ED 307: Ghidra (15 pts) ED 307:Ghidra(15分)

What You Need for This Project你需要什么这个项目

Purpose目的

Ghidra is a new open-source tool released by the NSA. Ghidra是NSA发布的一种新的开源工具。 It is a free, easy-to-use disassembler, an alternative to IDA Pro.它是一款免费,易于使用的反汇编程序,是IDA Pro的替代品。 We'll use Ghidra to analyze compiled Windows C programs, which is the most common use case.我们将使用Ghidra来分析已编译的Windows C程序,这是最常见的用例。

Installing JDK安装JDK

Ghidra requires a Java Development Environment. Ghidra需要Java开发环境。

In a Web browser, go to在Web浏览器中,转到

https://www.oracle.com/technetwork/java/javase/downloads/index.html https://www.oracle.com/technetwork/java/javase/downloads/index.html

Click the DOWNLOAD button, as shown below.单击DOWNLOAD按钮,如下所示。

On the next page, download the correct version for your OS, as shown below.在下一页,下载适用于您的操作系统的正确版本,如下所示。

Install the software with the default options, as shown below.使用默认选项安装软件,如下所示。

Downloading and Extracting Ghidra下载和提取Ghidra

In a Web browser, go to在Web浏览器中,转到

https://ghidra-sre.org/ https://ghidra-sre.org/

Click the " Download Ghidra " button, as shown below.单击“ 下载Ghidra ”按钮,如下所示。 Save the ghidra_9.0_PUBLIC_20190228.zip file in your Downloads folder.ghidra_9.0_PUBLIC_20190228.zip文件保存在“下载”文件夹中。

Unzip the file.解压缩文件。 In Windows, don't double-click it;在Windows中,不要双击它; that just appears to unzip it.这似乎只是解压缩它。 You must right-click it, click " Extract All... ", and Extract .您必须右键单击它,单击“ Extract All ... ”和Extract

Launching Ghidra启动Ghidra

In the "ghidra_9.0_PUBLIC_20190228" window, double-click the ghidra_9.0 folder to open it.在“ghidra_9.0_PUBLIC_20190228”窗口中,双击ghidra_9.0文件夹将其打开。

If you are on a Mac or Linux, double-click ghidraRun , as shown below.如果您使用的是Mac或Linux,请双击ghidraRun ,如下所示。 If you are using Windows, double-click ghidraRun.bat .如果您使用的是Windows,请双击ghidraRun.bat

An agreement pops up.弹出协议。 Click " I Agree ".点击“ 我同意 ”。

Ghidra opens, as shown below. Ghidra打开,如下所示。

In the little "Tip of the Day" box, click the Close button.在“每日提示”框中,单击“ 关闭”按钮。

Downloading Files to Analyze下载要分析的文件

Ghidra lets you look inside executable files and see how they work. Ghidra让您查看可执行文件,看看它们是如何工作的。 To see it go, we need some files to examine.要看到它,我们需要一些文件来检查。

One by one, right-click the links below and download the files.一个接一个,右键单击下面的链接并下载文件。 Save them in your Downloads folder.将它们保存在Downloads文件夹中。

Running the Files (Optional)运行文件(可选)

If you are using Windows, you can run these programs to see what they do.如果您使用的是Windows,则可以运行这些程序以查看它们的用途。 If you aren't using Windows, you can skip this section.如果您不使用Windows,则可以跳过此部分。

Click Start , " File Explorer ".单击开始 ,“ 文件资源管理器 ”。 In the left pane, click Downloads .在左侧窗格中,单击“ 下载”

At the top left of this window, click File , " Open command prompt ", " Open command prompt ", as shown below.在此窗口的左上角,单击文件 ,“ 打开命令提示符 ”,“ 打开命令提示符 ”,如下所示。

In the Command Prompt, execute these commands:在命令提示符中,执行以下命令:

crackme-121-1.exe的crackme-121-1.exe
crackme-121-1.exe password123 crackme-121-1.exe密码123
This is a simple password guessing game.这是一个简单的密码猜谜游戏。 Unless you enter the correct password, it says "Fail!", as shown below.除非您输入正确的密码,否则会显示“失败!”,如下所示。

Close the Command Prompt window.关闭命令提示符窗口。

Importing the File into Ghidra将文件导入Ghidra

In the "Ghidra:NO ACTIVE PROJECT" window, at the top left, click File , " New Project... ".在“Ghidra:NO ACTIVE PROJECT”窗口的左上角,单击File ,“ New Project ... ”。

In the "Select Project Type" page, accept the default option of " Non-Shared Project " and click Finish .在“选择项目类型”页面中,接受默认选项“ 非共享项目 ”,然后单击“ 完成”

In the "Select Project Location" page, enter your name into the "Project Name" field, as shown below, and click Next>> .在“选择项目位置”页面中,在“项目名称”字段中输入您的名称,如下所示,然后单击下一步>>

In the "Ghidra:YOURNAME" window, at the top left, click File , " Import File... ".在“Ghidra:YOURNAME”窗口的左上角,单击“ 文件 ”,“ 导入文件... ”。

In the "Select File to Import" window, double-click Downloads and double-click crackme-121-1.exe .在“选择要导入的文件”窗口中,双击“ 下载” ,然后双击“ crackme-121-1.exe”

A box pops up.弹出一个框。 Click OK .单击确定

After a few seconds, an "Import Results Summary" box appears, as shown below.几秒钟后,将出现“导入结果摘要”框,如下所示。

Click OK .单击确定

Analyzing the File in Ghidra分析Ghidra中的文件

In the "Ghidra:YOURNAME" window, at the center, double-click crackme-121-1.exe , as shown below.在“Ghidra:YOURNAME”窗口的中间,双击crackme-121-1.exe ,如下所示。

A big window opens, with an "Analyze" box on top, as shown below.打开一个大窗口,顶部有一个“分析”框,如下所示。 In the "Analyze" box, click Yes .在“分析”框中,单击“ 是”

In the "Analyze Options" box, click Analyze .在“分析选项”框中,单击“分析”。

In the "Auto-Analysis Summary" box, click OK .在“自动分析摘要”框中,单击“ 确定”

The main Ghidra window appears, showing the assembly code for the file in the large central pane, beginning at address 00400000 with the letters "MZ", as shown below.出现主Ghidra窗口,显示大型中央窗格中文件的汇编代码,从地址00400000开始,字母为“MZ”,如下所示。

All Windows executables start with those letters, at that relative address.所有Windows可执行文件都以相对地址的字母开头。

Cleaning Up the Display清理显示器

On the left side, there are three small boxes titled "Program Trees", "Symbol Tr", and "Data Type Man..".在左侧,有三个小方框,标题为“程序树”,“符号Tr”和“数据类型人...”。 Close them.关闭它们。

Finding Strings寻找字符串

From the menu bar, click Window , " Defined Strings ".从菜单栏中,单击“ 窗口” ,“已定义的字符串 ”。

On the right side, a box appears showing readable strings.在右侧,出现一个显示可读字符串的框。

Click Fail!点击失败! .

The left pane shows the address where that string is stored, as shown below.左侧窗格显示存储该字符串的地址,如下所示。

In the left pane, on the line showing the "Fail!\n" string, on the right side, after the "XREF" label, double-click FUN .在左侧窗格中,在显示“Fail!\ n”字符串的行上,在“XREF”标签后的右侧,双击FUN

The left pane shows the assembly code that uses this string, with a "PUSH" command, as shown below.左侧窗格显示使用此字符串的汇编代码,带有“PUSH”命令,如下所示。

Viewing Decompiled Code查看反编译代码

On the right side, close the "Defined Strings" pane.在右侧,关闭“Defined Strings”窗格。

A "Decompile" pane appears, as shown below.将出现“反编译”窗格,如下所示。

This is readable C code, and you can easily see that the password is topsecret这是可读的C代码,您可以很容易地看到密码是topsecret


ED 307.1: crackme-121-2 (5 pts) ED 307.1:crackme-121-2(5分)

Analyze crackme-121-2 in IDA.分析IDA中的crackme-121-2。 Find the password.找到密码。 Run the program in a Command Prompt with the correct password and verify that it produces the "Congratulations" message.使用正确的密码在命令提示符中运行该程序,并验证它是否产生“祝贺”消息。

The password is the flag.密码是标志。


ED 307.2: crackme-121-3 (5 pts) ED 307.2:crackme-121-3(5分)

Analyze crackme-121-3 in IDA.分析IDA中的crackme-121-3。 Find the password.找到密码。 Run the program in a Command Prompt with the correct password and verify that it produces the "Congratulations" message.使用正确的密码在命令提示符中运行该程序,并验证它是否产生“祝贺”消息。

The password is the flag.密码是标志。


ED 307.3: crackme-121-4 (5 pts) ED 307.3:crackme-121-4(5分)

Analyze crackme-121-4 in IDA.分析IDA中的crackme-121-4。 This one is different.这个是不同的。 Find the complete command line required to see the "Congratulations" message.找到查看“祝贺”消息所需的完整命令行。

The flag is that complete command line, like this:标志就是完整的命令行,如下所示:

notepad.exe topsecret

References参考

Ghidra Installation Guide Ghidra安装指南


Posted 3-7-19发表于3-7-19
Revised for WCIL 5-22-19为WCIL 5-22-19修订