ghidra - All things reversed

ghidra

A collection of 10 posts

Flare-On 8 - Antioch

Flare-On 8 - Antioch

> To solve this challenge, you’ll need to …AAARGH This challenge was really AAARGH for me. In retrospect I wonder why I didn't see what I was supposed to see and due to that lost almost a week on this fairly easy challenge. But let's start from the beginning. We

Flare-On 8 - known

Flare-On 8 - known

> We need your help with a ransomware infection that tied up some of our critical files. Good luck. With the second challenge, it's a bit step up in the difficulty. We are given an EXE with some files (different types; images images and text) that has been encrypted. Opening file

Flare-On 8 - credchecker

The first task in this year competition. It is a single HTML file. Inside we can find a simple check for credentials. function checkCreds() { if (username.value == "Admin" && atob(password.value) == "goldenticket") { var key = atob(encoded_key); var flag = ""; for (let i = 0; i < key.length; i++) { flag += String.fromCharCode(

Don't trust the decompilers

Don't trust the decompilers

Decompilers can be your greatest ally or your greatest enemy. Basing the analysis only by the result of only one tool can fail you greatly. See for yourself. -------------------------------------------------------------------------------- Prefer to watch? Check out this video. Recently, I was solving one of the challenge from ångstromCTF 2021 and after opening

Automating Ghidra - part 3

Automating Ghidra - part 3

In the third installment of this series (if you haven't read/seen here's - part 1 & part 2) we will be reconstructing program flow. This is useful for tasks such as Towel's armageddon [https://crackmes.one/crackme/5edb0b8533c5d449d91ae73b]. -------------------------------------------------------------------------------- Note: If you prefer watching, have a look at my YouTube

Automating Ghidra - part 2

Automating Ghidra - part 2

In the last Automating Ghidra post [https://allthingsreversed.io/scripting-ghidra/] we looked at how we can script Ghidra to do some mundane operations on the Memory Map of our binary. This time we will automate renaming labels for the data based on the values. -------------------------------------------------------------------------------- During ASIS CTF 2020 a

Automating ghidra

Automating ghidra

Ghidra is an awesome RE tool that quickly took off after its initial launch in 2019. It can display not only the disassembly of our binary but also have a decompiler that allows us to see a bit higher level code. You can also extend it by using python or

TAMUCtf - leaning tower

TAMUCtf - leaning tower

There were multiple things wrong [https://ctftime.org/event/1009] with this CTF but this one challenge was an interesting one. Windows binary, no noticeable entry point and no messages on screen. It's time to use our tools to dissect this one. -------------------------------------------------------------------------------- Prefer watching? As usually, if possible, starting

Core Dumb - HitCon 2019

Core Dumb - HitCon 2019

Note: challenge was solved together with Disconnected [https://twitter.com/disconnect3d_pl]. > Damn it my flag checker is so buggy it destroyed the program itself 😱 All I left is a core dump file :( Could you help me recover the flag ? Q_Q Let's start by checking the file that we

Oldschool - CONFidence Teaser 2019

Oldschool - CONFidence Teaser 2019

> Gynvael did a survey lately to see what kind of assembly is taught in Polish universities, and if any of them is still teaching the old 8086. Let us extend this question to the CTF scene! This challenge is a clear reference to Gynvael's survey which is obvious from the