Hello and welcome back.
In this video, I will show you how to step into functions and also how to step out of functions,
how to do commenting, and also how to convert hex into decimal and show it inside the disassembly as
well as the decompile view.
So let's open our home folder.
Open the session
one folder.
And then this is the crackme we are going to do,
C5.
So let us first run C5 and see what it does.
Right-click and select "Open terminal here."
And then run C5 without any parameters.
It will show you a message,
"C5 ."
This is something like usage, telling you how to use the program.
So now you put in a zero.
Let's say we put in one, two, three, four, five, six, seven.
It is "bad ."
So now we know the behavior.
We can start to analyze it.
I will import it into Ghidra.
It has been detected as an ELF file,
64-bit assembly binary. Click
Okay.
This is the import result summary.
Click on
Okay.
And then drag C5 into the code browser.
To begin the analysis, click on
Yes.
And click on Analyze.
Watch the bottom
right.
It has finished analysis.
Now head over to the Symbol Tree panel and expand the Functions folder and click on the, exit main.
Click on the main function.
Let's edit the function signature. Right-click and select "Edit Function Signature."
Let's change the first param name to argc,
and change the second param to
char star star argv.
Click
Okay.
On line eight,
it is checking whether your argument
count is not equal to two.
If it is not equal to two, then it will call a function called usage, followed by argv star.
argv star argv is argv[0], and that is the name of the binary itself, which is C5.
Let's analyze the output again.
In this run here, we call C5 without supplying any parameters.
So argv,
so argc will be one.
So if argc is one,
this will be true.
And so it will then call this usage function, supplying the name of the
program itself, which is C5.
So now if we wanted to step into this,
we can just double-click on it.
And we have entered the function itself.
So this is how you step into a function.
And if you wanted to step out of the function, we can use this back
button here, and the shortcut is Alt+Left Arrow.
So if you click on this now, we come back out of the function.
So let's go back inside again.
We know that this one is argv[0], which is the name of the program itself, which is C5.
So let's step into it now.
And this one here, since we know that this is argv[0], we can rename this. Right-click and rename the variable
as argv0.
And this one,
we know it is a char pointer,
char string.
So we can right-click and retype the variable as char star.
And hit Enter.
Now you see in the block of code itself, it calls the printf function.
And the first parameter is percentage
s, is a format specifier.
It will substitute the percentage s with the argv0 which you supplied to the function.
And since we know that argv0 is C5, so it will take C5 and insert here and then print out the whole
thing.
So this is how we get this message,
"C5" followed by "."
And then it will exit, passing negative one as the exit value.
Normally, zero, negative one is error, zero will be success.
So it will exit this without continuing the rest of the program.
Now we can go back, back again.
Sometimes you might need to hit the back button a few times to step out of the function.
That is because the back button detects how many times you left-
click on the mouse.
So for example, if you have entered the usage function and click somewhere else in here, then it
will count how many times you click in here, and then you have to click the back button that same number
of times to get back out of it.
So if we know now that this usage function is just to show you how to use the program, now we can write
a comment to explain that.
In order to write a comment, we can right-click here and then select "Comments,"
and then select "Set."
And you can also click "Pre Comment" for the decompile window.
The only comment we can set is a pre comment.
So click on "Set Pre Comment," and you can see here there are several tabs. Pre comment has been preselected
for you.
So here we can type a pre comment saying that we try to explain this function.
So we can say "shows usage:
C5
."
Now when you click Okay, you can see the comment there.
The comment is also reflected in the disassembly view over here: "shows usage."
Now we are not able to enter an end-of-line comment or plate comment inside the decompile view.
If you wanted to delete this comment, just select this,
right-click and go to "Comments,"
and then here "Set Pre Comments," and delete everything.
If you delete everything and click Okay, the comment is deleted.
So I'll just undo that to reinsert this.
To undo,
just hit Ctrl+Z on your keyboard.
You can also undo here,
Edit, Undo.
Now there are other comments, for example, plate comment and end-of-line comment.
Let me show you.
But plate comment and end-of-line comment can only be inserted for the disassembly view.
So if you wanted to enter a plate comment, you can select a location in your assembly view.
For example, if you wanted to add a
plate comment, it looks like this.
An end-of-line comment is a comment at the end of the line.
So for example, if I wanted to add a comment here,
so I will select this one, this call, right-click and then "Comments."
I can set plate comment.
I can also select "Set," and then from here choose the plate comment.
And so I say, type plate comment.
And then click Okay.
And now you see a plate comment here.
Plate comment does not appear in here.
Even if you were to insert a plate comment here, it would show up in here instead of in the decompile
view.
The other comment is the end-of-line comment.
So if you want to add end-of-line comment at the back of this line,
this is an end-of-line comment.
So if you want to add an end-of-line comment here, you can right-click, "Comment," select "EOL," and "End of Line
Comment."
You can also select "Set" and choose "EOL."
And then here you type in your comment and click Okay, and you have your comment.
Notice that your comment also does not appear in the decompile view.
If you were to try to set an end-of-line comment here by doing this and "Set" and set the comment here,
it will only appear in the disassembly view.
It won't appear here.
So for the decompile view, decompile panel, you can only set
pre comments.
You can't set other comments.
So if you want to undo a plate comment, just select the plate comment and go to "Comment," "Delete Plate
Comment," or you can click on "Set," select the plate comment tab, and then hit the backspace to delete
it.
And the plate comment is gone.
Similarly, if you wanted to delete the end-of-line comment, just select, right-click the end-of-
line comment, and then go to the "Comments," and then "Delete End of Line Comment."
Or you can go to the "Set," and then choose the tab for EOL, and then hit the backspace button to delete
it.
Click Okay, and end-of-line comment is gone.
So this is how you insert comments into your code browser workspace.
So in this video, this is where we will stop.
Now I will show you how to continue with the analysis in the next video.
Thank you for watching.