Ghidra quickstart & tutorial: Solving a simple crackme

[@MrMasterRhythm]

Please create a series of Reverse Engineering Basics! Love this!

[@recklessroges]

Its like the perfect purity of a man page was compiled into a perfect video. Instructions so clear I accidentally cracked the travelling knapsack problem.

[@S00mbre]

Crystal-clear, methodical and systematic walkthrough! Thank you!

[@willmcpherson2]

Beat tutorial I’ve ever seen. Clear, concise and simple.

[@TheMadMagician87]

Excellent explanation. Clear, concise and a great pace, wasn't confusingly fast or laboriously slow. I hope you continue to make videos on Ghidra.

[@0xUltraHex]

4:07 "a small popup will show up." popup occupies most of screen.

[@l1703]

wow this tutorial is just perfect, the pace the explanations, everything ! Thank you

[@edgeeffect]

I had a quick look at Ghidra a few weeks ago and it seemed rather complex.... It certainly seems a lot less complex now! Thanks.

[@goosenp]

Brilliant "in a nutshell" tutorial of getting to know the program quickly. Could you please do a follow-up of the very same crack me, but with showing how you "crack" the crackme by patching the binary inside Ghidra so that it always jumps to the success condition regardless of the input given?

[@gilperon]

Wow is that even possible with ghidra?

[@zitronenwasser]

Gil Bytepatching should be simple, worst case you just use like a Hex Editor and jump to the offset and manually patch ig

[@hyronharrison8127]

@@gilperon its possible i. Gdb, i would hope so! :)

[@jtw-r]

love the “NSA-Mainframe” on your terminal. I let out a good laugh at that!

[@negritoojosclaros]

very good video! Im already applying for NSA!

[@bv1495]

Jesus you make it look so easy !! Love it ! Keep em coming my friend.

[@frederick3524]

You have 13.2K subscribers and only 3 videos from 8 months ago! This was such a great video, I was disappointed to see you didn't have more content.

[@tyrrelldavis9919]

Tech KZbinrs always have their view count scaled way down

[@frankdai]

"Let's maximize the window" > Actually makes windows smaller

[@ytxstream]

And that's Mac OS for you

[@Tedd755]

@@ytxstream ⌘ + ⌥ + d is your friend

[@The_Ballo]

@@ytxstream *Java's half-assed implementation of

[@powershellaxp64]

He actually just moved it to the right.

[@soulife8383]

^^ effing owned dude... 😅 By a Polock Frank... sick digs

[@datenraffzahn6094]

Many thanks for suggesting this software ... I wanted to look into reverse engineering for years, but had not yet come across such an handy tool. AIDA wasn't really affordable for experimenting ... Again thank you very much!

[@abanjoplayer]

This helped so much, the main thing I needed was just the fact that you can click on named functions in the decompile window to go to them. Seems obvious but I just didn't know!

[@اطلبالحقوالرحمة]

Thank you Ghidra Ninja. You are a true Ninja!!

[@juozasmiskinis3590]

Thanks ninja! A very well prepared video. Hopefully more will come :)

[@andreww3575]

Fantastic. Hopefully looking forward to more of the same.

[@theleopards4198]

amazing man keep uploading ghidra tutorials

[@magi-bv7nd]

very nice and efficient intro into ghidra gui

[@namenone8387]

wow, nice introduction man. looking forward for more videos from you!

[@dzikibill6756]

I love it , already subscribed !

[@urnan7499]

Jidra 😞😭 didnt think that video would stress me out this much 🥶🥶🤯

[@SaintSaint]

Watched first 11 seconds. subscribed. I think I'm only subscribed to a dozen people after over a decade of being on KZbin.

[@dsuess]

For future listeners, Ghidra is pronounced, "Gee-druh"; [3] /ˈɡiːdrə/[4]). Source: github.com/NationalSecurityAgency/ghidra/wiki/Frequently-asked-questions#how-do-you-pronounce-ghidra Great video, and well-explained usage. Keep up the great work.

[@somedude5414]

(Thank you classic Godzilla movies.)

[@mohd1501]

Liked your explaination, easy and clear. Keep going please.

[@mitfreundlichengrussen1234]

Thank you - and pls. continue the work. PS: made me smile.

[@MichaelJenkin]

Nice, I was looking for samples with known outcomes so I could follow the technique ! Awesome . (Mickyj Whitehat)

[@cvspvr]

you've literally got a black hat on. don't lie

[@valshaev1145]

Nice introduction! Had have no idea abut Ghidra ;)

[@encryptedmind6952]

awesome video man,keep doing more basic malware analyasis and reversing.Thanks:)

[@playnikko]

Great job explaining - thank you!

[@GajoFanatico]

Excelent. We want more!! Really good tutorials

[@drygordspellweaver8761]

Very cool, I LOVE Ghidra so far

[@nan6849]

Thank you for a great overview. I'm getting started quite easily because of this 👍

[@TheChecklists]

Your videos are awesome! Please keep making content like this!

[@AtlasMTBRider]

I remember solving that very same Crack me with Hopper. thanks for the video, I have not given GHIDRA a try yet. I'm still learning how to pronounce it correctly :)

[@micah9382]

It is pronounced "Gee-druh" (github.com/NationalSecurityAgency/ghidra/wiki/Frequently-asked-questions#how-do-you-pronounce-ghidra), but that's okay. This video was a very nice introduction, by the way!

[@arejay988]

awesome tutorial - keep them coming man!

[@NasirKhan-kh4zq]

Thanks for wonderful tutorial. Subscribed.

[@AterNyctos]

Extremely informative! Very good video!

[@Malaphor]

"Just hit okay because nobody reads those anyway" Well, I guess I'm a nobody.

[@EchoXIIIGO]

You sir are a thought criminal reading those agreements... tut tut..

[@MichaelJenkin]

@@EchoXIIIGO I do recall about 10 years ago, a very prominent software vendor had an Easter egg in the terms and conditions. something about giving away your first born and pledging elegance to satan. It took about 5 or more years for someone to finally read it and mention it. (Mickyj Whitehat)

[@thatcrockpot1530]

@benzo I highly doubt an opensource project would send data to the NSA, I feel like people are very aware of their role in the world, especially floss peeps.

[@bitterlemonboy]

You must know what you are agreeing to before you agree.

[@b213videoz]

In dialog boxes like that the only buttonnshould be renamed from "Ok" to "Whatever" 🤪

[@DrGenius13]

Thanks man. I enjoyed you cracking that.

Love this. Keep up the great content man

[@0xm3trix]

The video was very helpful, keep it up bro👍👍

[@ColtonSpears]

Looking forward to more videos like this.

[@heycherry100]

Good and fast introduction!

[@calmic9838]

How are you able to run the Unix binary file. Im getting: ```zsh: exec format error: ./rev50_linux64-bit```

[@zraphy-veo5551]

Oh my... this video is amazing! ❤

[@MySisterIsASlytherin]

nice intro! of course, there's any number of possible solutions given that the only criterion is an @ in 5th position

[@osamazaid25]

Great video. I learned a lot from it.

[@tomay3000]

Thank you, very instructive.

[@liberator48]

Can you explain what argv[0] is? If argv[1] is the array of arguments.

[@stacksmashing]

argv[0] is the program Name, 1 is the first argument, 2 the second argument etc :) So if you call “ls /etc” argv[0] contains “ls”

[@SoCalRobb]

Great content, subbed, keep them coming!

[@nan6962]

hello, i have followed the same steps as you but my main function looks different. and it says no function in decompiler. please help

[@christullier2410]

I'm having the same problem

[@userusms]

Thank you for the nice tutorial!

[@sahilshankar2769]

How do you get the Linux shell on the terminal?

[@stacksmashing]

It’s a SSH connection into a VM

[@sahilshankar2769]

Ah I see. Thanks for the reply

[@nuszkat9953]

Waiting for more videos from you.

[@buzifalus]

Great tutorial, kudos! Can you elaborate why is there an issue requiring the usage of a pointer to a pointer for argv ?

[@m4heshd]

What Microsoft did right is "Maximize" and the taskbar.

[@MiserableLemon]

my terminal doesnt allow me to open the crack me initially, you said you're using a VM, is that a different terminal than mac's default?

[@pouncerminned863]

Just curious as I just learned that this tool exists, what is difference using this vs ollydbg for cracking? Other than assembly

[@ryuhighabusa430]

What should I do if I don't have a main function? None of the binaries I'm examining do. I'm struggling to find guidance on how to pick apart real-world binaries using Ghidra.

[@varyktv]

Great video! You explain things really simply. One question I have: can you use Ghidra to compare two similar .dll written in C++ files to find the differences between them?

[@jwdsoft]

I hope that you create a beginner series in reverse engineering embedded firmware

[@happyked]

Nice video! Do you plan on making more? Id love to see more videos on Ghidra :)

[@cyberuser0]

that was really good, ty !

[@georgensa3942]

love it bruh... keep it up

[@shrutilondhe3401]

Hey when trying to search for main it doesnt show any results and the main function i guess in some format like FUN_11001 some numbers can you tell me some settings to resolve this?

[@Tecnoesclavos]

First Step. Error. Invalid Function Signature Can't parse name: argv[] Do you want to continue editing or abort your changes?

[@stacksmashing]

Set it to char ** argv instead of char * argv[] That’s also how it’s in the video in the second step - I assume [] is now reserved

[@Tecnoesclavos]

@@stacksmashing yep it works, thank you!

[@stacksmashing]

No worries :) hope they eventually support that syntax

[@fade242black]

Great video. Keep it up!

[@karimessalim]

Great job

[@nxxxxzn]

very thorough. thanks

[@rfeil8443]

Could you please make a tutorial on how to skirt the Mac OX Catalina 10.15.8 and download Ghidra? I really want to start using Ghidra but my mac will not allow the Javascript updates ...

[@DonaldOfEarth]

Thanks for sharing! What do you use to show your keyboard input?

[@stacksmashing]

It's a tool called Keycastr

[@DurgaPrasadPandeyBCE]

@@stacksmashing why am i getting this error ? /ghidraprojects/rev50_linux64-bit: cannot execute binary file

[@victors8718]

That's a great tutorial man ,thx!

[@kokop1107]

Great video. But could you make a video comparing Ghidra to IDA or some other RE tools?

[@XxManagedxX]

Excellent video! Is there a way to isolate and tag raw binary into separate chunks? For example if you read an EEPROM and load it in Ghidra as raw binary can you then split it up into prgrogram, data, etc so that decompiler can make sense of it?

[@gamingSlasher]

Very nice. Great tutorial.

[@gabrield6425]

Thank you for this video!

[@NotAViper]

Very good tutorial

[@loremipsum5697]

THANK YOU FOR DOING GOD'S WORK!

[@jaybailey216]

Kind of a dumb question but how did you get your keystrokes to show up on the screen like that?

[@bennguyen1313]

Is there a way to find what part(s) of the program are referencing a data-text string? I've tried doing a global search of the address, but where can I find the functions that use it? I've looked at the tutorial 'Z0FCourse_ReverseEngineering' from stryker2k2/ wolfshirtzlabs but don't see that covered! Very new to this, would OllyDbg or IdaPro be more beginner friendly?

[@tyrrelldavis9919]

I'm a normie, no govlarp here, IDA is the only one I've heard of, Would be interesting to see how file analysis programs are built from scratch, as well as what language they would have to use to build a file analysis tool like ghidra or IDA Ghidra is kind of esoteric, IDA all the normies like me will recognize I know the govlarp people like using python

[@SolomonUcko]

There should be a list of "X-REFS" on the far right of the listing (you might need to scroll horizontally). There should also be a right-click option to show/list references.

[@tokayevkz]

hi! can you reload crack me file? link is down

[@stacksmashing]

Will do later today!

[@avtem]

Great video! Do you know how to hide the project window? i'd love to hide that window once i ran the code browser

[@osamaalbahrani]

Great tutorial!

[@shredder3034]

what if you wanna change code and bypass if clauses?

[@pswalia2u]

awsome tutorial !! only issue why we changed char* argv[] to char **argv ??

[@stacksmashing]

Because Ghidra unfortunately does not support [] in the function signature - so instead of saying 'this is a pointer to an array' we say 'this is a pointer to a pointer', which gives us the result we want :) (Simplified: Working with an array in C is basically just pointer-arithmetic in the background)

[@rosyidharyadi7871]

I come here only to see what the heck ghidra is. I know nothing about reversing, executables and stuff, and I never use Mac in my lifetime, so please forgive me if my question is so stupid. 0:26 Can you really run linux elf binary on Mac?? Or have you done some "hack" before to make it possible?

[@gilperon]

Great Job! Keep up please.

[@dvarshanidze]

./rev50_linux64-bit: cannot execute binary file. I use mac m1. what to do in this case.

[@wutangdaug]

Hello Ninja. I wonder how you secure your MacOS environment from the malware you analyzing? Seems like you are not running a virtual machine, then how do you isolated your machine?

[@einsteinx2]

Songchen Han In this case he’s analyzing a Linux binary, so it physically cannot run on macOS so there is no concern there. Same if you’re analyzing Windows malware on macOS or Linux (yes it may run under Wine, but you’d have to do that manually and it most likely wouldn’t work anyway). Also even if it was Mac malware, or if you were running Linux or Windows and analyzing Linux or Windows malware respectively, as long as you don’t execute the file it can’t do anything to your machine. Now with that said, if you’re analyzing malware at all, I agree it’s probably best to always do it inside a VM with networking and file sharing disabled just to be safe. Of course if your just reversing some normal software you don’t need to worry about any of that.

[@wutangdaug]

@@einsteinx2 OMG you are so sweet! That is a very good detailed explanation I could ever expected, that is very kind of you. I see, we can still reverse software/malware without of running environment. Huh, I ask because the only reverse engineer I do is the buffer overflow attack with requires the application to run and interact while monitor the registers and such in Immunity Debugger. I guess this is different from just purely "Reverse engineering". I am so happy I learned something today, thanks Ben!

[@einsteinx2]

@@wutangdaug Glad to help :) Yes exactly, when reversing with Ghidra, it's doing a disassembly and decompilation which is a static analysis. It never actually runs the binary. That's why he's able to analyze a linux elf on macOS, as it doesn't need to be compiled for that OS or even for that CPU architecture. He could just as easily be reverse engineering some ARM linux firmware or something. It's basically the same as looking at the file in a hex editor, except it's doing the extra work of converting the machine code into assembly and then a step further into C code which you can then annotate and comment to better understand the code flow. If you were to want to then use the information you learned from Ghidra to modify the binary for example to change a command and control server address or something like that so you could do some dynamic analysis by running it and viewing it's network traffic in Wireshark for example, then you would definitely want to do that in an isolated VM. But all Ghidra is doing is just looking at the bytes, it's not executing anything (unless it has some dynamic analysis features I'm unaware of).

[@wutangdaug]

@@einsteinx2 Thank you sir! I think I am more interested in the latter(modify the binary or control address). I guess that is dynamic analysis then. What tools you recommend for dynamic access then? Immunity Debugger/IDA PRO for windows, GDB for linux ?

[@wutangdaug]

@@einsteinx2 Also, do you have a twitter or something I can follow?

[@juliproo3962]

hi i have a problem: i the analyse just does not start! and if i want to select it from the menu it is gray. can someone help me please? note: im using windows 10

[@geocine]

are you planning on doing a course series for this? I would buy it

[@zakmods]

How do I find a specific word on windows I press ctrl f and it skips lines?

[@KenaS11]

Hello, loved your tutorial! Do you know if Ghidra has the ability to view embedded image files?

[@stacksmashing]

Thanks! Yes it does, and they’ll be marked as a bookmark

[@KenaS11]

@@stacksmashing Thanks!! Yep I see them all in bookmarks, now I need to figure out how to view them!

[@stacksmashing]

Just double click on the bookmark, and the picture should be in the disassembly view

[@pastuh]

Interesting why it throws error: Invalid Function Signature But you edited at 06:37 without problem.. Maybe new version is aware it must be array :)

[@letsplayer9558]

How can i fix this error? I'm at the moment a noob at programming.

[@tyrrelldavis9919]

@@letsplayer9558 the LARP groups are showing people how to use this shit lmao, hire me LARP people, I don't second guess stuff when I know what the shot is

[@anntakamaki1960]

Nice video, but I have a question. Is it possible to get the flag without putting the password? Since the flags stored somewhere within the file, right?

[@k0tigrun]

What VM do you use for running Linux code in OSX?

[@ashokvj8342]

Thanks man for the knowledge you are awsm