CC: Ghidra
Date: 30, May, 2021
Author: Dhilip Sanjay S
Click Here to go to the TryHackMe room.
Introduction
GHIDRA is a tool created by the NSA that allows the user to analyze binaries. It is well known for it's incredible de compiler which converts the assembly in the binary to C.
To install jdk and jre:
sudo apt install openjdk-13-jre openjdk-13-jdk
Create a New Project
Use
File->New Project->Non-Shared-Project
Specify the destination folder.
Analyze a binary
Import a file:
File->Import File
Ghidra will automatically detect what type on binary the file.
From there double click the binary, and you will be prompted to analyze the binary, click
Analyze->Yes
Symbol Tree - It allows you to view all of the files that were imported to create the binary, and view all user created functions.
You are able to see both the
disassembly
, and thedecompilation
, on the same screen!
For general binary analysis, you won't be interested in functions that start with "_" as those are functions created during compilation.
It's your turn!
How many user created functions(including main) are there?
Answer: 2
Steps to Reproduce:
Check the symbol table, the following two are the user defined functions:
main
fn1
What is the first variable set to in the main function?
Answer: 10
Steps to Reproduce:
local_c
is the iVar1Value
0xa
is being moved to the location pointed bylocal_c
Hex
a
-> Decimal10
What is the first variable set to, in the function "fn1"?
Answer: hello
Steps to Reproduce:
Inside the fn1:
If you provide the input "1", when you run the binary, what would the output be.(Note you can just run the binary to find this out, but that would defeat the whole purpose!).
Answer: nice!
Steps to Reproduce:
When you press
1
and pressEnter
-> "1\n" will be the inputstrcmp
will compare the two strings and return 0 if true.If
true
, then "nice!" will be printed
Miscellaneous Operations
Section 1: Patching Binaries
Occasionally there will be times when you want to patch(The art of changing assembly instructions) a binary. Ghidra offers support for this.
Right click the asm instruction, MOV EAX,0x0 and click "Patch Instruction".
From there you can change it to whatever you want, in this case let's change "MOV EAX,0x0" to MOV EAX,0x1"
Modified code:
Section 2: Searching
Ghidra supports going to different portions of memory, when given a memory address.
Click
Navigation(At the top bar)->Go To
and input amemory address
.
Final Exam
What outputs the good job message?
Answer: goodjob
Steps to Reproduce: Analyze the main function
References
Last updated