Hello and welcome back.
In this video, I will introduce you to a powerful disassembler and decompiler known as Ghidra.
So click on the bottom left corner on the Windows icon and then search for Ghidra.
Click on the first result that you find to launch Ghidra.
Ghidra is now firing up.
It will show you a tip of the day.
Just close it.
And here is your window for creating a new project.
So now we have no project.
Let's create a new one.
Click on File.
New Project.
And then select Non-shared project.
Click on Next and then select the desktop folder where you have unzipped your malware.
So navigate to the malware sample three and select the project directory as malware sample three.
And in the project name you can call it malware three and then click on Finish.
Now we have a new project and you can see the folder has been created in Ghidra.
We can now drag our malware sample here and you can see that Ghidra has created a new folder and some
other files.
So we shall drag sample.bin into this project.
So drag it and drop it into this malware three folder.
And Ghidra will begin the import process.
It will show you that it has detected the format as Portable Executable PE and the language is x86 32-
bit Windows.
So just click on
okay.
And now it will load.
After a while, you will get a Windows security alert.
Just check both boxes and allow access.
This is normal.
Ghidra needs to use it and now it is showing you the import results summary and you can see that it
has
the name of the program,
the processor, the size, 32-bit program,
and so on.
Let's click
okay.
And now it has imported it.
We can see on top here, there's the tool chest and tool chest are the tools you can use to analyze
the code.
So over here, what we want to do is open this sample.bin in a code browser.
So let's drag sample.bin and drop it into the code browser.
And begin the analysis process.
Ghidra will then ask you whether you would like to analyze it now. Click on
yes.
And here you can see all the available scripts or analyses that can be used.
Do not change anything.
Just accept the default and click on the button Analyze and you can see the analysis process has begun
and the status will be showing on the bottom right corner of the screen.
This will take a few minutes, so you need to be patient and I will pause the video and come back once
it's done.
After a few minutes, it has finally finished with the analysis.
Now, on the left here, you can see the Program Trees.
And this is a listing of all the sections contained within the malware itself.
We have got the .text, the .data, the .rdata and .rsrc and so on.
And this is similar to what you saw when you used PE Studio or CFF Explorer. In the center panel is
a Symbol Tree, and this contains all the names that are found inside the malware or the software that
you are analyzing, and you can expand on them to look inside their group,
grouped according to directory. You have Imports.
Imports contain all the DLL files and the functions within them that are being used by the program.
And then Exports, those which are exported by the program.
In the Functions here, you can see there is one called entry.
So if you click on it in the center, in the Listing panel, this is called the Listing window.
You will see the disassembled assembly language.
And here is the entry point.
The entry point is where the program first starts when it runs, and then just below it, you can see
there's a call to __security_init_cookie.
This is a hint that you should look for when you are disassembling and doing the
analysis of the code.
And just below this call to __security_init_cookie, you will find a jump,
right.
And this is the jump that will take you to the main function.
Now, on the right here, you will find the Decompile window.
And this is where you will see the C language listing of the assembly code.
And this is not perfect.
Sometimes it could be wrong, but it is quite close to the C language.
So now in order to find the main function, we will click on the jump that comes after the call to the
__security_init_cookie.
So let's click on this to head over there.
And now we are in the function that will contain the main.
So on the right here, you will see that this thing also shows you the corresponding decompiled
code for this function.
And if you look here and scroll down, you should find one function which has got three variables,
three parameters.
And this is the one here, is called one, two and three.
This is your main function.
Normally it is just below, somewhere at the bottom, below the exit function.
So this is the main function that is always there for any Windows program.
If you want to know more about this, you can look up MSDN.
You head over to the browser and look for MSDN.
And you key in the Windows
just type MSDN Windows main function signature.
Again, I think this should be the one. Let's click on it.
And it will tell you what it looks like, the main function signature.
All right.
So the complete main function signature has got three variables: argc, char pointer argv and char pointer environment
variables.
So these three is a standard signature for WinMain for Windows main function.
So you can use this actually to identify your main function in Ghidra.
So when analyzing after entering the entry and you will scroll down and look for a function which has
got three variables, three parameters, one, two, three and that will be your main function.
So you can right-click and edit the function signature and you can call this main and
the faster way is just to paste what you have copied from the MSDN.
So one, two, three,
just paste it.
All right.
I can't paste because I copied from outside the virtual machine.
So over here I can change the signature.
The return type will be int. The first parameter will be the count,
how many variables, how many arguments you have in your Windows program.
Okay.
The first one is int argc.
Second is char argv, and third is char environment.
So this is what we are going to change to.
So the first parameter, you don't have to do this, but I'm just showing you so that you know how to
edit the signature of any functions.
So this one should be argument count.
The second will be char
pointer square bracket, but inside Ghidra you cannot use a square bracket.
Ghidra doesn't understand it, so you have to convert the square bracket into two stars in front.
And finally, the last parameter is your environment variable.
Just char env.
And this one will be a char pointer as well.
So this is how you can edit the function,
the signature of any function. Just click
okay.
Once you click okay, the name of the thing will be reflected here automatically and inside here as
well.
So you can click on this to view it here.
All right.
This is the one main. You can see that
so these are the parameters pushed to the stack.
We have three pushes
before a call.
All right, so here is the same three,
one, two, three.
Then you have a call.
So these three pushes,
one, two,
three,
one, two, three, then a call.
So this call main function makes use of these three,
one, two, three.
So this is your main function, right?
So now you've located main.
Remember, you always have three pushes before a call.
Or another way is you can look for a function which has got three parameters and that is your main function.
So now you can click on this and go straight to the main function and this is your main function.
And here also the Decompile window will change to show you your main function.
All right.
So this is your main function and you can scroll down and take a look at it.
And this is what it looks like.
At this stage, you can see that this is the main function and there are many other smaller functions
within it.
So normally we will investigate each one of it in turn by double-clicking and entering it.
So if you double-click and enter something and then you want to step out of it, you just have to click
the back button here.
You see, now you have stepped into it.
You want to go back, just click back and then you step out of this function to go back to the parent
function.
Now you're back in main, right?
And then you can also click on Window here and click on Function Call Graph to look at the graphical
representation of all these functions.
So Ghidra will show you the Function Call Graph.
So from main you have all the other functions within main itself.
This is one way to view it and you can zoom in and out by using your mouse to scroll.
And then from main you can see all the sub-functions within it.
And then each one of these you can again click on it to enter it and click on it like
this.
And then there's a plus there at the bottom.
If you click the plus, you will expand and show you what is inside this function itself.
And you expand to show you what is inside this function.
And you can see at the bottom here all the functions within it.
You can move.
You can just drag and hold with your left mouse and it will move like this.
Then if you click the minus
here, you can see a minus.
It will collapse it again.
All right.
Now, another tool you can use is this one.
Window and then go down to Function Graph.
Click on Function Graph and it will show you the graphical form in square blocks like
this.
And then here you can zoom in and out using your scroll wheel.
You can zoom in, you can move by dragging and moving around.
You can also move your blocks around by dragging the title bar of each block and moving it around so
that it can align itself to make it easier to view.
Like this.
And then here you can see the if-else blocks are clearly marked here like that.
And then at the bottom is an overview of your graphical view,
Function Graph view like this.
Okay.
Now then, this is a graphical view of your decompiler here.
For example, Function 3 is over here.
So basically you will now enter each one of these calls here to see if there are anything interesting.
Okay, so as you enter each one, you will find that there is one particular function which is interesting
and just click on it to go there.
And here you can see there is one function called IsDebuggerPresent.
So it appears that this malware is checking whether there is a debugger attached to the program.
So it returns the result in var1.
So if you want to know what IsDebuggerPresent does you can Google for it in MSDN using the method
that I taught you earlier.
So if the debugger is present, it will return true.
So true will be one.
If debugger is not present, it will return zero.
And here is a test.
It is testing whether the result is one or not.
If the result is not equal to zero, that means debugger is present and so it will pop up a message
box to let the user know that this is a third-party compiler,
AutoIt script and then it will go somewhere else.
But if a debugger is not present, then this will be false and then it will go down here and do what
it's supposed to do as a malware.
All right.
So we have to somehow change this to be false.
We don't want the malware to detect the debugger.
So in order to do that, we will need to use another tool called x64dbg.
x64dbg is a powerful modern debugger where you can modify the running program to change the value of
any kind of API which is running.
So to do that, I will show you in the next lesson.
Thank you for watching.
I'll see you then.