Now we can use our Ghidra to decompile those addresses where we found with x64dbg and Cheat Engine.
So we look for this first address, right-click, copy, and then in Ghidra hit G on the keyboard to open
the Go To.
And inside here, paste the first address and this address, and then hit on
OK.
And it will go to that address.
But you will notice that this location has not been disassembled yet.
So let's right-click and disassemble it.
Hit on Disassemble.
And now it has disassembled.
And you will see it also has the push - over here.
And if you scroll down to the second address, this one, there should also be a return.
So if you scroll down low enough, you should be able to see a return at this address,
40013A2E.
40013A2E, that's your return.
Okay, so those are the start and end of the function, so we can go back to the top here and then just
right-click and create a function here.
So now Ghidra has created a function,
call it FUN_0040393C, and then automatically it will have been decompiled for us.
So click on the Decompile tab here and you can see our function.
And now we can analyze using the decompiled window.
So we can scroll down and we can see there is an if statement and there is a good message showing here,
"Correct.
Thank you."
And there's a bad message showing here,
"Sorry, wrong key."
So we know that whether to show a good message or a bad message will depend on
uVar1. So we can relabel this.
Just press L on the keyboard, call it result.
Click on it and you will see that this is where the result is being set.
So this is probably a compare string function and it's probably comparing two strings.
Let's click on local_14.
local_14 seems to be reading a string.
In this one,
it looks like a password.
Double-click on this and inspect the window.
You can see
so it looks like a password.
So assume that it is a password, so we can
relabel this one.
Press L and rename it. So we can say this is a copy string,
copy
actual key string.
So you copy this password to local variable 14, local_14, so we can relabel local_14 as an actual key.
So click Actual Key.
All right.
And then
click on the other one here, and local_18 is over here.
So local_18 is
probably the
key that you enter. You see that param_1.
So, okay, we can rename it, label it as My Input.
So now we click on this and you can see...
Now we come back to our function here.
You can see it seems to be comparing My Input with the Actual Key.
We can confirm it by double-clicking this to enter the function.
And you can see there's compare strings functions.
Here is comparing string one, string two.
Param_2 is this.
Param_1 is this.
Click on the Back button.
One more time and you can see param_1 is My Input,
param_2 is Actual Key.
So go back inside, so we can relabel this as My Input.
And we can relabel this as Actual Key.
And then just click on this and see what's happening. Over here is assigning Actual Key to another string,
so we can relabel this as Actual Key
String.
And this one is assigned to another string,
so we can relabel this as My Input String.
And when you click on this now, you can see clearly it is comparing whether your input is an actual
key.
If your input is actual key, you return zero.
So let's see when it returns zero, what happens?
Let's click on the Back button.
When it returns zero, it will store in the result.
And if the result is zero, it will show you the good message.
So this confirms that this function is a check, check string function, so we can rename it, relabel as
Check,
or we can, better, better still call it Compare, Compare String.
Now we know for sure that this function is comparing two strings,
the input and actual key.
And that confirms that this Actual Key here, which is coming from this string here,
is the actual password.
So this is how we can use Ghidra and debuggers together.
Debugger does not decompile code, although x64dbg can do it, but the decompiler is not as good as
Ghidra.
So Ghidra is good at decompiling code.
And if you want to decompile code first, you can use debuggers to locate regions of interest,
locate addresses of interest.
And once you got those addresses, you can come to Ghidra.
And then convert the data to strings and create functions, and then you can decompile it and view the,
study the algorithm to derive the serial key.
That's another thing I want to share with you is a Windows graph,
Function Graph tool.
So you can click on, on the function here.
Let's rename this function as...
We'll call it Check_Serial.
Now you can use a window.
Click on Window, Function Graph.
And you will generate the graph view.
You can zoom in and zoom out with the scroll wheel of your mouse.
The center wheel scroll wheel, and you can drag to look around.
And bottom right is another way to view.
You can drag the square box here to move around.
In the yellow circle here denotes the function that you are analyzing, here,
looking at. Can scroll and scroll.
If you can't read the dotted lines, you can go here.
And then drag this thing out so that you can view the rest of the dotted lines.
If it's not enough, go back and do again.
Select the box that you want to expand on.
Go back up here and drag.
Now you can see the rest of the string,
"Sorry,
wrong key."
"Correct key."
If you pull this to the right, it'll be clearer.
The red line denotes what happens when the jump zero test is not true, and the green line denotes the
jump that happens when the jump zero is true.
So this is an if-else statement.
The gray-blue line is the unconditional jump.
And you can see from here that over here there is a compare string.
It is loading your password here, serial key, and then here, copy, copy.
And then here, compare.
There's a test.
And based on this jump, it will then jump either to show the bad message or jump to show the good message
over here.
So this is also a useful tool for visualizing and analyzing the code.
So that's all for this session.
Thank you for watching.