Hello and welcome back.
Now that you have installed two versions of Ghidra on your computer, one for Linux and one for Windows,
which one should you use when you are reversing binaries?
So this is the lecture where I am going to share with you
reversing workflows.
So for Linux binaries, you have to run it on the Linux itself.
So Linux binaries are also known as ELF files.
So to test the binary, you will run it on Linux, and then when you are reversing, on the right is a diagram
for reversing.
You will also reverse it on Linux using the same machine that you are using for running the binary files.
However, when you are testing Windows binaries, you have a choice.
You could run your .exe on Windows and then reverse it on Linux.
Or you could run it on Windows and reverse it also on Windows.
So you have an option here.
So coming back to this diagram, Windows binaries are executable
files known as PE files.
Just like for Linux, they are known as ELF files.
So on,
for Linux, you will need to run the binary on Linux, and then that's it, reverse it on Linux as well.
But for Windows, you have a choice.
You can reverse the Windows binary using Ghidra which is running on Linux.
Similarly, for the case of Linux binaries, you could also reverse the Linux binary using Windows which
is running Ghidra.
Coming back to this, in both situations, whether or not you are using Ghidra on Windows or Ghidra on
Linux, you would typically use virtual machines.
This is especially so for those executables running on Windows because malware typically targets Windows.
So it is strongly advisable to run your PE files inside a Windows virtual machine.
And I've already shown you how to do that in the previous lecture.
So now you have an overview of the workflow.
Sometimes I will be running the reversing on Linux, sometimes I will run it on Windows.
So this is all I want to share with you in this video.
Thank you for watching.