Hello and welcome back.
In the next section, we are going to get started with reverse engineering Windows executable files
using Ghidra.
But before we go ahead and do that, first we need to install Ghidra on Windows.
In the previous sections, we already did installation of Ghidra on Linux, and we installed Linux in a virtual
machine.
Now in Windows, we should also use a virtual machine.
So the technique for installing is exactly the same as for the Linux installation.
You should create a new virtual machine inside of the Oracle VirtualBox and install your Windows in
there.
However, the Windows that you install could either be an imported OVA file, or you could install from
the ISO image itself.
If you do not know where to get a copy of Windows, you can search the internet.
There are many downloadable Windows on the internet.
You could buy from eBay, for example.
Just head over to eBay and search for Windows 7, and there are many there.
So it is not a problem to get a copy of a genuine Windows 7 from eBay itself or other sources.
Now it is very important to use a virtual machine when you are doing reverse engineering.
Never do reverse engineering directly on a host machine. On the left side here,
when you download and install any kind of software, for example, a crackme or even a malware, for
example, when you are doing reverse engineering and analysis for malware, if you don't have a virtual
machine, you will install it direct on your host machine, and that is very unsafe, as you do not know
whether the tools and the crackme that you download are safe.
So always use a virtual machine.
The virtual machine on the right-hand side is depicted and shown as a sandbox.
So sandbox is like a safety lab where you can play and do anything you want with any kind of software
without getting infected by viruses or Trojans or ransomware and so on.
So always use a virtual machine. Install your crackmes and your hacking tools or cracking tools inside
the virtual machine itself.
The other benefit of virtual machine is that it acts as a sandbox, and you can easily reset it to its
previous state.
I already explained this in the Linux lectures where I showed you how to restore the snapshots, so we
can use this ability to restore the earlier snapshots to undo any kind of changes which the software
or the crackme or even malware has made.
For example, writing to registry, installing files, altering operating system settings, tampering
with files, et cetera.
Also, many reverse engineering tools and also malware or even crackmes which are not malwares can be tagged
as malware.
So sometimes you just do not know for sure whether a crackme which you download is really a malware
or not.
Most most likely it is not a malware, but just false positive.
But to get peace of mind, always use a virtual machine.
So having said that, just go ahead now and install your virtual machine.
I will show you how to install Ghidra on Windows in the next few lectures, and after that we can proceed
with the reverse engineering.
Thank you for watching.
I'll see you in the next one.