Reverse Engineering Tutorial Ghidra (TryHackMe Compiled Challenge Writeup)

In this video, we're going to solve a challenge on the CTF platform TryHackMe, namely the challenge COMPILED. This one is relatively easy and is perfect to dive into the topic of reverse engineering. Before we can start, I have to show you the mandatory disclaimer. This video is purely for educational purposes. Please don't reverse engineer any programs that don't belong to you, of which you don't have the permission to do so. Please only do so if you have an official, written order to reverse engineer it. Please don't commit any crimes. This video is only for educational purposes. TryHackMe is a legal CTF platform, which means you can practice hacking. And I'm not going to show you how to commit any bad things, but how to protect yourself against them. A few weeks ago, I explained what you need to get into game hacking. As I said, you need something like reverse engineering. Some tools were used, such as Ghidra. And I want to show you how reverse engineering looks in practice based on this challenge. As I said, this is a very simple challenge. We're going to go through it step by step. But you can already see what's going to happen to you. It's all relatively simple and simple. But in a way, it only looks much more complex when it comes to game hacking. What does the task look like? Well, we're supposed to download a file here. You can just click on the blue download button here and download it. I've already drawn a virtual machine for myself. The file is called Compiled.compiled. So that's some file that's already been written. So the source code was written and the whole thing was then converted into an executable file. As I said, I've already put this on my desktop in my Kali Linux hacking machine. And now I can try to execute this file. You can't just double-click on it. Because then nothing happens. I'm going to type in ctrl-alt-t to start the terminal. Then I make the whole thing a little bigger. Then I switch to the desktop where my file is located. And now I just call the file compiled.compiled. To start it, just a dot, a slash and then the file name compiled.compiled. I press enter and now I'm asked for a password. Of course I don't know the password. So now I type in abc123 and press enter. And then I see, hopla, try again. So that wasn't the right password. We're supposed to find out the password in this task. What is the password? So abc123 doesn't even fit the number of characters here. We could just count how many characters are needed here. And then just brute force. But that's not the point of the matter. We're going to need eternity to brute force this. Because it's a relatively long password. So we have to use reverse engineering. With reverse engineering, we're now trying to build this file compiled.compiled back somehow. So we now have the compilation, this container with a lot of 1s and 9s, based on which we can't see the source code now. But we're now trying to restore the source code or at least a similar structure that helps us understand how the program works internally. To get a little bit of information about the file, we can use the command strings. I type in strings and then compile.compiled behind it, to let us know what text we can extract from this binary file. Then we already see some information. We can go up here and see things like password do you even ctf. This %s here. Then it says correct and try again. We've already seen this try again. That was the message if we type in the wrong password. Correct, we would see that if we type in the right password. And some other information, like something that looks like a component of a password. Then here with what it was compiled and so on. So a lot of information that we can't start with. So we have to try to put it into a form that we can analyze properly. And this is where the tool developed by NSA, Ghidra, helps us. Ghidra is not standard in Kailh Linux. That means if you open Ghidra for the first time, then you would first have to type in sudo apt-get install ghidra and then download the whole thing. I've already done that here, so I just start the command ghidra directly. And I don't enter anything behind it. I don't have to enter the file name compile.compile. Just start Ghidra. Yes, that takes a few seconds now. Take a little time. But as soon as it is fully loaded, then you see this screen here. You can simply close the tip. You don't need it now. And now to load the file here, which we want to analyze, we can switch to the desktop and then select compile.compile here. Just drag it into Ghidra here. Then click OK. And you see, the dragon does his job. As soon as this window appears, just click OK. And now you just double-click on this file here. Then you are asked whether you want to analyze the whole thing here. Then you click on Yes. Down here on the Analyze button. And then you see three different sections in the window. For us, this area is relevant here first. This is the assembler code. So you can already see that this is a bit built up here, like what you might know from your lecture on technical computer science. So somehow there are such opcodes and some operators that are then processed there. Of course, all of this is not really readable for humans. And Ghidra helps you to put structure in there. You can already see a few terms like password here. Then this do you even cdf, which we have already seen. And if you look in the right area, then you see what Ghidra suspects is behind this code. So there is already a C function implemented. So this is C code. And we can now try to analyze what is written there in this section. We see that the function fwrite is called here. So that's when we start the program now. This note, please enter your password. There it is, this password. And then we saw this do you even cdf here. Here, any value is entered with scanf. And saved in a variable local underscore 28. Okay, that means that what we enter now, what is directly on this message, please enter something. So this password follows. This is now read in with scanf and saved in a variable local underscore 28. Now it gets interesting, because we want to know when this correct is issued, this here. And you see it's a very simple if-else construct. So if-else instruction, this is a if-then statement, which is then programmed. If a certain condition is met, then something else should be filled out or in this case issued. But it gets interesting down here, because here it says this correct, which should be issued. So we have a try again up here, which is triggered by this test here with the if-else instruction. And we have a try again down here, which is formulated as an else instruction. So if this condition here, if ival is equal to zero, does not apply, so is not equal to zero, then try again is issued, otherwise the correct. That means the value of ival must be zero. That means that string compare must return this value zero. Because before this if-else instruction is executed, the variable ival is again with the help of string compare assigned a value. And this time it is checked if the variable underscore 28, so our variable, which is created by entering something there as a user, whether it has the value underscore init. How do we proceed now? Well, if you know how the function scanf works, then this is actually relatively easy. But we assume we do not know that. So let's try the functionality of this program snippet here just to rebuild briefly. I have prepared this once, which is called test.c and there I have done nothing else than in my main program to define a variable. It is also called local underscore 28, there are 32 characters for provided, which then fit in there. Then I assign, enter the password again, then the scanf instruction follows, just as it is now here in our program, which we have compiled. And there we now enter something as a user. The whole thing is stored in the variable local underscore 28 and at the end we exit it, so that we can be shown what the input is. Okay, I save the whole thing with ctrl s, with ctrl x I finish that. Then I compile the program with the command gcc minus o. There I now assign what the output file should be called. It is now here, by the way, test. I hand over the program itself, which I now want to compile, as well as this compiled.compiled, so test.c. Now I press enter, no errors, that's already good. I see when I enter ls here, there is now a new program, which is called test. And I can call it as follows, by simply entering . slash test, as well as . slash compile, I can now execute programs in the same way. I press enter and am now asked for a password. Now I enter abc123 again, as before at compile.compiled. If I press enter, I see that the input is empty. How can that be? What if I now enter this do you even %s ctf here? So I start the program again and enter do you even %s ctf. What is the input there? Okay, %s ctf. So that seems to be what was entered here. How can that be? Very simple. What I now enter here, you see this do you even, that must be there, so that %s ctf is written behind it. So I have to enter do you even and then something behind it. This is then the actual password that I have to enter. So what is still missing, so that I can now enter underscore init down here in this part of the game. So I have to enter this do you even and then the actual password follows. So this is the part that will be checked later. Okay, so we can now clarify this with a second example. So I enter the program here again and say here do you even and now I enter for example underscore init So this do you even starts my string, what I have to enter and then underscore init So if I start the program now, you see, the input is init and this should lead to a true statement when we put this into the string compare here. But how does this work? Very simple, this function scanf accepts only strings in this case that start with this do you even. This is maybe a bit mean, but it shows you if you don't know the functionality of a certain function like scanf then just ask chatgpt or look in the manual. And you can find this online or you can also show it directly here in Kailinux. But it is important to recognize that this do you even has to be entered here so that this scanf processes the further input and then this %s follows what the user enters and this is saved in the variable local underscore 28. This means that if we enter do you even as a password and then underscore init then it should work and the result should be correct. To check if this is true, let's try it directly on the program. We have the compile.compile on the computer. I enter do you even as a password and it shows correct. This means that this is the correct password. I switch back to tryhack.me enter and yay the challenge was solved.