Very impressed by the quality of the tutorial.Clear, concice, straight to the point how I like em'. Ghidra truly is a powerful tool but once again in the hands of a capable person it is even better. Also, that encrypted firmware had no chance at all, when the key and the booty is in the hand of the attacker it's only a matter of time! No amount of obfuscation can change that simple fact.
@John Woods Don't bother encrypting anything that's entirely controlled by an attacker- it's just obfuscation. You could use some sort of online method of getting the key from a central server, but even then it wouldn't be perfect.
@John Woods In this case the correct solution would have been to have the key inside the device in some place that does not get overwritten by a firmware upgrade. That way you don't have to ship the decryption key with new firmware. They are just idiots.
@TheGame402 That too only takes one person with electronical hacking knowledge. The worst part is that once the key gets shared online, you cannot change it because it is hard coded in all devices.
Its nice to see some real hacking being done by someone that is good at it. You are also a really good teacher; clear and well paced, showing your mastery of the subject.
Since Ghidra is quite a new tool, it is quite difficult to find resources on it, so you're really doing the community an amazing service. This video made me subscribe. I'm having trouble finding a resource on how to using Ghidra for embedded firmware which isn't unix based. (No MMU, just bare metal firmware) Liveoverflow did quite an interesting series on the STM32-based legder wallet, could you please point me to a resource on analysing the same type of embedded device with Ghidra?
It was very interesting to watch the workflow and what programs were used to achieve the final goal. I'm looking to get back into reversing, but I became too rusty and there is a ton of new programs, tools and techniques that I know nothing about.
I remember having fun with MSVS6, Cracker's Kit and OllyDbg on Windows XP. Those days seems so distant now..
The AES functions in the library does not use padding. So when running openssl from command line you have to use ”-nopad” to get the last 16 bytes (and avoid the error message). Your key is also two zero bytes too short ”0000” (from the python script), but openssl will pad the key with zero bytes so it works anyway.
Very helpful video. I now see why my previous attempts understand reverse engineering were bound to fail. My way of approaching such a problem where not because I have only limit knowledge about x86 assembler - although that probably doesnt help either - it was more a misunderstanding of how to use the decompilation view. Thanks for this video, and I'm looking forward to the next videos
Amazing video. You make it easy to follow by being precise, and "answering" questions that may pop up as I watch it. Your videos are really packed with great information. I learned a lot. Thank you.
Amazing! I'm happy to see some comprehensive coverage of Ghidra. This is packed full of useful information for Ghidra. Being familiar with reversing only gets you so far with a given program.
Wonderful video. From what I see you've spent a great deal of time studying the firmware. Some basics on how you go about reverse engineering would be really helpful. Thanks.
That was wonderful. I enjoyed watching this video as I was able to stay with it quite well. I was wondering how someone like yourself would approach disk encryption, like say, Veracrypt. What would be involved with that? If you had control of a machine, logged into Windows, with dismounted partitions.. could there be a way to decrypt? Thanks.
Excellent video and great channel!! Thank you for sharing your knowledge with us who are not yet experts in this matters. Golden things to learn here :)
this is love dude... you are awesome just keep them coming Hope you explain some router firmware reversing and explaination for how these hackers are now exploiting the routers on a very large scale. Thnaks in advance :)
Also a short question: Your accent sounds familiar to me. Are you from germany? If i'm right: Schöne Grüße aus Bayern! Sehr gut erklärte Videos, denen auch sicher Leute folgen könnten, die bis jetzt noch kaum etwas in die Richtung gemacht haben. Hoffe da kommen noch ein paar mehr Videos! Was bringt mir all mein Wissen, wenn ich es nicht verständlich äußern kann. Wirklich gut ist man erst in einem Thema, wenn man die komplexeren Vorgänge simpel erklären kann. Und das kannst du auf jeden Fall! And maybe you could start a Discordserver for your followers. That would help to build a community:) @Ghidra Ninja
Wow it was so great,i am really fascinated by your method, i hope that soon as you can "please" make videos about reverse engineering basics, and maybe other things also !! big thanks <3 :)
thank you for your videos, its good if we can see more of your videos about CTF binary reverse. and please make your videos more easy to understand for beginners . thank you
Discovered your channel a couple of days ago and I'm loving the content! Regarding binwalk on macOS, I managed to install it with homebrew but it complains about failing to run external extractor unsquashfs, with several errors regarding squashfs-root, sasquatch etc. How did you get it running on macOS without errors? Or are you running a linux subsystem? Thanks in advance
Sir. Not very many are able to articulate a lesson in a way my brain to absorb. Especially when it comes to variables in dialect. All said it can be frustrating at times. While I am going to have to rewatch this I would personally like to thank you for your time as well as your ability to clearly lay it out... I will mos def look for more of your tutorials
Awesome video...great information. What would you have done if you did not have access to the older firmware version, would this still be possible, just much harder?
Wonderful video. I noticed that the firmware for 1.11 is not on the site from what I see anymore? Can't really follow along in the video without that older update, is there a way you could link it so people could still follow along? Thank you, such great content!
Insider here: We know that the encryption is very basic and rather embarassing. We don't want to make it too easy, but we also know that even the "hardest encryption" will be cracked if enough time is invested. So this is the middle way.. Nice video, thanks for the tips!
So basically if they release a new version of this hardware, and implement the encrypted firmware from the factory, you would not be able to do this. (And offcourse, they should change the key to something else, than the one you showed)
Hi, very good tutorial indeed yet I'm not able to replay it as, the firmware files are'nt available anymore from Moxa. did you make a copy of the cited files or do you know were I can get them ? best
your video encouraged me to hack into my router fw. I was able to crack the fw verification dunction :D now how do we compile it back so it can be flashed? i checked fw-mod-kit but i am not so sure.
0 likes
A Rob2020-04-12 04:38:58 (edited 2020-04-12 04:39:27 )
Do one for Wireless Mic Systems like Shure and stuff like that
The most obvious benefit is that the software gets plugins developed at no cost, bugs are fixed at no cost, and you get an army of devs scrutinizing the code to make it the best it can be. Simple benefits of open source. They also increase their talent pool. In case that wasn’t enough motivation the US gov has a quota they need to fill on code they open source to the public under an Obama legislation.
It's funny how he clearly understands what he's looking at but still renames things to help himself understand what he's looking at more clearly... Brain, you so silly...
hi, i did buy a software with server confirmation. the owner has closed the servr an i have no more access. can you deactivate the pass and the server function?- if so please, contact me
I know it has been 2 years and moxa W2150A v1.11 is no longer available. So hopefully, somebody pls send me that firmware so I can do some cool experiment.
where is my wanna cry decrypt part 2?? we realy want it man i enjoy ur videos even more than P0** videos please make videos faster and 1 video about reverse engineering basics <❤/>
The basic reverse engineering procedure yes, but the firmware protections of modern gaming consoles are far more advanced - check the videos of fail0verflow to learn about console security (with a focus of homebrew, not piracy)
@stacksmashing Thanks for the answer. But why would closed source software keep the function names in their binary? I would assume that (substantially?) simplifies reversing.
Very impressed by the quality of the tutorial.Clear, concice, straight to the point how I like em'. Ghidra truly is a powerful tool but once again in the hands of a capable person it is even better. Also, that encrypted firmware had no chance at all, when the key and the booty is in the hand of the attacker it's only a matter of time! No amount of obfuscation can change that simple fact.
169 likesReplies (4)
What is a better way to do this? Clearly not having the key inside the bin, what's better practice?
4 likes@John Woods Don't bother encrypting anything that's entirely controlled by an attacker- it's just obfuscation. You could use some sort of online method of getting the key from a central server, but even then it wouldn't be perfect.
7 likes@John Woods In this case the correct solution would have been to have the key inside the device in some place that does not get overwritten by a firmware upgrade. That way you don't have to ship the decryption key with new firmware. They are just idiots.
9 likes@TheGame402 That too only takes one person with electronical hacking knowledge. The worst part is that once the key gets shared online, you cannot change it because it is hard coded in all devices.
1 likeIts nice to see some real hacking being done by someone that is good at it. You are also a really good teacher; clear and well paced, showing your mastery of the subject.
33 likesWow, this tutorial is of amazing quality!
39 likesSince Ghidra is quite a new tool, it is quite difficult to find resources on it, so you're really doing the community an amazing service. This video made me subscribe.
I'm having trouble finding a resource on how to using Ghidra for embedded firmware which isn't unix based. (No MMU, just bare metal firmware) Liveoverflow did quite an interesting series on the STM32-based legder wallet, could you please point me to a resource on analysing the same type of embedded device with Ghidra?
Replies (1)
hi from liveoverflow ,which new tool do you know so far ,i need more knoledge
0 likes"You should definitely make a video about reverse engineering basics"
158 likesReplies (2)
yes
1 likeIt's been awhile
1 likeThis video is PAAACKED with great info. Keep them coming!
94 likesIt was very interesting to watch the workflow and what programs were used to achieve the final goal.
8 likesI'm looking to get back into reversing, but I became too rusty and there is a ton of new programs, tools and techniques that I know nothing about.
I remember having fun with MSVS6, Cracker's Kit and OllyDbg on Windows XP. Those days seems so distant now..
The AES functions in the library does not use padding. So when running openssl from command line you have to use ”-nopad” to get the last 16 bytes (and avoid the error message).
2 likesYour key is also two zero bytes too short ”0000” (from the python script), but openssl will pad the key with zero bytes so it works anyway.
Very helpful video. I now see why my previous attempts understand reverse engineering were bound to fail. My way of approaching such a problem where not because I have only limit knowledge about x86 assembler - although that probably doesnt help either - it was more a misunderstanding of how to use the decompilation view. Thanks for this video, and I'm looking forward to the next videos
6 likesAmazing video. You make it easy to follow by being precise, and "answering" questions that may pop up as I watch it. Your videos are really packed with great information. I learned a lot. Thank you.
0 likesAmazing! I'm happy to see some comprehensive coverage of Ghidra. This is packed full of useful information for Ghidra. Being familiar with reversing only gets you so far with a given program.
4 likesThat's really impressive. Thank you for walking us through.
1 likeWonderful video. From what I see you've spent a great deal of time studying the firmware. Some basics on how you go about reverse engineering would be really helpful. Thanks.
0 likesI came to crack software, stayed for the full tutorial series. Really great stuff.
1 likeThat was wonderful. I enjoyed watching this video as I was able to stay with it quite well. I was wondering how someone like yourself would approach disk encryption, like say, Veracrypt. What would be involved with that? If you had control of a machine, logged into Windows, with dismounted partitions.. could there be a way to decrypt? Thanks.
0 likesExcellent video and great channel!! Thank you for sharing your knowledge with us who are not yet experts in this matters. Golden things to learn here :)
3 likesThis guy deserves more recognition! Extremely skilled! Subbed!
0 likesI'm a APCSA student with no experience with reverse engineering, this sounds like something very fun I can do and learn while quarantined.
1 likeI'm here from LiveOverflow's channel and I'm loving your content. Please make more of this stuff! :D
4 likesReplies (1)
Welcome on board 😀
2 likesthis is love dude...
23 likesyou are awesome just keep them coming
Hope you explain some router firmware reversing and explaination for how these hackers are now exploiting the routers on a very large scale.
Thnaks in advance :)
Wow, great to see how this sort of stuff is done. Subscribed and look forward to checking out some of your other videos!
0 likesGreat Work here!
7 likesHope there will come more in the future! Very good explained and ez to follow.
Replies (1)
Also a short question: Your accent sounds familiar to me. Are you from germany?
1 likeIf i'm right: Schöne Grüße aus Bayern! Sehr gut erklärte Videos, denen auch sicher Leute folgen könnten, die bis jetzt noch kaum etwas in die Richtung gemacht haben. Hoffe da kommen noch ein paar mehr Videos! Was bringt mir all mein Wissen, wenn ich es nicht verständlich äußern kann. Wirklich gut ist man erst in einem Thema, wenn man die komplexeren Vorgänge simpel erklären kann. Und das kannst du auf jeden Fall!
And maybe you could start a Discordserver for your followers. That would help to build a community:) @Ghidra Ninja
Unbelievable quality of the content. Massive thanks, mate!
3 likesI'll in love with your channel! Please create a series of Reverse Engineering Basics!
10 likesAs a user of Idea and doing some RE for time to time, this is very impressive !
1 likeAll seems so easy but it is not.
Gateway to shell :D Good job Thomas, love the work you put in!!
1 likeSorry a bit late :(
Wow it was so great,i am really fascinated by your method, i hope that soon as you can "please" make videos about reverse engineering basics, and maybe other things also !! big thanks <3 :)
0 likesthank you for your videos, its good if we can see more of your videos about CTF binary reverse. and please make your videos more easy to understand for beginners . thank you
0 likesI love your work! Nice and easy to understand. I looking forward your future videos.
3 likesDude, please uploads more videos, you cannot imagine how we appreciate your videos. Thank you very much
1 likeDiscovered your channel a couple of days ago and I'm loving the content! Regarding binwalk on macOS, I managed to install it with homebrew but it complains about failing to run external extractor unsquashfs, with several errors regarding squashfs-root, sasquatch etc. How did you get it running on macOS without errors? Or are you running a linux subsystem? Thanks in advance
0 likesThis video is great. Alongside LiveOverflow one of the best RE videos on Youtube! Keep them coming.
3 likesYour videos are really very good. Thank you for them and please continue for new ones 👍🏻
3 likeswow - perfect example of a very skilled knowledge/intension mix. Thx for the work and sharing.
2 likesSir. Not very many are able to articulate a lesson in a way my brain to absorb. Especially when it comes to variables in dialect. All said it can be frustrating at times. While I am going to have to rewatch this I would personally like to thank you for your time as well as your ability to clearly lay it out... I will mos def look for more of your tutorials
0 likesAwesome, love the information.
2 likesYour channel is great, hoping to see more of these in the future.
Question: when you were renaming variables, how did you establish that auStack48 was actually the userkey?
2 likesReplies (1)
ahh forget it. I just realise you had looked at the function signature.
2 likesThis is really helpful for understanding the Ghidra workflow. Thanks!
2 likesAwesome video...great information. What would you have done if you did not have access to the older firmware version, would this still be possible, just much harder?
0 likesWonderful video. I noticed that the firmware for 1.11 is not on the site from what I see anymore? Can't really follow along in the video without that older update, is there a way you could link it so people could still follow along? Thank you, such great content!
0 likesMate could you make more firmware hacking videos please. This is sick !!
0 likesAs others already have said this video is very informative and in good quality. Good job!
5 likesI guess you are German? How did you learn all of this?
So glad I took the extra effort to put in security from the beginning in the firmware update system I've designed.
0 likesthis is a high level of reverse engineering !
11 likeslike + subscribe
Insider here: We know that the encryption is very basic and rather embarassing. We don't want to make it too easy, but we also know that even the "hardest encryption" will be cracked if enough time is invested. So this is the middle way..
1 likeNice video, thanks for the tips!
Replies (3)
Embedded engineer here, you guys hiring?
0 likes@kartoffelwaffel This is an anonymous account, sorry.
0 likes@NameIst Unbekannt As implied by your name, no worries!
1 likeSo basically if they release a new version of this hardware, and implement the encrypted firmware from the factory, you would not be able to do this. (And offcourse, they should change the key to something else, than the one you showed)
0 likesReally great video and good explanation. Thanks you so much for it...
0 likesId die to watch a reverse engineering basics tutorial. I was hooked just by watching for 2 minutes
2 likesFor a moment I thought you are the presenter of SCADA: Gateway to shell from a CCC talk. Impressive work and video quality!
4 likesReplies (1)
🤫Thank you!
2 likesThis video was so good, very well explained
3 likesHi, very good tutorial indeed yet I'm not able to replay it as, the firmware files are'nt available anymore from Moxa. did you make a copy of the cited files or do you know were I can get them ? best
0 likesawesome video, really loved it. I'm very excited about the upcoming post on finding a vuln in the device.
0 likesCan't wait to see more of your Ghidra videos!
1 likeWow! Thank you so much for such high quality video. Subscribed! Please keep going.
1 likeIncredible tutorial!
0 likesDo you do any other stuff? I would happily see some of it no matter what it is. You are awesome.
2 likesReplies (1)
Definitely in the future!
2 likesyou are amazing man, i really hope u keep going with this
1 likeI'm watching all of your videos, very good content!
0 likesWoah, Man, that was awesome. I cant wait to see more from You!
0 likesReally nice video. I only hope that now you can upload more often.
0 likesThank you for these tutorials!
1 likeMany thanks to Ghidra Ninja and the NSA!
7 likesGreat video, thank you very much!
3 likesDoes finding something like this warrant a CVE to the researcher?
0 likesWow that was awesome 😊
1 likegreat and amazing tutorial
0 likesI love this tool! ❤️❤️❤️
0 likesThis is so great.
0 likesKeep it up.
Super advanced. Thanks for the video =)
0 likesSo clean, so cool i love this video !
0 likesThese are fantastic. Keep going
0 likesdoes Ghidra have malware/trackers built into it? I'd guess running it in a locked down VM is recommended, right ?
0 likesAwesome stuff, thank you!! :)
1 likeThis channel is going to blow up! Subscribed.
0 likesGhidra ninja can you suggest a course where I can start learning this stuff?
0 likesThank you
What did you use to record the keybindings at the bottom?
0 likesBro awsm video i have became a huge fan of youu you have got the skills man
2 likesThis is so awesome! Sure hope NSA pays you well :*
4 likesReplies (1)
Haha that's what I was thinking. He seems pretty experienced with software the NSA released only a month ago...
1 likeI subscribed and enabled the notification. Thanks for the great video.
0 likesPhenomenal vid/tutorial!!
1 likeYou should make more video man. Love your video <3
4 likesVery interesting, thanks for sharing!
1 likeYou should make a video series on what each option means in Ghidra
4 likesReplies (1)
Yea that would be cool.
1 likedamn tools are horrifyingly powerful nowadays.
9 likesAwesome, thank you !
2 likesyour video encouraged me to hack into my router fw. I was able to crack the fw verification dunction :D now how do we compile it back so it can be flashed? i checked fw-mod-kit but i am not so sure.
0 likesDo one for Wireless Mic Systems like Shure and stuff like that
0 likesyeah man this is what am looking for . thx bro (y)
0 likesQuality of the video is excellent!
3 likesFantastic video! I keep checking YouTube to see if you’ve uploaded.
1 likeStrong content!
1 likewoww! So much good info! Awesome!
0 likesAwesome! Thanks!
0 likesWell done.
1 likeLooks like ghidra is some decent tool.
Still wonder what NSAs endgame here is
Replies (1)
The most obvious benefit is that the software gets plugins developed at no cost, bugs are fixed at no cost, and you get an army of devs scrutinizing the code to make it the best it can be. Simple benefits of open source. They also increase their talent pool. In case that wasn’t enough motivation the US gov has a quota they need to fill on code they open source to the public under an Obama legislation.
0 likessir you are a scholar and a gentleman, imma check all your vids
0 likesSmashed that subscribe and notify button fast AF! Keep them coming!
1 likeMükenmel çok teşekkür ederim 🙏
0 likeswhat about a firmware that was encrypted from the beginning?
0 likesThis video is amazing. Subbed
1 likeWow this is reeeeally cool!!
0 likesgreat content
0 likesDoes the Ghidra decompile assembly to a high level language?
0 likesNice video bro :-)
5 likesIt's funny how he clearly understands what he's looking at but still renames things to help himself understand what he's looking at more clearly...
0 likesBrain, you so silly...
Best video I’ve seen all week.
1 likeYour seeing now is a master at work🔥🔥🔥
0 likesLol now you can aes-ecb-encrypt and make a custom firmware
31 likesawesome! cant wait for next video
1 likesuper super cooooooool ! love it !
0 likeshi, i did buy a software with server confirmation. the owner has closed the servr an i have no more access. can you deactivate the pass and the server function?- if so please, contact me
0 likesGreat video
2 likesCouldn't find the second part of this video. Is it uploaded yet?
0 likesWait. Is this liveoverflow in incognito-mode?
13 likesReplies (1)
Hah, it's not, but we are from the same country! LiveOverflow is the best.
22 likesGreat vid. Thanks
1 likecan you reverse engineer nokia 1100 firmware (DCT4) encrytion to mod it to include my own images ringtones etc :)
0 likesThe entropy of this video is enormous, I can see that without running binwalk -E.
0 likesReplies (1)
You're saying it's very random? :P
0 likesexcellent!
0 likesGutes video ^^
1 likeReplies (1)
Danke!
0 likesWowwwwww Super!
1 likeGenius! Got a New sub
1 likeDoes Ghidra work on Linux?
0 likesWish I had taken up programming as a kid, learning t h is as a middle aged guy is painful
0 likesI know it has been 2 years and moxa W2150A v1.11 is no longer available. So hopefully, somebody pls send me that firmware so I can do some cool experiment.
0 likesDanke Bruder. Hilft mir sehr
0 likesawesome man work on iot devices
1 likeI think it's creepy at this very time they're handing us this knowledge and power.. how much trouble are WE really in??!
1 likeeverything flew over my head
0 likesI respect you
0 likeswhere is my wanna cry decrypt part 2??
0 likeswe realy want it man
i enjoy ur videos even more than P0** videos
please make videos faster and 1 video about reverse engineering basics
<❤/>
wtf i just saw. You changed my life from today.
0 likesBoom! Subscribe button got hit ! The bell got hit !
1 likeCan this method apply gaming consoles example PS4 extra..
2 likesReplies (1)
The basic reverse engineering procedure yes, but the firmware protections of modern gaming consoles are far more advanced - check the videos of fail0verflow to learn about console security (with a focus of homebrew, not piracy)
2 likesps. how did you know it was ECB AES over CBC or otherwise?
1 likeReplies (2)
the decryption function where he found the buffer offset was already called ecb128 after ghidra extracted its symbols
2 likesIdan Horowitz thanks!
1 likeplease keep reversing engineer public
0 likesReplies (1)
This have an amazing quality!
0 likesDon't know anything about decompilers and I'm wondering how does ghidra infer function names?
0 likesReplies (2)
The function names on this cases were included in the binary :) otherwise you just get fun_0x... names
1 like@stacksmashing Thanks for the answer. But why would closed source software keep the function names in their binary? I would assume that (substantially?) simplifies reversing.
0 likesSubbed thanks to Reddit
1 likecool.....heavy duty
1 likeDOPE AF
2 likesReplies (1)
hey was looking for part 2 but found your 34C3 talk on SCADA system that will do i guess :), Again thank for sharing outside of con that's nice :)
0 likeswow
0 likeswizardary
0 likesFrom where did u learn all these shits dude??
0 likesHoly shit.
0 likesLike si tu es aussi à l’HEIA
2 likes