Lab 04 - Intro to C++ assembly reversing and Ghidra

Objectives:

• Learn some of the distinctive features of binaries that were created using C++
• Install and use the Ghidra software reverse engineering suite of tools and use it in static binary analysis of some simple binaries.

Materials

Lab archive. Unzip using:unzip lab04.zip. Password is lab04.

Step 1

Install Ghidra in your linux virtual (or real) machine: https://ghidra-sre.org/InstallationGuide.html

Step 2

Watch the following video introduction to Ghidra in which the narrator solves a simple crackme - without reading any assembly! You will be wondering why we didn't use Ghidra since the first day. The reason is that I like to teach you to drive on manual mode before going on automatic because I think it forces students to understand some low level stuff that could go unnoticed otherwise.

Step 3

No se por qué he escrito el resto de la asignación si los próximos videos están en español.

Vea le siguiente video corto sobre disassembly de programas de C++.

Step 4

El enredo continúa. Ahora veanme sudando frio tratando el reverse engineering the un binario usando ghidra y gdb. El binario que estoy analizando es crk2.

Ejemplo usando Ghidra 1/4

Ejemplo usando Ghidra 2/4

Ejemplo usando Ghidra 3/4

Ejemplo usando Ghidra 4/4

Step 5

En el file que descargaste al principio encontrarás los siguientes ejecutables:

• chupi
• strcmp
• bacalaito

chupi

Someone has messed with the binary chupi. The address provided to libc_start_main is not correct. Please fix it. When you solve it correctly you should get a flag.

strcmp

Find how to run the strcmp binary so that it prints the successful message. If not successful, it won't print anything.

bacalaito

Find the cd-key

Analízalos y rinde un informe sobre tu procedimiento y los resultados.