copy over web/rev guides

Author: reteps

fallctf-2024/src/SUMMARY.md

@@ -3,6 +3,8 @@
 - [Intro](./intro.md)
     - [pwntools](./pwntools.md)
 - [Misc](./misc.md)
-- [CRYPTO](./crypto/crypto.md)
+- [Web](./web/web.md)
+- [Reverse Engineering](./rev/rev.md)
+- [Crypto](./crypto/crypto.md)
 - [OSINT](./osint/osint.md)
 - [PWN](./pwn/pwn.md)

fallctf-2024/src/rev/README.md

@@ -0,0 +1 @@
+See [./rev.org](./rev.org)

fallctf-2024/src/rev/images/ghdira3.png

@@ -0,0 +1,2 @@
+# Reverse Engineering
+<embed src="./rev.pdf" type="application/pdf" style="width: 100%; height: 80vh;">

fallctf-2024/src/rev/images/ghidra1.png

@@ -0,0 +1,99 @@
+#+title: Reverse Engineering
+
+* Start here
+** General tips
+- figure out what the goal is
+  - there is usually a clear "win condition", such as printing a flag
+- figure out what the input is
+  - some parts of the program don't change depending on the input
+  - it might not matter what the input is!
+  - how does the input get used?
+** A note about past meetings
+SIGPwny has already ran two meetings on this topic! Check out [[https://sigpwny.com/meetings/fa2023/2023-09-17/][Reverse Engineering Setup]] and [[https://sigpwny.com/meetings/fa2023/2023-09-21/][Reverse Engineering I]]. We have slides and recorded meeting presentations, which you may prefer more than these notes.
+* Basics
+** What it is
+Reverse engineering is the process of understanding computer programs. The goal is to figure out what the program does. Usually, programs are difficult to understand, either intentionally or unintentionally.
+** Main types of analysis
+- Static analysis: reading code, using tools to understand code /without running it/
+  - Good place to start, not great if there's a lot of code
+- Dynamic analysis: running code, inspecting or modifying the program as it's running
+  - Generally faster, captures entire program environment
+** A word on abstractions
+- Abstract (higher level) programs are easier to understand
+- Languages like Python and JavaScript are higher level
+- Languages like assembly and C are lower level
+- As you modify a program to become more abstract (to better understand it), you lose some information in the process
+* Tools
+** Bytecode viewer
+*** Installation
+- see https://github.com/Konloch/bytecode-viewer
+*** When to use
+This program is used to decompile Java files, which usually have the .jar extension
+*** How to use
+Simply import the java jar program into the bytecode viewer and see the decompiled java code! This works by recovering the java code from the compiled java bytecode.
+** Ghidra
+*** Installation
+- see [[https://sigpwny.com/meetings/fa2023/2023-09-17/][Reverse Engineering Setup]]
+- or, just read the [[https://ghidra-sre.org/InstallationGuide.html][installation guide]]
+*** When to use
+Use this tool for binaries, not python scripts. Ghidra "decompiles", or simplifies, binary programs into more human-readable "pseudo-C" code.
+
+Ghidra is a *static analysis* tool.
+*** Interface
+[[./images/ghidra1.png]]
+
+Once you open a program in Ghidra, click "OK" for all the auto analyze popups (there should be several). Now, the interface should look like the above image.
+
+(1) is the decompiled code output. This is what you will be looking at for the most part. You can rename variables by clicking a variable and pressing =L=. Change the type by right clicking and selecting =Retype Variable=.
+
+(2) is the assembly instructions. This won't be very helpful if you don't know assembly, and can be mostly ignored for the challenges at Fall CTF.
+
+(3) is the "symbol tree". This shows you different named values that are present in the file. Click =Functions= and scroll down to select the =main= function. This shows you the first function that runs.
+
+[[./images/ghidra2.png]]
+
+Here we can see the =main= function in the symbol tree. If there is no =main=, click =_start= and see what that function calls.
+
+[[./images/ghdira3.png]]
+
+Above is a picture of the decompilation (disclaimer: this is not a challenge from Fall CTF). Almost every function you see will have an if statement with =__stack_chk_fail= at the bottom. This is a check for the "stack canary", which is not relevant to any challenges here. It may be of more interest in pwn challenge. The ~local_10 = *(long *)(in_FS_OFFSET + 0x28);~ line at the top sets up the stack canary and can also be ignored.
+
+Note that the variables are named with undescriptive names, such as =iVar1= and =local_28=. This is because the decompiler does not know the details of variables in the original function. As a result, it has to generate variable names.
+** GDB
+*** Installation
+- see [[https://sigpwny.com/meetings/fa2023/2023-09-17/][Reverse Engineering Setup]]
+*** When to use
+Similarly to Ghidra, use this tool for binaries, not python scripts. GDB is a debugger that runs programs, giving you the ability to stop, inspect, and modify code as it is executing.
+
+GDB is a *dynamic analysis* tool.
+*** Basics
+Run =gdb ./chal= on the command line, where =chal= is the name of the program. Note that you must be on Linux (WSL works too). This will not work for Apple Silicon Mac users.
+
+GDB will launch you into a program with a different terminal prompt, where each line starts with =(gdb)=. You interact with the program by typing in commands
+*** Commands
+- misc
+  - =help <command>=: get help about any of the commands listed here
+- running
+  - =run=: run the program from the start
+  - =quit=: exit GDB
+  - =start=: start the program and break on the =main= function
+- breakpoints
+  - =break <func>+<offset>=: set a breakpoint at the function =<func>= with an offset =<offset>=. Useful to get the offset from the =disas= command
+- inspecting program
+  - =disas <func>=: disassemble the =<func>= function
+  - =info reg=: print all the registers
+  - =x=: print data (see =help x= for more info)
+    - =x/4gx 0x1234=: print 4 QWORDS (64-bit values) in hex starting at address =0x1234=
+    - =x/10i $rip=: print 10 instructions starting at =$rip= (current instruction pointer)
+    - =x/7wx $rsp=: print 7 WORDS (32-bit values) in hex starting at =$rsp= (stack pointer)
+    - =x/8bd $rdi=: print 8 bytes in decimal starting at the address in =$rdi=
+  - =set=: set values
+    - ~set $rax=23~: sets =$rax= to 23
+    - ~set $rip+=4~: adds 4 to =$rip=
+      - this skips the current instruction, if it is 4 bytes long
+*** General workflow
+- first, identify interesting places to set a breakpoint in Ghidra
+- use the assembly instructions window in Ghidra to see the offset to break at
+- run the program in GDB and set a breakpoint
+- modify or print values as desired
+- repeat until solved