> For the complete documentation index, see [llms.txt](https://abdulazim.gitbook.io/write-up/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://abdulazim.gitbook.io/write-up/reversing-elf-tryhackme/reversing-elf.md).
# Reversing ELF
This room is suitable for those who want to try or beginnner in learning Reverse Engineering. In this write up i will using 2 tools which are: IDA & Binary Ninja. This room is free btw.
Basic things to do Reverse Engineering that I know is
1. Basic knowledge in C/C++
2. Basic knowledge in assemble language.
3. Find the main function first. It is because in programming, we will call other function in the main function.
4. Find what is other function that being call by main function.
5.
### Crack 1
We need to download crackme1 file from the tryhacme website.
Step 1: Gather information about the program. Since i'm using Windows Flare, i will be using Detect It Easy(DIE) tools to get information about the program.
Figure 1.0
Figure 1.0 shows that information we get for the program crackme 1 using DIE tools. Base on Figure 1.0 above, we know that this program have:
1. Operation system: Ubuntu Linux(16.04.9,ABI: 2.6.32)\[AMD64, 64-bit, EXEC]
2. Compiler: GCC(5.4.0). This means this program is compiled by GCC a tools to compile C file.
3. Language: C/C++. This program is use C/C++ language to code this program.
But for this first challenge, the task ask us to run the binary. So let's run the program using linux.
This was easy. Just running the program and will get the flag.
```
flag{not_that_kind_of_elf}
```
***
### Crack 2
Next challenge is Crack2. We need to find the password within the program. As usual, i will using DIE tools to gather information about the program.
Figure 2.0
Based on Figure 2.0, the program crackme2 contain:
1. Operation system: Ubuntu Linux(16.04.9,ABI: 2.6.32)\[386, 32-bit, EXEC]
2. Compiler: GCC(5.4.0)
3. Language: C/C++
Now, let's decompile the program to find the password.
Binary Ninja Usage
Step 1: Drag the program to compile inside the binary ninja.
Figure 3.0
This how it should looks like, if drag the program inside the binary ninja. Figure 3.0 also shows that that's the main function for crackme2 program.
Figure 4.0
Figure 4.0 shows that, the program uses `strcmp()` to compare `argv[1]` (the password provided by the user) with the string `"super_secret_password"`.
If the result of `strcmp()` is not equal to 0 (meaning the two strings do not match), it:
* Prints `"Access denied."`.
* Returns `1`, signaling failure.
* If the password is correct, the program prints `"Access granted."`.
* Then, it calls the function `giveFlag()`, which is presumably designed to reveal or provide a flag.
Password for crackme2 is
```
super_secret_password
```
***
### Crack3
Figure 5.0
Same step, let's gather the information about crackme3 program using DIE tools. Figure 5.0 shows an information about the crackme3 program.
1. Operation system: Ubuntu Linux(ABI: 2.6.24)\[386, 32-bit, EXEC]
2. Compiler: GCC(4.6.3)
3. Language: C/C++
This time, we need to use our basic reverse engineering skills to obtain the flag within crackme3. For crackme3 i will be using binary ninja to decompile the program.
Figure 6.0
This is how it's look like if we decompile it using binary ninja. Based on Figure 6.0 above, this is main function of the crackme3 program.
Figure 7.0
Based on Figure 7.0, this is what is the codes means:
* `strcmp(eax_3, "ZjByX3kwdXJfNWVjMG5kX2xlNTVvbl91...")`: The `strcmp()` function compares `eax_3` (a user-provided input) with a hardcoded string `"ZjByX3kwdXJfNWVjMG5kX2xlNTVvbl91..."`.
* This comparison returns `0` if both strings are exactly identical. If they do not match, the result will not be `0`.
Seems like there is base64 encoded strings. This could be our flag. Let's obtain the full text of the base64 string by click at the base64 string beside the `eax_3.`
Figure 8.0
This is how it should looks like if click on the base64 string from Figure 7.0.
```
ZjByX3kwdXJfNWVjMG5kX2xlNTVvbl91bmJhc2U2NF80bGxfN2gzXzdoMW5nNQ==
```
Decode it using base64 decoder. This is the flag:
```
f0r_y0ur_5ec0nd_le55on_unbase64_4ll_7h3_7h1ng5
```
***
### Crack4
