Simple Tools and Techniques for Reversing a binary - bin 0x06

[@Bubatu7]

Hahaha, "press shift+r and be happy." Great tutorials, you make it look so easy! Thank you!

[@0x90meansnop8]

Dude, I'm really thankfull for your videos! As a selftaught coder it's sometimes hard to move on when there is nobody around you to help you out. But the biggest struggle I faced was not the code by itself. It were mostly the tools i had to use and I had no idea most of them even exist. Thank you very much for this video. This will help me to learn a lot faster than I did before. You're awesome.

[@0x3b]

for real

[@mosesnah2893]

how can these wonderful tutorials only have 4000 views? Cannot believe Thank you so much for these super awesome & helpful videos :)

[@LiveOverflow]

thank you! If you think it deserves more views, please share it. I'd appreciate it :)

[@AhmedJadelrab]

I think because there are a few people who understands what he is talking about.

[@twistedsim]

x10 views in 1 year, not bad

[@DigitalMonsters]

To be fair this stuff is super esoteric. I get that these tutorials are aimed at beginners but it still assumes an absurd level of computer competency from the outset. I'm a recent Software Engineering grad and I feel completely out of my depth. I need to find an even more "for dummies" series than this and maybe then I can come back to this.

[@LiveOverflow]

I would like to make videos that help people on your level. I’m wondering how I should approach it. Any ideas or examples? Wanna write me a mail LiveOverflow at gmail?

[@muffawuffaman]

" for a full list of commands see 'strings /dev/urandom' " oh boy this is one long help file

[@cocbuilds]

I haven't read a single help file yet. They're all like 50 pages worth.

[@jacobtungate3828]

@@cocbuilds issa joke because urandom is just random characters

[@blueairwolf1]

RTFM -read the fine/f*ck!ng manual :D

[@dox432]

strings objdump strace, ltrace Hopper Disassembler (other disassemblers include Ghidra, IDA Pro, and Ollydbg) radare2 (cutter)

[@Hackers-df5fm]

i've been trying to master radare, its been 2 YEARS!! also, great explanation of disassembling and decompilation of binary!

[@TheGimpyGus]

I was really keen to get into this kind of thing for a long time, your tutorials are amazing, honestly thankyou!

[@Ebotchl23]

If you are doing this in 2020 and want to move the nodes around you need to first toggle into graph cursor mode with "c" and then you can move nodes around. Shift + hjkl while not in cursor mode will just allow you to jump around visual mode faster.

[@madisonhanberry6019]

I've been looking for a reverse-engineering resource like these videos for years! Please make more!!!

[@lars-magnusskog3983]

Just a quick note that the r2 commands has changed quite a bit from 2016 to 2020. E.g. the help in visual mode is quite a bit more extensive.

[@gtg7529]

Dear, although i only can understand less than 50% of your video, your are a very amazing guy! Thanks for your videos and i watch your each video more than 3times to try to understand what you say...

[@ricardobrito6868]

WOW! this radare is better than jdb when stepping instructions... You can see it stepping in the graph! Really good!

[@zeynarz7614]

God Bless you for making this series. Thank you so much.

[@b0nes95]

I don't know how I'd live without my trusty companion, CTRL +R.

[@connormcneill9024]

"for a full list of commands see `strings /dev/random`' i c wat u did ther

[@elatedmaniac]

Literally learned more in this 12 min video than two months of class.

[@Salmiery]

This was a great overview of these tools and techniques. Keep them coming!

[@omri9325]

Can you use Hopper to crack Hopper?

[@douwehuysmans5959]

Yes

[@asjidkalam]

Yes indeed.

[@4pxris3]

never thought about that

[@lmaoroflcopter]

Yes. But it's

[@sarahtonin58913]

_HMMM_

[@b00i00d]

Great vid! Makes you work to get to every last detail and that's the real fun of it!

[@darshannn10]

the way he says "Press Shift +R and be happy" 😂😂

[@typedeaf]

I am really impressed and inspired by the advanced content of the newer videos. The completionist in me has to start with your first videos :D I wonder if you use radare now.

[@dastrn]

I'm really enjoying these videos! Thank you for putting them together. Please keep them coming!

[@HoldFastFilms]

Great video. That was very helpful! Keep it up.

[@Tzeny15]

Keep these kinds of video coming!

[@RoughSubset]

KZbin removed episode 0x07 in your playlist :/ Any chance of making it available via other platforms?

[@TNothingFree]

radar seems like windbg, it is great for developers especially C/C++ devs to learn such reversing tools.

[@rastakiwi3899]

Hello. I understand why there are blue numbers that can't be traduced to ASCII, but do you know why there are untraductable Hex marked by ^ while some are marked by ? Why isn't written for example? It is confusing :0. Thanks!

[@fluzzlesnuff]

This probably isn’t useful to you now, but for anyone wondering this in the future: ASCII values 0-31 are ‘control codes’ and can usually be typed with the control key plus a letter or special character. The control key is often represented by a caret (^). So ‘^C’ means control-C, which is ASCII value 3. Vim tries to print unprintable bytes as control codes, so any byte less than 32 will print as a ‘^@‘ or similar. Bytes larger than 127, though, are not in ASCII at all, so they are printed as or whatever hex value. TL;DR: Bytes < 32 are printed as ‘^C’ (control code), bytes > 127 are printed as ‘’ (hex code).

[@MrRavenVZ]

Very good quality content, thank you!

[@alojzybabel4153]

03:15 Is there some way to distinguish user code from those unknown library functions if they were statically linked into the executable and all we know is some random addresses? :q That would save a lot of time when analyzing programs because I would not have to try cracking the code that later tunrs out to be some library code irrelevant to the logic of the program :q

[@dewankpant]

I have a question when I try the same thing with hopper. I am not able to get those neatly formatted strings with characters, rather what i get in the pseudocode is the locations for those strings. is there any such option that you have enabled?

[@TempestFrenzy]

I'm confused as to how you determined 0x4006da contained the key at 4:45 in the video. Can anyone explain this part to me please. Thank you in advance and love your videos so far LiveOverflow :)

[@elianagriffith9510]

Because that memory address was very big. 400 bytes. That's a lot of characters to be simply code.

[@compilationsmania451]

Look at 4:27. The rodata section starts from 4006c0 and it's size is 4e, so it's range is from 4006c0 to 4006c0+4e. When we run till the string comparison and print addresses in the registers, 4006da is the only address which belongs in that range. So, we deduce that it must be the address of the string because we know the string is in rodata section.

[@kvsec1337]

This is superb😁❤️ thank you very much uncle !

[@nukexplosion6679]

Awesome stuff! Thank you for making these tutorials for us

[@olfmombach260]

I just can't get the string from the address like you did at 4:35. When I stop at the breakpoint and look at the registers, they all point at a completely different location (except eip of course) and also don't hold strings. I'm on x86 btw.

[@abhishekpandey71]

watching this in 2022, awesome... thanks man.

[@bartlx]

Thanks for making this great tool referencing video

[@anteconfig5391]

how well does objdump show the assembly for the given hexcode. Also does objdump reliably output the proper assembly instructions for non-ELF file formats?

[@awesomedee5421]

Thank you. I am one of those people who thinks Mac sux, so I subscribed because you showed linux.

[@day1player]

This video is utterly hilarious. Thank you very much!

[@lovelygirish2242]

Beautiful stuff

[@dodochi79]

Very impressed!

[@saeedradmehr1976]

I found this one specifically helpful, Thank you!

[@linuxguy1199]

BTW there is cutter for radare which is a free graphical frontend for it

[@drwblkfact7286]

Can someone explain why register rsi is important and why it had the string AAAA-Z10N-42-OK in it? Is it common for the rsi register to hold the the comparing string when the function strcmp is called ?

[@kosmasraptis8374]

Usually this happens for no specific reason. The rsi register just seems to be available at that moment so the compiler puts the line there.

[@first-thoughtgiver-of-will2456]

Thank you this is very helpful for my research.

[@caydauden]

Question at 4:19, you mentioned main should start at 0x4004d0 and we should be able to find this in the screenshot on the right, but in screenshot on the right, main starts at 0x4005bd? Also, .rodata starts at address 0x4006c0, so we would expect the license string to be at that address, but at 4:45, looks like license string is located at address 0x4006da instead?

[@caydauden]

I see, the binary code starts at 0x4004d0, which starts with other functions before "main": _start, deregister_tm_clones, register_tm_clones, __do_global_dtors_aux, frame_dummy, and finally "main" starts at 0x4005bd which is within the range (0x4004d0, 0x4004d0 + 0x1e2)

[@caydauden]

Also see that .rodata has this data, which also includes the license key at address 0x4006da: (gdb) x/10sb 0x4006c0 0x4006c0 : "\001" 0x4006c2 : "\002" 0x4006c4: "Checking License: %s " 0x4006da: "AAAA-Z10N-42-OK" 0x4006ea: "Access Granted!" 0x4006fa: "WRONG!" 0x400701: "Usage: " 0x40070e: "" 0x40070f: ""

[@Siik94Skillz]

at 1:47, how do you tell gdb to output exactly that with a variable @ rbp-0x28??? been looking for it everywhere and cant find it...

[@sabyabhoi8841]

hey bro, like you changed the disassembly flavor in gdb using "set disassembly-flavor intel", can we do something similar in radare2 as well? As I firmly believe that the disassembly shown in gdb is much more easier to understand than the one in radare2

[@paired7815]

Hi ...thanks a lot ...very interesting videos ...i am new to this ...do you recommend ghidra instead of learning radare ?

[@BraveSirSausage]

using Kali which has Radare2 pre-installed, when i run 'VV' it launches a web server and I get a GUI :( Not as cool as the terminal graph, how do i get rid of it !

[@LiveOverflow]

set the environment variable for the web graph to false. I think that helps. [0x100001174]> e graph.web=false

[@BraveSirSausage]

cool thanks ! for anyone else 'e' lists all environment variables.

[@ahmedsoliman8007]

please kali is shipped with really old old version of radare2 " always use radare2 from git

[@scottbehrens1660]

Awesome tutorials, I have a question. When I look at the pseudo-code, it's doesn't include the nicely formatted strings like your video shows: nt main(int arg0, int arg1) { var_10 = arg1; if (arg0 == 0x2) { printf(0x4006c4); if (strcmp(*(var_10 + 0x8), 0x4006da) == 0x0) { puts(0x4006ea); } else { puts(0x4006fa); } } else { puts(0x400701); } return 0x0; } Any ideas?

[@kushansingh6244]

Nowadays, in my opinion, best tool out there is Ghidra for Disassembly and Decompilation and its free. What do you think LiveOverflow ?

[@janardhannarayana]

amazing tutorial

[@balb98]

Sorry, i don't understand why you use `r TEST-KEY` when breaking the strcmp. Can someone explain me that?

[@damiancampbell1743]

The 'r' in 'r TEST-KEY' is just a shorten version of 'run TEST-KEY'. It does the same thing.

[@williamsquires3070]

You can also use Ghidra (free) from ghidra-sre.org; You’ll need Java 11 SDK. Ghidra is a disassembler that works on MacOS X and Windows, and should work on any platform that has Java 11 SDK/runtime, though you may have to figure out how to make (or modify) a launcher script for a Linux distro. It can use many of the IDA-Pro scripts from what I’ve been told, though I don’t have IDA-Pro, so I can’t really say (because it’s too expensive.)

[@AntonioSouza]

Very, Very 0x1337 times Very cool. Thank's you. You é very good. Sorry my english, I'm brazilian.

At 9:09 I can't use 'aaa' anymore, so what alternative command should I use? Thank you

[@chuchuthegameryt1171]

Thanks man. Really useful. Debugging got easier for me. Can you please make a video on CHAINED ret2libc attack. I am actually stuck. There are two methods in it : ESP Lifting and FRAME FAKING and I am not able to make either one of them work.

[@kishoresuri007]

Hey.. I have an issue with radare2 while trying to rerun the program using ood. tried to edit the ptrace scope but with no use. When i use ood, it reopens the file in read-write mode and tries to attach . "ptrace attach : operation not permitted" this is the error. do u have any idea about this

[@douwehuysmans5959]

You need root privileges to attach to a running process. Try sudo

[@trebelojaques458]

"and it makes sense to master them all, *Except Radare, nobody every really masters radare* " lmaoo

[@dkdk-pd1vn]

Great stuff but please slow down!

[@angeloalonzo5500]

lol I thought this will be simple

[@ryanmccauley211]

Anybody having an issue like me where the .rodata address doesn't match the registers when running, try compiling with -no-pie flag so the address doesn't get randomized

[@tanmaybora359]

@Ryan Mccauley Thank You So Much!

[@DebilNo4Mk1]

6:34 "Affordable" *AFFORDABLE*

[@wielkizderzaczhadronowkucy293]

some of those tools cost thousands of dollars (and radare is still better than them)

[@arifbasri4950]

Thank you Sir, really helpful

[@RDesHu-hd2ln]

Great Video !

[@jonbikaku6133]

Been following this channel and have to say, you got some really dope content! One question regarding redare2 while installing on Ubuntu, after doing the setup and running r2, i get an error saying ` r2: error while loading shared libraries: libr_core.so: cannot open shared object file: No such file or directory `. Any idea how to solve ? I looked online and it seems like its not able to get the shared path of the library.

[@franciscobahamondes5878]

github.com/radare/radare2/issues/11897

[@الْمَذْهَبُالْحَنْبَلِيُّ-ت9ذ]

Which song/music are you using in your intro and ending ?

[@ПетяТабуреткин-в7т]

10:04 N I C E A R R O W S

[@sarafdimi2072]

I have a question: We saw with ltrace what the arguments of strcmp were. If we want to make our program more secure, what would we do? Attach some crypto to it ?

[@nukexplosion6679]

Make an algorithm for key validation, which he talks about in the next video.

[@وزيرالفقراء]

hello bro , tell me please how i can clear memory and register for do fast action and speed cpu for instruction with assembly code ? thank you very much

[@nikhilt3755]

what if i strip the symbols and then run strace and ltrace will i get function calls?

[@Matt-ir1ky]

Hey. Thank you very much for your tutorials. I have a small issue with R2... I ran through this tutorial a couple nights ago and I was able to recreate everything you did but tonight when I try in R2 to press VV to display the graph, it opens in its webUI and I can't seem to figure out how to change it back. So I hit VV after seeking to the main func but it opens up my chrome explorer and shows me a graph in there instead. I mean its probably a sophisticated feature but I don't want it at this point... Thanks again!

[@Matt-ir1ky]

Not sure what the deal was. My r2 was acting weird. It wasn't giving me the silly message when you open it and different ouputs for this or that. I deleted my apt version and installed from git and now its working again. Thanks!

[@shubhamjagtap1919]

thanks buddy

[@cipher3966]

Most viewed points are where you wrote the commands quickly and in tiny font at the bottom of the screen. Kind of frustrating, often seeing what was typed is impossible

[@osmelfernandezbelen2836]

Hello friend, good video, I would like to know if you have any program with the one of the vidoe but that works for windows. I am interested in unzipping a firmware made for the msd7816 chip of the mstar company.

[@damiancampbell1743]

I personally don't know of any programs like this that work for Windows, but honestly, I think you'd be better off looking into WSL (Windows Subsystem for Linux) or using a VM (Virtual Machine) like Virtual Box or VMware Workstation with Linux VM on it.

[@meksaldi]

Awesome content!

[@nazibabrar1824]

Can anyone help me with an issue I am having with ltrace :) ? The thing is, when I am trying to execute the binary from the github repo of the description with "ltrace ./license_1 KEY", It's working fine and showing all the function calls fine. But when I am compiling the source code with "gcc license_1.c -o license_1 -Wall", The ltrace command doesn't work anymore. It's just showing the standard output, no function calls. I think this is an issue with the gcc compiler. How do I compile the source code to be able to read the function calls with ltrace?

[@kevinjohansson3923]

Man, why have I just found out about this channel now?

[@nickst2797]

Man, why have I just found out about this channel now?

[@ahora1026]

And one year later, why did I ........

[@jamespeterson7979]

I tried the: ltrace ./license TEST It does not give me the strcmp command line. But with "objdump -d" i can find the strcmp.plt as i saw in your video, 3:18 objdump also tells me that it must be somehow related to glibc: # 3fd0 Still ltrace doesn't print the strcmp line. Does it have to do with the compiler version? [gcc version 9.3.0 (Ubuntu 9.3.0-10ubuntu2)]

[@jamespeterson7979]

With the file command i found that your ELF is a 'executable' with 'dynamic linked' libraries my ELF was a 'shared object' with 'dynamic linked libraries' i tried compiling it with '-static ' parameter so i got a 'executable' but it was 'statically linked' and got a increased filesize. I don't know how you compiled it, maybe there are special parameter you used? Your's is also half the size on mine. (16kb vs 8kb), i thought maybe it could have something to do with 32 and 64 bit, but your file stated that it is a "ELF 64-bit LSB".

[@diaahanna8882]

is it possible to find bugs in a compiler genrated code ??

[@MrJaylassiter]

I learned so much 😎

[@gustavogonzalez8644]

Can RetDec Radare2 decompile a .bin file?

[@victorreaver1984]

When I type ./license_1 AAAA-Z1ON-42-OK, it says "Wrong!". Any idea why?

[@Saimon404]

Sir have anyway to cython to python file??? I mean decompile cython compiled and get result python file purely...any method or paid method..kindly repaly pls.

[@bmac3933]

Great video :)

[@ExtinityOfficial]

Well, time to master Radare then.

[@johannbauer2863]

ExtinityOfficial you can also use cutter, which is a gui for radare

[@doron2402]

What's your opinion about dtrace?

[@pauribelles7920]

Why did he choose to look up specifically for the rsi register to find out the string? How can you found out that? (4:45)

[@stathisstathopoulos9007]

I was wondering too, couldn't find any similarities

[@pod9594]

.rodata section had 0x4e long contens from 0x4006c0 (4:26). Only rsi register was in that range : 0x4006da (4:45).

[@webpunisher2954]

I do not understand if the file is a binary where 0 and 1 are??

[@YURIA9802]

GIANT CHARACTERS

[@drwblkfact7286]

Thank u !!!

[@9thCrusade]

when i typed in aaa in radare it showed me some shortcuts and aaa wasnt one of them. what to do? :/

[@cyberguide_in]

At 8:44, when I did ./sys/install.sh, it says "You need GNU Make to build me". Can you please help me?

[@babaroro5942]

Hey ! found the solution, you have to install GNU make with "apt-get install build-essential", it worked for me. Good luck ! :)

[@NphiniT]

Do all of these tools come with ubuntu by default?

[@damiancampbell1743]

Quite a few of these wont, if you're using a security oriented distro like Kali or Parrot, a fair amount of them probably will. As you can see though, it's not terribly hard to acquire them. A simple "sudo apt-get " will do the trick. if you do "sudo apt-get ..." will allow you to install multiple programs simultaneously.

[@user-kp5kg5dl8h]

Anyone else have issues opening certain manual pages? Digging around Google, I've seen others with this issue, but so far none of the solutions have worked. I've read in one place that it could be a bug?

[@damiancampbell1743]

Not sure which programs you're referring to in particular, but I'm willing to bet it's the one's related to C functions, like "man strcmp" and etc. You can install these with "sudo apt-get install manpages-dev" and "sudo apt-get install manpages-posix-dev". They should work now.

[@deamer44]

Can anyone explain to me how he got to the conclusion that jne 0x4000623 goes to location 4005ea for a call??

[@b00i00d]

I think if you watched his previous video it would be clearer. Basically the jne jumps to its address if not equal to 2. If it _is_ equal then the code will continue sequentially from that point (i.e. no jump) and 4005ea is the next major instruction (if you skip all the movs and adds)

[@manishasinha6694]

Great tutorials !

[@noahosterholz9385]

Hey can someone pls help me? I cant set adress specific breakpoints in gdb (break *main works) because the adresses seem to change when i run the program and are not the same as displayed in "disassemble main" (there are a bunch of 5s in the adress when i run it where before were 0s) Sry for bad english im german

[@noahosterholz9385]

@@thevulnx ah okay thanks that sounds logic.

[@jorgevarela1725]

Press SHIFT+R and be happy

[@khennacheaymene1638]

Zion, 42, rabbit running.... Now u see your self