folder.
Double-click on it.
To open a terminal in this location,
right-click and select Open Terminal Here.
We can now run C2.
Without any parameter,
it will display a message saying, "Please supply the password."
We are now going to supply
a parameter of three As, and we get a different message saying, "We never use a password that short."
So let's give it a longer password and hit Enter, and it now says, "Wrong answer. Try again."
So let's head back to the code browser.
You can select the code browser from here and scroll down and select code browser.
As you can see,
argc is testing whether there are two parameters.
In this example here, there is only one parameter, so argc is one.
So in this case, because argc is not two, it will not execute this part.
Instead, it will go to the else part and puts a string.
puts is a function to print a string.
It is also known as put string, hence puts for put string.
It will put the string, print supply,
"Please supply the password," which you see here. In the second run,
we supply a password AAA, so this time argc is two because there are two arguments.
So it will enter the if block here instead of the else part here.
It will then use the strlen function to calculate the length of the input.
The length of the input is stored in argv[1].
argv[1] is referring to... argv[0] is referring to the name of the program itself, which is C2.
So if we wanted to extract what the user typed in, you must specify argv[1], which is here,
argv[1].
So that is the meaning of the second parameter to the main function.
So it will calculate the length of the parameter and store it in this variable as var_2.
So we know that var_2 is a variable that stores the length.
Therefore, we can rename it. Just right-click on this variable and select Rename Variable.
Alternatively, you can also press the L key on your keyboard.
The L key is a shortcut for renaming variables.
Just click on this, and now you can rename it to something meaningful.
length.
Now when reading this line,
it is easier to understand the code.
Now when you click on length,
this part is not highlighted.
It would be nice if all the length were highlighted
so that it is easier for us to do analysis.
You can normally highlight all the similar variables by the middle mouse button, but sometimes it doesn't
work.
So in order to fix that, we want it to highlight all the variables that we selected
by using the left click instead of the middle mouse click.
To do that, head over to the Edit menu and click on it, and then select Tool Options.
Over here,
scroll down to
Listing Fields
folder and expand on it.
Down here,
scroll down and look for the property called Cursor Text Highlight and click on it.
On the right, you will see that
there is a
few settings that you can set.
The first one is to enable Cursor Text Highlight and the color that you want to use.
And the third line shows you which mouse button to use.
Currently, it is set to middle.
Click on the list box here and select left.
And then click Apply.
You can also restore the default settings if you so decide.
Now click
Okay.
This time when we click on a variable or a label, it will highlight all the similar variables inside
the code listing.
So this is how you can set Ghidra to highlight all similar selected labels.
So that is how we do this,
and I will stop here for this video and continue with the analysis of this code in the next video.
Thank you for watching.