Please create a series of Reverse Engineering Basics! Love this!


Brilliant "in a nutshell" tutorial of getting to know the program quickly.<br>Could you please do a follow-up of the very same crack me, but with showing how you "crack" the crackme by patching the binary inside Ghidra so that it always jumps to the success condition regardless of the input given?

Brilliant "in a nutshell" tutorial of getting to know the program quickly.
Could you please do a follow-up of the very same crack me, but with showing how you "crack" the crackme by patching the binary inside Ghidra so that it always jumps to the success condition regardless of the input given?

@Gil its possible i. Gdb, i would hope so! :)

Gil Bytepatching should be simple, worst case you just use like a Hex Editor and jump to the offset and manually patch ig


Excellent explanation. Clear, concise and a great pace, wasn't confusingly fast or laboriously slow. I hope you continue to make videos on Ghidra.


Crystal-clear, methodical and systematic walkthrough! Thank you!

Искандер Шафиков


wow this tutorial is just perfect, the pace the explanations, everything ! Thank you


Beat tutorial I’ve ever seen. Clear, concise and simple.


Thank you for a great overview. I'm getting started quite easily because of this 👍


Many thanks for suggesting this software ... I wanted to look into reverse engineering for years, but had not yet come across such an handy tool. AIDA wasn't really affordable for experimenting ... Again thank you very much!


For future listeners, Ghidra is pronounced,  "Gee-druh"; [3] /ˈɡiːdrə/[4]).

Source:
https://github.com/NationalSecurityAgency/ghidra/wiki/Frequently-asked-questions#how-do-you-pronounce-ghidra

Great video, and well-explained usage. Keep up the great work.


This helped so much, the main thing I needed was just the fact that you can click on named functions in the decompile window to go to them. Seems obvious but I just didn't know!


Great tutorial, kudos! Can you elaborate why is there an issue requiring the usage of a pointer to a pointer for argv ?


I had a quick look at Ghidra a few weeks ago and it seemed rather complex.... It certainly seems a lot less complex now! Thanks.


awesome video man,keep doing more basic malware analyasis and reversing.Thanks:)


Fantastic. Hopefully looking forward to more of the same.


Your videos are awesome! Please keep making content like this!


Excelent. We want more!! Really good tutorials


This is great, a nice simple introduction to ghidra.  How'd you setup the VM? did you use Virtualbox? or something else?


Liked your explaination, easy and clear. Keep going please.


Thanks ninja! A very well prepared video. Hopefully more  will come :)


Nice video! Do you plan on making more? Id love to see more videos on Ghidra :)


Love this. Keep up the great content man


Interesting. When I put the C function prototype for a main() function in, Ghidra wouldn’t even accept “[]”, and I had to use an extra “*” anyway.


"Let's maximize the window"<br>> Actually makes windows smaller

"Let's maximize the window"
> Actually makes windows smaller

^^  effing owned dude... 😅<br>By a Polock Frank... sick digs

^^  effing owned dude... 😅
By a Polock Frank... sick digs

@ytxstream *Java's half-assed implementation of


Thanks for wonderful tutorial. Subscribed.


This was a great video. Amazing explanation but if you could speak a little louder and also put in some energy into your voice it would be even better


wow, nice introduction man. looking forward for more videos from you!


Great video. But could you make a video comparing Ghidra to IDA or some other RE tools?


nice intro! of course, there's any number of possible solutions given that the only criterion is an @ in 5th position


are you planning on doing a course series for this? I would buy it


The video was very helpful, keep it up bro👍👍


awesome tutorial - keep them coming man!


I hope that you create a beginner series in reverse engineering embedded firmware


Nice, I was looking for samples with known outcomes so I could follow the technique ! Awesome . (Mickyj Whitehat)

you've literally got a black hat on. don't lie


I remember solving that very same Crack me with Hopper.<br>thanks for the video, I have not given GHIDRA  a try yet. I'm still learning how to pronounce it correctly :)

I remember solving that very same Crack me with Hopper.
thanks for the video, I have not given GHIDRA  a try yet. I'm still learning how to pronounce it correctly :)

It is pronounced "Gee-druh" (https://github.com/NationalSecurityAgency/ghidra/wiki/Frequently-asked-questions#how-do-you-pronounce-ghidra), but that's okay.
This video was a very nice introduction, by the way!


Jesus you make it look so easy !! Love it ! Keep em coming my friend.


Man, saw this and your wannacry videos, they are insanely high quality. I really hope you still plan on making more videos at some point!


Hello, loved your tutorial! Do you know if Ghidra has the ability to view embedded image files?

Just double click on the bookmark, and the picture should be in the disassembly view

@stacksmashing  Thanks!! Yep I see them all in bookmarks,  now I need to figure out how to view them!

Thanks! Yes it does, and they’ll be marked as a bookmark


Its like the perfect purity of a man page was compiled into a perfect video. Instructions so clear I accidentally cracked the travelling knapsack problem.


Could you do a little tutorial using a MSDOS 16bit binary file? Maybe something that's not packed?


4:07 "a small popup will show up."

popup occupies most of screen.


Is there a way to find what part(s) of the program are referencing a data-text string?   I've tried doing a global search of the address, but where can I find the functions that use it?  I've looked at the tutorial 'Z0FCourse_ReverseEngineering' from stryker2k2/ wolfshirtzlabs but don't see that covered!

Very new to this, would OllyDbg or IdaPro be more beginner friendly?

There should be a list of "X-REFS" on the far right of the listing (you might need to scroll horizontally). There should also be a right-click option to show/list references.

I'm a normie,  no govlarp here,

IDA is the only one I've heard of,

Would be interesting to see how file analysis programs are built from scratch,  as well as what language they would have to use to build a file analysis tool like ghidra or IDA

Ghidra is kind of esoteric,
IDA all the normies like me will recognize

I know the govlarp people like using python


Thanks for sharing! What do you use to show your keyboard input?

@stacksmashing
why am i getting this error ?
 /ghidraprojects/rev50_linux64-bit: cannot execute binary file


Can you explain what argv[0] is? If argv[1] is the array of arguments.

argv[0] is the program Name, 1 is the first argument, 2 the second argument etc :)<br>So if you call “ls /etc” argv[0] contains “ls”

argv[0] is the program Name, 1 is the first argument, 2 the second argument etc :)
So if you call “ls /etc” argv[0] contains “ls”


You have 13.2K subscribers and only 3 videos from 8 months ago!  This was such a great video, I was disappointed to see you didn't have more content.

Tech YouTubers always have their view count scaled way down


Just curious as I just learned that this tool exists, what is difference using this vs ollydbg for cracking? Other than assembly


hello, i have followed the same steps as you but my main function looks different. and it says no function in decompiler. please help


I hope you teach me more about reverse , please create tutorial on udemy , i will subscribe you


Hey, can you explain how to figure out which format/language/etc is used for a specific program, if you don't know it? :)

Good Job btw

There is only one language - assembly :)

PE Header, eg program named "Detect it easy 2.00"


amazing man keep uploading ghidra tutorials


Kind of a dumb question but how did you get your keystrokes to show up on the screen like that?


What VM do you use for running Linux code in OSX?


Great content, subbed, keep them coming!


What Microsoft did right is "Maximize" and the taskbar.


Could you please make a tutorial on how to skirt the Mac OX Catalina 10.15.8 and download Ghidra? I really want to start using Ghidra but my mac will not allow the Javascript updates ...


Thank you Ghidra Ninja. You are a true Ninja!!

اطلب الحق والرحمة


Looking forward to more videos like this.


Thanks man for the knowledge you are awsm


Hello Ninja. I wonder how you secure your MacOS environment from the malware you analyzing? Seems like you are not running a virtual machine, then how do you isolated your machine?

@Ben Baron Still, you taught me something I never think of, bring me the concept of dynamic analysis, i use to think dynamic analysis is more like static code comparison by software with less human involved. but good to learn that.

I also add you from discord, name is RedCorner!

I am following the liveoverflow as well!

@Songchen Han To clarify, I'm not a security researcher or anything, though I have been a professional software engineer for a decade now and have been tinkering with computers since I was a kid. At work I do everything from managing and securing servers, building custom Android ROMs (including a bit of kernel hacking), and writing software in various languages on various platforms. However, as a hobby I like to work on embedded hardware and game console hacking/homebrew, so I've been interested in learning Ghidra to reverse engineer console homebrew, software, and firmware, especially Dreamcast at the moment as I'm most heavily working on that console right now and there is an SH4 CPU plugin for Ghidra.

With that said, just based on my software development background, for dynamic analysis, something like GDB, LLDB, or whatever debugger is common on Windows (I don't use it much) and Wireshark for network monitoring is a good place to start. Keep in mind that if the binary was stripped and not exported with debug symbols (which if they know what they're doing is likely the case) it will be more difficult to use any debugger. Though once you know the addresses of the functions you're interested in from Ghidra disassembly, you should be able to at least set breakpoints on them and do some inspection of memory and registers, etc, but the normal debugging functionality will be more limited than usual and many commands will likely not work or not work correctly.

I wish I could give you more information, but I'm still learning myself and am very new to reverse engineering which is why I've been watching this channel and LiveOverflow a lot lately.

I'm @benbaron on Twitter, but I rarely use it. I'm on Discord a lot as @einsteinx2#2342, mostly in the Simulant Discord server, which is a Dreamcast hacking and homebrew development server.

@Ben Baron Also, do you have a twitter or something I can follow?

@Ben Baron Thank you sir! I think I am more interested in the latter(modify the binary or control address). I guess that is dynamic analysis then.

What tools you recommend for dynamic access then? Immunity Debugger/IDA PRO for windows, GDB for linux ?

@Songchen Han Glad to help :)

Yes exactly, when reversing with Ghidra, it's doing a disassembly and decompilation which is a static analysis. It never actually runs the binary. That's why he's able to analyze a linux elf on macOS, as it doesn't need to be compiled for that OS or even for that CPU architecture. He could just as easily be reverse engineering some ARM linux firmware or something.

It's basically the same as looking at the file in a hex editor, except it's doing the extra work of converting the machine code into assembly and then a step further into C code which you can then annotate and comment to better understand the code flow.

If you were to want to then use the information you learned from Ghidra to modify the binary for example to change a command and control server address or something like that so you could do some dynamic analysis by running it and viewing it's network traffic in Wireshark for example, then you would definitely want to do that in an isolated VM. But all Ghidra is doing is just looking at the bytes, it's not executing anything (unless it has some dynamic analysis features I'm unaware of).

@Ben Baron OMG you are so sweet! That is a very good detailed explanation I could ever expected, that is very kind of you.

I see, we can still reverse software/malware without of running environment. Huh, I ask because the only reverse engineer I do is the buffer overflow attack with requires the application to run and interact while monitor the registers and such in Immunity Debugger. I guess this is different from just purely "Reverse engineering".

I am so happy I learned something today, thanks Ben!

Songchen Han In this case he’s analyzing a Linux binary, so it physically cannot run on macOS so there is no concern there. Same if you’re analyzing Windows malware on macOS or Linux (yes it may run under Wine, but you’d have to do that manually and it most likely wouldn’t work anyway). Also even if it was Mac malware, or if you were running Linux or Windows and analyzing Linux or Windows malware respectively, as long as you don’t execute the file it can’t do anything to your machine.

Now with that said, if you’re analyzing malware at all, I agree it’s probably best to always do it inside a VM with networking and file sharing disabled just to be safe. Of course if your just reversing some normal software you don’t need to worry about any of that.


Thanks man. I enjoyed you cracking that.


nice but can u show the next step to us like if i have to modify the exe and have to change password from @ to something else how am going to do that . i know there are tons of tuts there but all of them go through asm analysis and not teach exe modification , so will be thankful if u can make detail video on exe modifications


Thank you - and pls. continue the work. PS: made me smile.


Interesting why it throws error: Invalid Function Signature
But you edited at 06:37 without problem..
Maybe new version is aware it must be array :)

@let's player the LARP groups are showing people how to use this shit lmao, hire me LARP people,  <br>I don't second guess stuff when I know what the shot is

@let's player the LARP groups are showing people how to use this shit lmao, hire me LARP people,
I don't second guess stuff when I know what the shot is

How can i fix this error? I'm at the moment a noob at programming.


I get an error "decompile.exe" not found when disassembling. Anyone know why?


What VM are you using to get that seamless terminal integration?


Can someone please help me find an unused map select for a GC game?


please can you write the easy_reserve password??


Would love to try this but I'm not putting anything made by the NSA on my PC lol


How difficult is to show how to save (which format) the patched file or/and apply to original file ???? ????? ?????


How do you get the Linux shell on the terminal?


Nice introduction! Had have no idea abut Ghidra ;)


hi i have a problem: i the analyse just does not start! and if i want to select it from the menu it is gray. can someone help me please?<br>note: im using windows 10

hi i have a problem: i the analyse just does not start! and if i want to select it from the menu it is gray. can someone help me please?
note: im using windows 10


What VM were you using during this video?

None, I have a separate computer where I do this kind of stuff.


my terminal doesnt allow me to open the crack me initially, you said you're using a VM, is that a different terminal than mac's default?


awsome tutorial !! only issue why we changed char* argv[] to char **argv ??

Because Ghidra unfortunately does not support [] in the function signature - so instead of saying 'this is a pointer to an array' we say 'this is a pointer to a pointer', which gives us the result we want :) (Simplified: Working with an array in C is basically just pointer-arithmetic in the background)


Watched first 11 seconds.  subscribed.  I think I'm only subscribed to a dozen people after over a decade of being on Youtube.


wow your using this sucesfully and i fail at a baby shark singing program (basically a less trivial kinda hello world) lol.

actually ghidra seems to hate the function definitions of visual studios stdlib...


is there a way i can try this? because the crackme zip file is password protected


hi! can you reload crack me file? link is down

Тимур Акимбаев


Have you noticed that it's not possible to patch or export working exes from Ghidra?

nah it creates binaries with seg faults. @stacksmashing check this out: https://github.com/NationalSecurityAgency/ghidra/issues/19

File -> Export program didn't work for you?


Wonderful introduction! You kind of sound German


lots of day later i restarted, i thought i had to rewrite program name and make it with 10 letters. oOPps forget [1] != 1 rather 2.


It's Ghidra!!! It's not a J. It's a soft G as in gear  (not G as in generous or gentle or genius). Then it's followed by hard E, as in easy and finally dra (soft), as in dram.


So is anyone else having trouble accessing crackmes.one? Any word on how long it's going to be down.

@stacksmashing how did you get this crackme to run on macos? I can't seem to get mine to run :/

Looks like it down, will upload and host the crackme myself later today (on a plane right now)


I cant run the exec on my mac. It says "zsh; exec format error"


So there are "good" feds?

Tell me what the shot is lmao, I'm too bored and see through the veil that most content is staged and fake


not working anymore for the main function. still trying to figure out what changed

Use this instead:<br>int main (int argc, char * * argv)

Use this instead:
int main (int argc, char * * argv)


Wait, it is pronounced jai-dra not ghee-dra?<br>Learn something new everyday.

Wait, it is pronounced jai-dra not ghee-dra?
Learn something new everyday.

Ah no, It is pronounced ghee-dra afaik, or atleast that's the popular pronunciation. He himself calls it ghee-dra in later videos


Is Ghidra really safe to use?<br>I do not trust the NSA at all.

Is Ghidra really safe to use?
I do not trust the NSA at all.

@killmoo, true, but I believe there were several vulnerabilities found and fixed in Ghidra upon its release.

Now seeing as it was an in-house tool for the NSA, then they should have been able to patch these up (or at least some of them, and acknowledge that these vulnerabilities exist).

I find it hard to believe that those vulnerabilities are not, in fact, deliberately placed backdoors.

I really want to get into reverse engineering, and I only use free software, so I guess I'll have to use radare2 for the time being.

(I'm not saying radare2 is bad, it's just notoriously difficult to learn and virtually impossible to master, from what I've heard and read at this point in time.)

PS of course vulnerabilities exist in virtually every program, and it is entirely possible that these vulnerabilities slipped through, but seeing as we are talking about the NSA and their infamous reputation, I can't help but be dubious and sceptical.

(Edit: content.)


Passwords are often : crackmes.de or crackmes.one


"Just hit okay because nobody reads those anyway" Well, I guess I'm a nobody.

@benzo people with the skill & knowledge to use Ghidra are exactly the people with the skill & knowledge to find out if you've hidden something shady in it, especially since it's open source. It's the last group of people you'd want to attempt to fool.

You must know what you are agreeing to before you agree.

@benzo I highly doubt an opensource project would send data to the NSA, I feel like people are very aware of their role in the world, especially floss peeps.

@EchoXIII...GO! I do recall about 10 years ago, a very prominent software vendor had an Easter egg in the terms and conditions.  something about giving away your first born and pledging elegance to satan. It took about 5 or more years for someone to finally read it and mention it. (Mickyj Whitehat)

You sir are a thought criminal reading those agreements... tut tut..


I come here only to see what the heck ghidra is. I know nothing about reversing, executables and stuff, and I never use Mac in my lifetime, so please forgive me if my question is so stupid. 0:26 Can you really run linux elf binary on Mac?? Or have you done some "hack" before to make it possible?


Why does he pronounce it Ghidra in another video but pronounce it Ghidra in this video?


Jidra 😞😭 didnt think that video would stress me out this much 🥶🥶🤯


how anyone does not read a agreement license that mentions nsa :P


Are you running this on a vr enviroment?

@stacksmashing thank you great tutorial by the way.

@Geo Brito I in general recommend running things like this in a VM cause I've accidentally ransomwared my investigation VM before :D

@stacksmashing sorry that is exactly what i meant cool thank you for the info do you recomend running this in a VM enviroment or on my regular linux machine

Do you mean VM? I run this on a dedicated machine that I regularly wipe anyway. (And I don't think Ghidra is backdoored or anything.)


U sad that u been using it for "years" so my question is how did u know it befor vault7 leak? How long u are/been working for nsa?


Dude, it's pronounced "Ghidra"!  (j/k, was a good video)


Nice reverse engineering. wouldn't call it a crack, since you didn't patch it to allow any input ;)


I get a popup when changing to the new c standard saying Can't pass name: argv[]


GHIDRA!

The NSA program that comes with a built-in spyware and R.A.T!

*GHIDRA!*

The *NSA* program that comes with a built-in spyware and R.A.T!


It's funny that you pronounce Ghidra wrong this entire video.


comment here the password I am from another country there and it is difficult to know just by hearing the password


I thought since the g is before the h it would be pronounced as geye-druh fff<br>English has me all sorts of confused

I thought since the g is before the h it would be pronounced as geye-druh fff
English has me all sorts of confused


The crackme was a stupid crack me totally unrealistic no body codes that way in real life ........just saying  it would take me no less than 30 seconds to NOP the jumps NO KEY NEEDED .


Kyle, WTF is "Dude, it's pronounced "Ghidra"! "?  That leaves things as clear as mud.  It is pronounced GEE-druh with a hard G (as in "good").


...just hit agree because in the EULA, you sign your first child over to the NSA.

That's super bad advice.


This is ghidra , so what software is indra? Or is indra a red herring ?


@stacksmashing I think we should use immunity debugger + ghidra


Uh, like can you play Space Invaders on this? Didn't understand a thing you were talking about. Looking for old games like Pac-Man? my homie? Do you have Pac-WoMan? Dude, nomesayin