Тёмный

Ghidra quickstart & tutorial: Solving a simple crackme 

stacksmashing
Подписаться 217 тыс.
Просмотров 340 тыс.
50% 1

Опубликовано:

 

2 окт 2024

Поделиться:

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист
Посмотреть позже
Комментарии : 268   
@MrMasterRhythm
@MrMasterRhythm 5 лет назад
Please create a series of Reverse Engineering Basics! Love this!
@frankdai
@frankdai 5 лет назад
"Let's maximize the window" > Actually makes windows smaller
@ytxstream
@ytxstream 4 года назад
And that's Mac OS for you
@Tedd755
@Tedd755 4 года назад
@@ytxstream ⌘ + ⌥ + d is your friend
@The_Ballo
@The_Ballo 4 года назад
@@ytxstream *Java's half-assed implementation of
@powershellaxp64
@powershellaxp64 4 года назад
He actually just moved it to the right.
@soulife8383
@soulife8383 3 года назад
^^ effing owned dude... 😅 By a Polock Frank... sick digs
@goosenp
@goosenp 5 лет назад
Brilliant "in a nutshell" tutorial of getting to know the program quickly. Could you please do a follow-up of the very same crack me, but with showing how you "crack" the crackme by patching the binary inside Ghidra so that it always jumps to the success condition regardless of the input given?
@gilperon
@gilperon 5 лет назад
Wow is that even possible with ghidra?
@zitronenwasser
@zitronenwasser 5 лет назад
Gil Bytepatching should be simple, worst case you just use like a Hex Editor and jump to the offset and manually patch ig
@hyronharrison8127
@hyronharrison8127 4 года назад
@@gilperon its possible i. Gdb, i would hope so! :)
@0xUltraHex
@0xUltraHex 4 года назад
4:07 "a small popup will show up." popup occupies most of screen.
@recklessroges
@recklessroges 5 лет назад
Its like the perfect purity of a man page was compiled into a perfect video. Instructions so clear I accidentally cracked the travelling knapsack problem.
@Malaphor
@Malaphor 5 лет назад
"Just hit okay because nobody reads those anyway" Well, I guess I'm a nobody.
@EchoXIIIGO
@EchoXIIIGO 5 лет назад
You sir are a thought criminal reading those agreements... tut tut..
@MichaelJenkin
@MichaelJenkin 5 лет назад
@@EchoXIIIGO I do recall about 10 years ago, a very prominent software vendor had an Easter egg in the terms and conditions. something about giving away your first born and pledging elegance to satan. It took about 5 or more years for someone to finally read it and mention it. (Mickyj Whitehat)
@thatcrockpot1530
@thatcrockpot1530 4 года назад
@benzo I highly doubt an opensource project would send data to the NSA, I feel like people are very aware of their role in the world, especially floss peeps.
@bitterlemonboy
@bitterlemonboy 4 года назад
You must know what you are agreeing to before you agree.
@b213videoz
@b213videoz 3 месяца назад
In dialog boxes like that the only buttonnshould be renamed from "Ok" to "Whatever" 🤪
@andreww3575
@andreww3575 5 лет назад
Fantastic. Hopefully looking forward to more of the same.
@MichaelJenkin
@MichaelJenkin 5 лет назад
Nice, I was looking for samples with known outcomes so I could follow the technique ! Awesome . (Mickyj Whitehat)
@cvspvr
@cvspvr 4 года назад
you've literally got a black hat on. don't lie
@S00mbre
@S00mbre 5 лет назад
Crystal-clear, methodical and systematic walkthrough! Thank you!
@calmic9838
@calmic9838 Год назад
How are you able to run the Unix binary file. Im getting: ```zsh: exec format error: ./rev50_linux64-bit```
@urugulu1656
@urugulu1656 5 лет назад
wow your using this sucesfully and i fail at a baby shark singing program (basically a less trivial kinda hello world) lol. actually ghidra seems to hate the function definitions of visual studios stdlib...
@l1703
@l1703 4 года назад
wow this tutorial is just perfect, the pace the explanations, everything ! Thank you
@dzikibill6756
@dzikibill6756 5 лет назад
I love it , already subscribed !
@juozasmiskinis3590
@juozasmiskinis3590 5 лет назад
Thanks ninja! A very well prepared video. Hopefully more will come :)
@Collidedatoms
@Collidedatoms 5 лет назад
It's Gee-druh, not jeye-druh
@ashxxiv
@ashxxiv 5 лет назад
I thought since the g is before the h it would be pronounced as geye-druh fff English has me all sorts of confused
@williamsquires3070
@williamsquires3070 4 года назад
Interesting. When I put the C function prototype for a main() function in, Ghidra wouldn’t even accept “[]”, and I had to use an extra “*” anyway.
@jwdsoft
@jwdsoft 4 года назад
I hope that you create a beginner series in reverse engineering embedded firmware
@frederick3524
@frederick3524 4 года назад
You have 13.2K subscribers and only 3 videos from 8 months ago! This was such a great video, I was disappointed to see you didn't have more content.
@tyrrelldavis9919
@tyrrelldavis9919 4 года назад
Tech RU-vidrs always have their view count scaled way down
@arthurdark3945
@arthurdark3945 Год назад
You know its a good hacking tool when it uses Windows 95 style GUI.
@liberator48
@liberator48 3 года назад
Can you explain what argv[0] is? If argv[1] is the array of arguments.
@stacksmashing
@stacksmashing 3 года назад
argv[0] is the program Name, 1 is the first argument, 2 the second argument etc :) So if you call “ls /etc” argv[0] contains “ls”
@mitfreundlichengrussen1234
@mitfreundlichengrussen1234 5 лет назад
Thank you - and pls. continue the work. PS: made me smile.
@theleopards4198
@theleopards4198 5 лет назад
amazing man keep uploading ghidra tutorials
@todayschef1734
@todayschef1734 4 года назад
It's pronounced GHEE dra
@TheMadMagician87
@TheMadMagician87 5 лет назад
Excellent explanation. Clear, concise and a great pace, wasn't confusingly fast or laboriously slow. I hope you continue to make videos on Ghidra.
@urnan7499
@urnan7499 3 года назад
Jidra 😞😭 didnt think that video would stress me out this much 🥶🥶🤯
@اطلبالحقوالرحمة
Thank you Ghidra Ninja. You are a true Ninja!!
@negritoojosclaros
@negritoojosclaros 8 месяцев назад
very good video! Im already applying for NSA!
@bv1495
@bv1495 5 лет назад
Jesus you make it look so easy !! Love it ! Keep em coming my friend.
@edgeeffect
@edgeeffect 3 года назад
I had a quick look at Ghidra a few weeks ago and it seemed rather complex.... It certainly seems a lot less complex now! Thanks.
@c2ashman
@c2ashman 4 года назад
AAA content. Grüße aus Deutschland
@willmcpherson2
@willmcpherson2 3 года назад
Beat tutorial I’ve ever seen. Clear, concise and simple.
@10dragon456
@10dragon456 5 лет назад
What VM were you using during this video?
@stacksmashing
@stacksmashing 5 лет назад
None, I have a separate computer where I do this kind of stuff.
@m4heshd
@m4heshd 3 года назад
What Microsoft did right is "Maximize" and the taskbar.
@encryptedmind6952
@encryptedmind6952 5 лет назад
awesome video man,keep doing more basic malware analyasis and reversing.Thanks:)
@dsuess
@dsuess 3 года назад
For future listeners, Ghidra is pronounced, "Gee-druh"; [3] /ˈɡiːdrə/[4]). Source: github.com/NationalSecurityAgency/ghidra/wiki/Frequently-asked-questions#how-do-you-pronounce-ghidra Great video, and well-explained usage. Keep up the great work.
@somedude5414
@somedude5414 2 года назад
(Thank you classic Godzilla movies.)
@MiserableLemon
@MiserableLemon 5 лет назад
my terminal doesnt allow me to open the crack me initially, you said you're using a VM, is that a different terminal than mac's default?
@varyktv
@varyktv 6 месяцев назад
Great video! You explain things really simply. One question I have: can you use Ghidra to compare two similar .dll written in C++ files to find the differences between them?
@nuszkat9953
@nuszkat9953 4 года назад
Waiting for more videos from you.
@mohd1501
@mohd1501 5 лет назад
Liked your explaination, easy and clear. Keep going please.
@NasirKhan-kh4zq
@NasirKhan-kh4zq 3 года назад
Thanks for wonderful tutorial. Subscribed.
@playnikko
@playnikko 4 года назад
Great job explaining - thank you!
@nextproject9908
@nextproject9908 4 года назад
I hope you teach me more about reverse , please create tutorial on udemy , i will subscribe you
@pouncerminned863
@pouncerminned863 5 лет назад
Just curious as I just learned that this tool exists, what is difference using this vs ollydbg for cracking? Other than assembly
@pastuh
@pastuh 4 года назад
Interesting why it throws error: Invalid Function Signature But you edited at 06:37 without problem.. Maybe new version is aware it must be array :)
@letsplayer9558
@letsplayer9558 4 года назад
How can i fix this error? I'm at the moment a noob at programming.
@tyrrelldavis9919
@tyrrelldavis9919 4 года назад
@@letsplayer9558 the LARP groups are showing people how to use this shit lmao, hire me LARP people, I don't second guess stuff when I know what the shot is
@Tecnoesclavos
@Tecnoesclavos 4 месяца назад
First Step. Error. Invalid Function Signature Can't parse name: argv[] Do you want to continue editing or abort your changes?
@stacksmashing
@stacksmashing 4 месяца назад
Set it to char ** argv instead of char * argv[] That’s also how it’s in the video in the second step - I assume [] is now reserved
@Tecnoesclavos
@Tecnoesclavos 4 месяца назад
@@stacksmashing yep it works, thank you!
@stacksmashing
@stacksmashing 4 месяца назад
No worries :) hope they eventually support that syntax
@karimessalim
@karimessalim 5 лет назад
Great job
@dvarshanidze
@dvarshanidze 5 месяцев назад
./rev50_linux64-bit: cannot execute binary file. I use mac m1. what to do in this case.
@Kjmhv
@Kjmhv 5 лет назад
can you plz tell the ZIP password here
@ThatBeastEDM
@ThatBeastEDM 4 года назад
Passwords are often : crackmes.de or crackmes.one
@tokayevkz
@tokayevkz 5 лет назад
hi! can you reload crack me file? link is down
@stacksmashing
@stacksmashing 5 лет назад
Will do later today!
@datenraffzahn6094
@datenraffzahn6094 3 года назад
Many thanks for suggesting this software ... I wanted to look into reverse engineering for years, but had not yet come across such an handy tool. AIDA wasn't really affordable for experimenting ... Again thank you very much!
@shrutilondhe3401
@shrutilondhe3401 8 месяцев назад
Hey when trying to search for main it doesnt show any results and the main function i guess in some format like FUN_11001 some numbers can you tell me some settings to resolve this?
@osamazaid25
@osamazaid25 5 лет назад
Great video. I learned a lot from it.
@nan6962
@nan6962 3 года назад
hello, i have followed the same steps as you but my main function looks different. and it says no function in decompiler. please help
@christullier2410
@christullier2410 3 года назад
I'm having the same problem
@tomay3000
@tomay3000 3 года назад
Thank you, very instructive.
@kokop1107
@kokop1107 5 лет назад
Great video. But could you make a video comparing Ghidra to IDA or some other RE tools?
@johnqpublic8126
@johnqpublic8126 2 года назад
It's called Ghidra, like gidra, not jhidra...
@HardCoded31103
@HardCoded31103 3 года назад
Great job
@georgensa3942
@georgensa3942 5 лет назад
love it bruh... keep it up
@valshaev1145
@valshaev1145 4 года назад
Nice introduction! Had have no idea abut Ghidra ;)
@happyked
@happyked 5 лет назад
Nice video! Do you plan on making more? Id love to see more videos on Ghidra :)
@kawuschel1518
@kawuschel1518 5 лет назад
Are you on a Mac or is this a Vbox
@sahilshankar2769
@sahilshankar2769 5 лет назад
How do you get the Linux shell on the terminal?
@stacksmashing
@stacksmashing 5 лет назад
It’s a SSH connection into a VM
@sahilshankar2769
@sahilshankar2769 5 лет назад
Ah I see. Thanks for the reply
@gabrielwilliams6373
@gabrielwilliams6373 5 лет назад
Is Ghidra really safe to use? I do not trust the NSA at all.
@gabrielwilliams6373
@gabrielwilliams6373 5 лет назад
@killmoo, true, but I believe there were several vulnerabilities found and fixed in Ghidra upon its release. Now seeing as it was an in-house tool for the NSA, then they should have been able to patch these up (or at least some of them, and acknowledge that these vulnerabilities exist). I find it hard to believe that those vulnerabilities are not, in fact, deliberately placed backdoors. I really want to get into reverse engineering, and I only use free software, so I guess I'll have to use radare2 for the time being. (I'm not saying radare2 is bad, it's just notoriously difficult to learn and virtually impossible to master, from what I've heard and read at this point in time.) PS of course vulnerabilities exist in virtually every program, and it is entirely possible that these vulnerabilities slipped through, but seeing as we are talking about the NSA and their infamous reputation, I can't help but be dubious and sceptical. (Edit: content.)
@elysian778
@elysian778 Год назад
what if you press dont agree
@MichaelClampett
@MichaelClampett 4 месяца назад
great tutorial - but it's not jai-druh, it's gee-drah
@namenone8387
@namenone8387 4 года назад
wow, nice introduction man. looking forward for more videos from you!
@5urg3x
@5urg3x 5 месяцев назад
Why is this in Java lol I hate Java
@agentstona
@agentstona 2 года назад
The crackme was a stupid crack me totally unrealistic no body codes that way in real life ........just saying it would take me no less than 30 seconds to NOP the jumps NO KEY NEEDED .
@stacksmashing
@stacksmashing 2 года назад
That's why it's a simple crackme :)
@rosyidharyadi7871
@rosyidharyadi7871 4 года назад
I come here only to see what the heck ghidra is. I know nothing about reversing, executables and stuff, and I never use Mac in my lifetime, so please forgive me if my question is so stupid. 0:26 Can you really run linux elf binary on Mac?? Or have you done some "hack" before to make it possible?
@apateonaeagle9928
@apateonaeagle9928 4 года назад
How difficult is to show how to save (which format) the patched file or/and apply to original file ???? ????? ?????
@jimreynolds2399
@jimreynolds2399 3 года назад
It's Ghidra!!! It's not a J. It's a soft G as in gear (not G as in generous or gentle or genius). Then it's followed by hard E, as in easy and finally dra (soft), as in dram.
@nxxxxzn
@nxxxxzn 5 лет назад
very thorough. thanks
@jaybailey216
@jaybailey216 3 года назад
Kind of a dumb question but how did you get your keystrokes to show up on the screen like that?
@user-tj2qj5tm1f
@user-tj2qj5tm1f Год назад
Ich glaub mein Pferd pfeift, das ist ja ein geiles Tool.
@anntakamaki1960
@anntakamaki1960 Год назад
Nice video, but I have a question. Is it possible to get the flag without putting the password? Since the flags stored somewhere within the file, right?
@LeeFall
@LeeFall 4 года назад
Would love to try this but I'm not putting anything made by the NSA on my PC lol
@NeXuSInfoS3c
@NeXuSInfoS3c 5 лет назад
fucking awesome
@rfeil8443
@rfeil8443 4 года назад
Could you please make a tutorial on how to skirt the Mac OX Catalina 10.15.8 and download Ghidra? I really want to start using Ghidra but my mac will not allow the Javascript updates ...
@buzifalus
@buzifalus 2 года назад
Great tutorial, kudos! Can you elaborate why is there an issue requiring the usage of a pointer to a pointer for argv ?
@blackhorse8427
@blackhorse8427 3 года назад
U sad that u been using it for "years" so my question is how did u know it befor vault7 leak? How long u are/been working for nsa?
@complexitytr9098
@complexitytr9098 3 года назад
lots of day later i restarted, i thought i had to rewrite program name and make it with 10 letters. oOPps forget [1] != 1 rather 2.
@SaintSaint
@SaintSaint 4 года назад
Watched first 11 seconds. subscribed. I think I'm only subscribed to a dozen people after over a decade of being on RU-vid.
@michaszwaczko6562
@michaszwaczko6562 2 года назад
It is pronounced gee dra nor jeay dra
@pswalia2u
@pswalia2u 5 лет назад
awsome tutorial !! only issue why we changed char* argv[] to char **argv ??
@stacksmashing
@stacksmashing 5 лет назад
Because Ghidra unfortunately does not support [] in the function signature - so instead of saying 'this is a pointer to an array' we say 'this is a pointer to a pointer', which gives us the result we want :) (Simplified: Working with an array in C is basically just pointer-arithmetic in the background)
@olee_7277
@olee_7277 4 года назад
this tutorial is very jay
@tyrrelldavis9919
@tyrrelldavis9919 4 года назад
So there are "good" feds? Tell me what the shot is lmao, I'm too bored and see through the veil that most content is staged and fake
@888snuffy
@888snuffy 5 лет назад
I get an error "decompile.exe" not found when disassembling. Anyone know why?
@TheUnusualSuspect101
@TheUnusualSuspect101 5 лет назад
awesome tutorial - keep them coming man!
@Messothelioma
@Messothelioma 3 года назад
Why does he pronounce it Ghidra in another video but pronounce it Ghidra in this video?
@ashokvj8342
@ashokvj8342 5 лет назад
Thanks man for the knowledge you are awsm
@avtem
@avtem Год назад
Great video! Do you know how to hide the project window? i'd love to hide that window once i ran the code browser
@arejay988
@arejay988 5 лет назад
awesome tutorial - keep them coming man!
@AtlasMTBRider
@AtlasMTBRider 5 лет назад
I remember solving that very same Crack me with Hopper. thanks for the video, I have not given GHIDRA a try yet. I'm still learning how to pronounce it correctly :)
@micah9382
@micah9382 5 лет назад
It is pronounced "Gee-druh" (github.com/NationalSecurityAgency/ghidra/wiki/Frequently-asked-questions#how-do-you-pronounce-ghidra), but that's okay. This video was a very nice introduction, by the way!
@alienencore3848
@alienencore3848 5 лет назад
It's funny that you pronounce Ghidra wrong this entire video.
@stacksmashing
@stacksmashing 5 лет назад
Indeed :) I fixed it in the other ones.
@dustincthornton
@dustincthornton 3 года назад
not working anymore for the main function. still trying to figure out what changed
@emulacionretro5800
@emulacionretro5800 3 года назад
Use this instead: int main (int argc, char * * argv)
@jtw-r
@jtw-r Год назад
love the “NSA-Mainframe” on your terminal. I let out a good laugh at that!
@renovatiovr
@renovatiovr 4 года назад
it is pronounced gheedra
@0xm3trix
@0xm3trix 4 года назад
The video was very helpful, keep it up bro👍👍
@achuthvp5257
@achuthvp5257 4 года назад
This was a great video. Amazing explanation but if you could speak a little louder and also put in some energy into your voice it would be even better
@cyberuser0
@cyberuser0 Месяц назад
that was really good, ty !
@k0tigrun
@k0tigrun 3 года назад
What VM do you use for running Linux code in OSX?
Далее
HackadayU: Reverse Engineering with Ghidra Class 1
1:05:06
#kikakim
00:10
Просмотров 12 млн
НОВАЯ "БУХАНКА" 2024. ФИНАЛ
1:39:04
Просмотров 173 тыс.
How to Crack Software (Reverse Engineering)
16:16
Просмотров 573 тыс.
Google CTF - BEGINNER Reverse Engineering w/ ANGR
39:47
Reverse Engineering Malware with Ghidra
1:13:43
Просмотров 5 тыс.
I Reverse Engineered this Program Automatically.
16:53