Reverse Engineering: CTF Tools

DISASSEMBLERS & DECOMPILERS Ghidra (NSA Tool)

Installation#

wget https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_10.3_build/ghidra_10.3_PUBLIC_20230829.zip (opens in a new tab) unzip ghidra_10.3_PUBLIC_20230829.zip cd ghidra_10.3_PUBLIC ./ghidraRun What it does:

Decompiler: Converts assembly back to C-like code

Disassembler: Shows assembly instructions

Analysis: Automatic function detection, cross-references

Usage: Open binary → Auto-analysis → Check decompiler window

Key Features:

Free and powerful

Great for understanding program logic

Scriptable with Python/Java

Radare2 (CLI Framework) bash

Installation#

git clone https://github.com/radareorg/radare2 (opens in a new tab) cd radare2 && sys/install.sh

Usage:#

r2 binary_file # Open binary [0x00000000]> aaa # Auto-analysis [0x00000000]> s main # Seek to main function [0x00000000]> pdf # Disassemble function What it does:

Command-line reverse engineering

Debugging: Step through execution

Analysis: Hex editing, patching

Common Commands:

bash aaa # Auto-analysis ie # Entry points iI # Binary info fs functions # List functions pdf @ main # Disassemble main IDA Pro (Commercial) bash

Download from: https://hex-rays.com/ida-free/ (opens in a new tab)#

Install manually (not in repos)#

What it does:

Industry standard disassembler

Interactive graph view of functions

Advanced debugging capabilities

🐛 DEBUGGERS GDB with Enhancements bash

Installation#

sudo apt install gdb pip3 install gdbgui # Web UI for GDB git clone https://github.com/longld/peda.git (opens in a new tab) ~/peda # GDB enhancement

Usage:#

gdb ./binary (gdb) break main # Set breakpoint at main (gdb) run # Start execution (gdb) ni # Next instruction (gdb) info registers # Show registers What it does:

Debug binaries in real-time

Set breakpoints to pause execution

Inspect memory and registers

Modify values during runtime

Enhanced GDB Plugins:

PEDA: Python Exploit Development Assistance

GEF: GDB Enhanced Features

pwndbg: Pwntools GDB integration

x64dbg (Windows - use with Wine) bash sudo apt install wine

Download from: https://x64dbg.com/ (opens in a new tab)#

What it does:

Windows debugger (like OllyDbg but modern)

Great for malware analysis

User-friendly interface

🔍 ANALYSIS TOOLS Binary Ninja (Commercial) bash

Download from: https://binary.ninja/ (opens in a new tab)#

What it does:

Modern reverse engineering platform

Intermediate Language (IL) representation

Great for understanding code flow

Hopper (macOS/Linux - Commercial) bash

Download from: https://www.hopperapp.com/ (opens in a new tab)#

What it does:

macOS/Linux disassembler

Pseudo-code generation

Control flow graphs

📊 ANALYSIS & EXTRACTION TOOLS Strings bash

Built-in Linux tool#

strings binary_file # Extract all strings strings -n 8 binary_file # Strings with min 8 chars strings binary_file | grep -i flag # Search for flag What it does: Extracts readable text from binaries

file bash file mystery_file # Identify file type file -k binary # Keep going after first match What it does: Determines file format

objdump bash objdump -d binary # Disassemble executable sections objdump -x binary # Display all headers objdump -s binary # Display full contents What it does: Linux binary analysis tool

readelf bash readelf -a binary # All ELF information readelf -h binary # ELF header readelf -s binary # Symbols table What it does: ELF binary analysis

ltrace & strace bash ltrace ./binary # Trace library calls strace ./binary # Trace system calls What it does: Monitor program interactions

🐍 PYTHON REVERSE ENGINEERING LIBRARIES pwntools bash pip3 install pwntools

Python usage:#

from pwn import * context.log_level = 'debug' elf = ELF('./binary') What it does: CTF framework with binary interaction

angr (Symbolic Execution) bash pip3 install angr

Python usage:#

import angr proj = angr.Project('./binary') state = proj.factory.entry_state() simgr = proj.factory.simulation_manager(state) What it does: Automated binary analysis using symbolic execution

capstone (Disassembly Framework) bash pip3 install capstone

Python usage:#

from capstone import * code = b"\x55\x48\x8b\x05" md = Cs(CS_ARCH_X86, CS_MODE_64) for i in md.disasm(code, 0x1000): print(f"0x{i.address:x}:\t{i.mnemonic}\t{i.op_str}") What it does: Lightweight multi-architecture disassembly

pefile (Windows PE Analysis) bash pip3 install pefile

Python usage:#

import pefile pe = pefile.PE('file.exe') print(pe.dump_info()) What it does: Analyze Windows Portable Executable files

🛠️ SPECIALIZED TOOLS JD-GUI (Java Decompiler) bash sudo apt install jd-gui

Usage:#

jd-gui JavaApp.jar # Open Java archive What it does: Decompile Java .class files

dnSpy (.NET Decompiler) bash

Use with Wine or on Windows#

Download from: https://github.com/dnSpy/dnSpy/ (opens in a new tab)#

What it does: Decompile and debug .NET applications

apktool (Android APK Analysis) bash sudo apt install apktool

Usage:#

apktool d app.apk # Decompile APK apktool b app/ # Rebuild APK What it does: Reverse engineer Android applications