Hello and welcome back.
In today's video, I'll show you how to get started with Windows Ghidra.
Before that, go ahead and create a new folder called Ghidra Projects, and inside it create a new sub
folder called gcm-1, and download this from the resource link that I provided for you, and
put this crackme inside this new subfolder.
This is a GUI crackme, so let us run it first and see what it does.
Now enter any kind of serial key and click on Check, and you get the bad message.
So this is the behavior.
Now we are going to reverse this
crackme.
Now in Ghidra, click on the File.
Click on New Project.
Click on Next.
And then click on the three dots.
Navigate to your new folder.
Ghidra Projects and select this folder called gcm-1, and click on the Select Project Directory.
Give it a name called gcm
-1, and hit on the Finish button.
Now we are going to import this crackme into Ghidra.
So drag and drop it into this new folder.
And it has detected the PE file format.
Click
OK.
And this is the summary of the import process.
Click on the button
OK.
Now we can start analyzing.
Drag it into the dragon icon.
And it will open up the Code Browser and ask you to confirm if you want to analyze it.
Click on
Yes.
And then in the list of analyses,
check this box,
Decompiler
Parameter ID.
And then scroll down and uncheck PDB Universal.
PDB is a debugger file that is generated when you create a program.
Now, only the person, the programmer who writes the program, will have this PDB file.
If you downloaded a program or crackme from third-party sources, you will not have access to
this.
So we will assume that we don't have access to this PDB debugger file.
So we uncheck it.
And then check this one,
Windows PE. It will propagate the external parameter and make it easy for us to analyze data.
So click on Analyze.
And keep your eye on the bottom right corner, which shows you the status and progress of the analysis.
After about one minute, the analysis is now complete.
The thing I want to do now is to set the preferences.
So go to Edit, select Tool Options, and then select Listing Fields.
Listing Fields.
And then inside here, look for Cursor Text Highlight.
And then here the default is Middle.
So change it to Left.
Similar to what we did for the Ghidra on Linux.
So click
OK.
Look for the Functions folder and then look for main.
But you won't find any main because this is a GUI program.
So look for Entry Point instead.
There you go.
Entry Point.
So the Entry Point is the thing that runs before main.
But in GUI programs, there is no main.
Even though you can find the entry, there is no main.
But it does have a Win
Main. WinMain is the entry point for Windows GUI programs.
I will also put this link in the resource file that you download.
So this is the signature of WinMain.
But sometimes you won't find it inside the code listing.
So on the right, you go to the Decompiler window and look for Entry.
There it is.
And then if you scroll down looking for WinMain, you might not find it.
One clue of where WinMain could be is just after the function that gets all the environment variables.
So you get command line here.
So this could be it.
Let's check it out.
Yes, this is it.
So this is WinMain, and you can see the CreateDialogParam, then ShowWindow.
So when this ShowWindow API is called, it will display this window.
This is the meaning of ShowWindow.
So this must be WinMain.
Add the signature.
So we can go to
the documentation for WinMain.
You should not copy the semicolon at the back.
So you might want to do this instead.
And leave out the semicolon.
And then right-click, Copy, and head back to Ghidra.
And then right-click on undefined, the undefined function, and select Edit Function Signature.
And now here you can just paste in, right-click and Paste, or Ctrl+V to paste what you have
just copied, and then remove the API in front.
So once you've done this, make sure there is no semicolon at the back here.
Click
OK.
And then for this one, you can just accept the default as string pointer,
window string.
Click
OK.
And so now you have the correct signature for WinMain.
You can see here this is a while loop.
Typically, Windows will have a while loop where it keeps on parsing or scanning for the inputs from
the user and then checking whether it's a message dialog.
And then after that, if it is a dialog message, for example, if you use your mouse and click on
these windows with the mouse, it will translate it using the TranslateMessage function and
store it in the Windows structure called MSG.
And then it will dispatch it.
It will dispatch it to the callback function.
But here you don't see the callback function.
So callback function is not visible here.
If you have done some Windows programming, you will know, you will recognize this kind of code.
But we are not going to use this to solve this challenge.
Instead, we are going to search for strings.
So look over here.
This is the bad message,
Wrong Key,
Try Again.
Go to Windows Menu and select Defined Strings.
And it will show you all the strings that have been found while doing the analysis.
So you can scroll down and look for the bad message, which is this one: Wrong Serial Key,
Try Again.
Or you can filter it out from here.
Type "wrong."
And there you go.
Wrong Serial Key,
Try Again.
Sometimes you might not be able to find it in the Defined Strings window.
So if you don't see your strings here, for example, if it's Unicode, you might not see the strings
here.
You might or you might not.
So in that case, if you don't see it here, go to Search, use a different tool called Search, and then
select For Strings, and then here
I accept the default,
which is switched on and loaded blocks, and click Search, and there you go.
You get another
result here.
If this window doesn't pop up in here, sometimes you might, it might be a
floating window like this, for example.
And you want to dock this window in here, you just drag
the inside blue bar, not the outside one, the inside blue bar.
Drag it to the right here and let go.
And then you will dock it here, and you will have the tabs showing you all the windows that you've
docked.
Right.
So
you can use the result of the search here and filter out.
Sorry.
And there you go.
So you have two ways of searching for strings.
One is you use Defined Strings, which is coming from Windows,
Defined Strings.
The other way is to use the Search for Strings, and you will find it here.
So now you can double-click on this and go to the location of the string, which is here.
Wrong
Serial Key, Try Again, and then you will find the cross-references to the function which makes use of this
string.
So you can just double-click on this cross-reference, and it takes you to the code listing,
the function.
Scroll up and you will see the function.
This is a function from 0x401090.
So the moment you see this in the code listing, it will also be displayed in the Decompiler view.
So click on the Decompiler tab here.
And this is the function.
All right, so this is a main function.
You can rename it as main.
And in here you will see the GetDlgItemText is a Windows API to extract whatever the user has
typed.
And then if you scroll down, you will see the MessageBox for good message.
And the MessageBox for the bad message.
So whether you're showing the correct key or the wrong key, it will depend on the result of
uVar3. So uVar3 is the result of your comparison.
So this is a comparison loop which goes through the process of comparison.
And it looks quite complicated.
It is actually doing some kind of string comparison between the actual password and what you enter.
So if the comparison shows that the key that you enter is the same as the actual key, then uVar3
should be zero.
Then only it will show the MessageBox.
Now another way you can view this whole function main is to use the Window Graph.
You can hit on the Window and go down to Window Function Call Graph.
A new Function Call Graph will then
do a graphical analysis and show you from a high-level point of view what your call stack looks like.
So your call stack started with WinMain, and then from WinMain you call your main, which is this
one which you just renamed.
And then from this main function, you have all the subfunctions within this main function.
For example, GetDlgItem is this one, and PostQuitMessage is somewhere down at the bottom.
And then MessageBox would be this MessageBox inside here.
And sometimes it can even expand further.
If you have a plus icon and a minus icon, if it's a minus icon, you can collapse the parent.
And if you click on the button minus, you collapse the child.
So it's quite a good tool for visualizing your call stack.
Sometimes you can also use this to trace the parent.
Okay, now that you have the decompiled main here, you can scroll down and analyze the code.
You can see here that it is having a GetDlgItem
Text API to read what the user entered, and you can check out MSDN library by going to Google Chrome
and search for GetDlgItem
Text, and click on this result.
So this one will read in the string and store it in here.
All right.
This is the handle to the window that you are trying to read.
And then this is the string that stores the item.
This is a data item referring to the text box.
So you are storing your text in the third parameter.
One, two, three.
So when you come back here, you see,
so this parameter, one, two, three,
the parameter contains your string.
This is what you entered.
All right.
And interestingly, if you see on top here, pcVar4 is the actual password, right?
It looks like the actual password.
So you can rename it.
This one is the actual key.
This is just an assumption.
So even if it's just an assumption, you just go ahead and rename it.
So this local, the default is the third parameter,
one, two, three.
So this is your input,
my_input.
And then it starts in here.
You can also rename this.
Right-click and Rename, or just press L on your keyboard, and we'll call this pointer.
Pointer is just a memory address, pointer to my input.
Underscore my_input.
See.
So actual key here,
my input here.
And then if you go down further,
it is trying to extract some things.
You don't have to understand every single line. Just from the high-level conceptual view is good enough.
So just by looking like this, you can see it is taking your input and using it in various places and
doing some kind of string operation with the input.
So even if you didn't understand every single line, still you can more or less guess that they are
comparing these two things.
So this makes it very highly likely that this is actually the actual key, right?
And then based on this, it will then store the result of your comparison, probably in this uVar2.
Because at the end, after doing all this, it was going to check whether your uVar2 is zero.
That means this one
probably we can rename it now as the result.
Right-click, Rename, result, and hit
OK.
So if your result is zero, then it will show you a good message, right?
So from here you have a very good basis for suggesting that this is your actual key, so we can test it
out. Now we can go to our crackme and test it out.
So we just run our crackme and then try to enter the password.
So from here your password is "cracking_lessons."
So we just copy it.
And right, just right-click and Copy.
And then from here we right-click and Paste.
There you go.
So we have solved this crackme by reversing it in Ghidra.
Before we leave, I want to show you another useful tool.
Under Windows, you can also look at Function Call Trees here.
So when you do Function Call Trees, it will show you two panels at the bottom.
On the left is your incoming call, and on the right is your outgoing call.
The outgoing call is all the functions contained within the main.
So you can see here, main, and inside it you have all these outgoing calls or outgoing functions like
memset.
Memset is over here. MessageBox here.
So should be down here somewhere.
You got a few MessageBoxes here, and then GetDlgItemText is found here, and so on.
And on the left panel is your incoming calls.
Incoming calls list all the parents for main function.
That means the other functions which call main, for example, WinMain.
And this tallies up nicely with our graph.
So we go back to graph here. Windows and click on Function Call Graph, and you can see WinMain is a parent
for main.
And compare it with your call tree. WinMain, incoming, incoming reference.
So WinMain is the parent.
You are here: main, and this is WinMain.
And then down here is your outgoing calls, and you can compare with the right panel.
Outgoing calls are down here.
So there are two ways to visualize your call stack.
You can use the Windows
Function Call Graph, or you can use the Windows Function Call Tree from here.
Windows
Function Call Graph or
Function Call Trees.
These two are quite useful.
The other one is Functions itself.
You click on Functions.
It will list all the functions that are available in this whole program.
This function can also be docked.
You can pull it out from here.
You can pull it up to the top,
and so it will become floating.
Or you can dock it back in here by pulling the inside bar, not the outside one,
pulling the inside bar and pulling here.
And it will dock here.
One, two, three, four.
So these are all the main things you can use.
So in this lesson, you have learned quite a lot.
Yes.
You learned how to identify the Entry Point for Windows GUI programs, how to use the search string,
search for Defined Strings, and also for using the String Search method.
Also, learn how to use the Function Call Tree and Function Call Graph, and also how to understand
and search for Windows API and understand it.
So that's all for this video.
Thank you for watching.