Today, I'm going to be showing you guys how to reverse engineer a simple license checker program by using Ghidra.

Today, I'm going to be showing you guys how to reverse engineer a simple license checker program by using Ghidra, Gidra, however you say it. You can use other programs like IDA Pro, X64 debugger, something like that, I think that's what it's called to do this, but today I'm going to be showing you how to do it with Ghidra because that's been my favorite software to use so far. Plus it is free to use and I believe IDA Pro at least is paid for. I'm not sure about X64 debugger, but anyways, let's just get into the video. So after installing Ghidra public, I'm doing this on Kali Linux, it might be different on Windows or other systems. After installing Ghidra, you enter the directory and you click Ghidra run and yeah, just run it. That is how you get it started in Kali Linux. Today we're going to be using this little thing called license checker one. The link to the crack me will be in the description below. But yeah, after getting Ghidra started and everything, sorry if I'm saying it wrong, I'm just going to say Ghidra. But yeah, after getting Ghidra started again, just click import file. So after you get the file imported, you are going to double click on it to open it in Ghidra. A license checker one has not been analyzed. Would you like to analyze it now? You're going to click yes. You don't have to check mark any of these, but the one I like to check mark to make things a little bit easier to read is the compiler parameter ID. After check marking that, if you'd like, you're going to click analyze and you are going to wait for the program to load. If all this looks confusing to you, don't worry, I will explain everything in a little bit. What this side is is the machine code or the assembly code of the program. This is the closest version to a human readable version of machine code and same program called assembly. I'm not going to explain every single thing to do with assembly. Basically, all you need to know for this video at least, besides ones and zeros, this is the closest thing that humans have to a readable version of machine code. And if it looks confusing, don't worry, it is. If you ever see videos online that are saying like, oh, assembly is actually a really easy language to learn, it's not that hard, they are fucking lying to you. It is very difficult to learn. It is not easy to learn at all. It is very confusing. So with that little window on the right hand side that just came up a minute ago, that is very important. Let me pull up the main function. So this is the main function where the program runs. And basically this is the, this is basically the, the closest version Ghidra could get to the C of the C version of this code on the left hand side. Let's see how this program actually runs, so we can get an idea of what we are working, working with. So as you see, it says usage license checker one, license key here. So we're going to put a random license key, just a bunch of two, three and twos and all that stuff. Doesn't matter what you do. I do not have the answer at the moment. Yeah, so whatever we put, it's not going to be a valid license key. So we are going to crack this real quick. So we're going to, this is the easier version, but I'm going to show you guys the more advanced reverse engineering type of version in a minute. So as you see, with usual crack me challenges that are just on this level of easy, it's pretty simple to read. So in the C code on the right hand side over here, you can see that it says if this variable, which is the variable that is reading, that is getting passed to this message right here, this variable, I mean, I don't know, sorry, I'm terrible at explaining code. But all you need to know is that this variable is the argument that you're passing in to, it's basically the, the mess, like what comes after this. So, sorry, I'm, I'm better at explaining things in action, not by just looking at thin air and trying to explain it from there. So when you type license checker one, basically what this code is doing, when you put in a license checker one, it says a license key here. It's doing that because the executable is the first argument that is getting passed into the C code, but there's nothing getting passed in the second one. So it goes to this line. So it gets passed into this line right here. So if there is an argument, but it isn't, it is incorrect, it's not the right license, it's going to be passed into this argument over here. And as you can see, on this part of the code, it says, it's been, I don't want to explain every single part, but it's basically saying that if the second argument of the C code is this message right here, then the license is valid. So this is obviously a very easy crack me. You can literally just pull it up and see the right license key right here. This is not how other reverse engineering, usual reverse engineering goes. Like no Photoshop platform is just going to leave the license, a license right in the source code. No, none of them will ever do that. It won't let me copy it into here for some reason, so I'm just going to have to manually type it in. Yep, so as you can see, if bar, a variable one equals zero, which is basically a success code in C language, it means it's right. If our, yeah, if this is correct, this gets passed into here and it put and it prints this message out. So this was the right, uh, this was the right license, it's basically saying. But let's say, since this was a very easy to do reverse engineer and none, I, I know that this is not what y'all are looking for. Y'all are, y'all are looking to actually learn how to reverse engineer something or patch a program. So you can modify the program basically. So let's say if we could get this program instead of saying, oh, only if you enter this message right here, it gives you a success code. Let's say if we could take that actually and make it to where it prints a success code no matter what. So that is what, that is the main goal in this today's video. So what we will be doing is patching this program so it always prints this congratulations message. So again, this is a very simple tutorial. Not all reverse engineering scenarios are going to be like this. No, none of them are, this is a very easy crack me, but it is somewhat realistic. So what we will be doing, we're going to be finding where this print message gets sent on the assembly code. So as you see, it gets sent over here. But where does this actual if statement get, uh, print out? So it gets printed over here. And on this assembly line right here, we have what's called a JNZ or Jenz, something like that, in assembly or machine language, whatever you want to call it. And basically what this means is jump if not zero. And it is, it's what's called, it is a conditional jump. So it is basically saying if it meets a certain condition and if the message is correct or it meets zero, which is a success code in C, um, jump to this line right here. Wait, oh wait, no. Uh, yeah, well these are conditionals, but um, yeah, if it is right, just it jumps to this message right here. So, or if it is wrong, if, if it doesn't meet the condition, then it will be printed, it will be printing this right here. So what we will be doing is modifying this line right here and exporting it so it actually prints this message no matter what. So to modify this to where it actually prints the success message no matter what, we are going to be finding this right here. So this is the line that prints the in the assembly code that prints the success message. So we're going to find the address, the, the, I believe it's the address or pointer address. Again, I'm pretty new to, to this too, so sorry if I'm getting some of this wrong. So we're going to be finding this little memory address right here and making a, and changing this to a jump condition and changing the address of this, which is, I believe this is the failure message. Yeah, this is the failure message. So we're going to be changing this to always print out the success message, which is right here. Actually, let's first, uh, click on this line, control shift G. Just will, basically get the instruction ready for patching, or patch instruction, whatever you want to call it. So after it's done, if it says something like gold, then you're good to go. I, I've never seen it say anything otherwise for me. Um, but yeah, if it's gold, you're good to go, don't worry. So what we're going to do is change JNZ to jump because the reason we're doing this is because jump in assembly means that the program will always jump to this specified address. So, we're going to click jump and then we're going to modify this memory address to the congratulations message. So, the the message that prints congratulations is actually right here, it's right below, so you don't really need to look too far to get to it. So, we're going to type OXO, O1011C7. So, it's going to jump to this address no matter what, if I got this right at least. Um, but yeah, it looks to be getting printed good. If it, if it doesn't work, it will definitely say something. So, after we get, after we change this, we're going to export the program. Go to the top left, click file and go to export. And we are going to click format. Actually, yeah, oh yeah, click format and go to original file. And we're going to change the name so it doesn't interfere with the other one. Let's just name it license checker one patched. And that is it. Now we're going to click okay. Now it is exported to our directory. So, we're going to pull, pull it up. So, as you can see, it is right here, but we need to make it an executable. So, it gets printed out. So, now is an executable program. So, I'm pretty sure it should print the congratulations message no matter what, even without, yeah, you still need to enter a license key. So, yeah, what at no matter what message you print, it will enter the congratulations message. So, uh, yeah, let's run it again. Yeah, see, it always prints the congratulations message. So, that is a very, that is a very simple patch in reverse engineering. Uh, again, this isn't going to work for things like Photoshop or games or anything like that. That obviously takes a much higher level of reverse engineering, and I cannot teach that in that video, in this video, because one, I suck and I'm not good enough for that. Um, I'm pretty new to reverse engineering. It's very fun to me, but I'm not that good at it. Not good at it at all, actually. Um, but I have not seen many tutorials, uh, on this, on this topic that actually teach you like raw reverse engineering. Uh, so, yeah, I wanted to make a video on a basic crack me, which I figured out. And, um, yeah, I wanted to show you guys a different way to get the program right, besides just entering the license key. I want to show you guys how to actually patch the program so it always, uh, prints the, uh, congratulations message. In my opinion, I think crack me's are fun when you can get, or reverse engineering is fun where you're not looking for the message, but you're actually manipulating the program to always, um, print the correct message. So, or the flag, whatever you want to call it. So, I hope y'all learned something in this video today. Um, if you guys want to see more videos like this, please let me know. I will, or if y'all have any other ideas, please let me know. Uh, if y'all enjoyed the video, please let me know. If y'all hated it, please let me know so I know what kind of content to stay away from. But either way, I hope you guys have a good day and, uh, yeah, I will see you all in the next one. Bye.