C Structures in Ghidra: How to Reverse Engineer Faster

preview_player
Показать описание
Learn how C structures can improve your reverse engineering workflow.

0:00 How I failed
0:38 How developers use C structures in their programs
3:13 Reverse Engineering C structures in Ghidra
6:10 Using structures vs no structures

~~~ 🐵 Social ~~~
  1. Path Cybersec [Slava Moskvin]
Рекомендации по теме
C Structures in 0:07:11

C Structures in Ghidra: How to Reverse Engineer Faster

Reversing Structures - 0:24:36

Reversing Structures - Ghidra Reversing Tutorials

Software Reverse Engineering 0:14:13

Software Reverse Engineering with Ghidra -- Creating Structures

Intro to Reverse 0:19:47

Intro to Reverse Engineering with GHIDRA - Lesson 5 Structures Exploit Educations Phoenix heap one

Reversing Looping Control 0:17:21

Reversing Looping Control Structures - Ghidra Reversing Tutorials

Ghidra, how to 0:06:48

Ghidra, how to make a struct

Starting Project in 0:14:25

Starting Project in Ghidra | Reverse Engineering

Part 5: Reverse 0:00:56

Part 5: Reverse Engineering: Converting assembly code to C code Ghidra Decompiler #shorts #short

Reversing Array Data 0:36:24

Reversing Array Data Structures - Ghidra Reversing Tutorials

everything is open 0:13:56

everything is open source if you can reverse engineer (try it RIGHT NOW!)

Getting Started Reversing 0:35:19

Getting Started Reversing C++ Objects with Ghidra - Ghidra Reversing Tutorials

An introduction to 0:39:39

An introduction to hacking video games with Ghidra

Ghidra Automotive ECU 0:01:31

Ghidra Automotive ECU hacking class (Bosch MED17, Infineon Tricore)

Understanding Calling Conventions 0:20:17

Understanding Calling Conventions - Ghidra Reversing Tutorials

REVERSE ENGINEERING C++PROGRAMS 0:20:10

REVERSE ENGINEERING C++PROGRAMS USING NSA GHIDRA AND PYTHON IN 2023

Software Reverse Engineering 0:14:17

Software Reverse Engineering with Ghidra -- Creating Arrays and Changing Function Signatures

Part 3: Reverse 0:00:57

Part 3: Reverse Engineering : Understanding Ghidra User Interface - Sections & Import Table

Reverse Engineering - 0:19:49

Reverse Engineering - Computerphile

You Can Learn 0:00:49

You Can Learn Assembly in 60 Seconds (its easy) #shorts

GHIDRA for Reverse 0:17:44

GHIDRA for Reverse Engineering (PicoCTF 2022 #42 'bbbloat')

Decompiling ARM raw 0:39:35

Decompiling ARM raw binary with Ghidra

Come Get Your 0:46:16

Come Get Your Free NSA Reverse Engineering Tool!

Pull apart an 0:45:28

Pull apart an EXE file with Ghidra (NSA Tool) (Reverse Engineering)

Beginner Reverse Engineering 0:12:21

Beginner Reverse Engineering | Part 2: Compiling and Decompiling (Ghidra + IDA)

Комментарии
Автор

@Path Cybersec [Slava Moskvin]  ahh, yea. It saves me a lot of time when REing a structure in a function, but it's also not amazing or perfect, so you do have to do some stuff manually!

A suggestion for your next tutorial on the subject could be how to get the size of the individual fields from the asm, as I don't think Ghidra automaticlly does that when you rename a field.

Btw, you can type the size in directly at the bottom of the structure editor, and it will create the correct amount of bytes!

Glad to see people are making RE tutorials! Hope you keep making them!

nordgaren
Автор

Sir, can you explain how to reverse engineering quickbooks with advance inventory

TheSimpleLife
Автор

Love your videos,
Although I still struggle with reverse engineering.

eyalv
Автор

Have you used the auto fill struct function to make structure dissection even faster?

nordgaren
Автор

unrealted question can you link the music used?

vedaryan
Автор

is reverse engineering and exploit development processor specific?INTEL/AMD ...can i do reversing and develop exploit with amd pc same as computers with intel processor ???? and does reversing tools like ghidra work on amd ??

anonsurf
Автор

Ну да у нас же у всех есть размер и названия полей...
Попробуй разобрать структуру о которой ты вообще ничего не знаешь и инициализируется она в стеке (без malloc).
И еще, ghidra и ida выдают разный код. Вот например в csgo есть структура netadr_t, гидра пишет что движок игры обращается к оффсету 0x28 или типа того, что вообще за пределами структуры. А IDA пишет что обращается по оффсету 5, что является вторым байтом ip адреса. А по факту они оба обращались к первому полю структуры, где хранится тип адреса (netadrtype_t) и как с этим работать? Если бы у меня не было исходников движка игры, то я бы никогда в жизни не догадался где что там. Вот например есть кс 2, там исходников уже нет и как разбираться в нем я вообще без понятия.

MrLuckyTomas