After importing files into your project, you can start to reverse engineer them.
This is a cool feature of Jira allowing you to import more than one file into a single project because
you can apply some operation.
For example, search over multiple files.
For example, an executable binary and its dependencies.
In this lecture we will see how to analyze these files using Jira.
And here, in order to perform and configure the analysis, you will want to click double click on it
your project file or you can just right click and open a default window.
Here we are.
We also have the several options here.
Rename, delete, cut, copy, new folder, abort program and refresh.
We will further refresh it in case we have any new files in it.
And after that we will just click on Enter.
That's it.
And here you will be asked whether to analyze the file.
And you you probably want to answer yes to this because the analysis operation recognize functions,
parameters, strings and more.
And usually you will want to let the user get this information for you.
And a lot of analysis configuration options do exist.
So you can see the description for every option by clicking on it.
And here the description is going to be displayed here and we also have the options.
And here we in this apply data archives, we have apply known data type archives based on your program
information.
We have Ascii strings.
This is the analyzer searches for valid strings and automatically creates them into the binary.
And here we can also use create strings containing existing strings, create strings containing references
and so on.
We also have the stack.
So create stacks for variable function function ID finds known functions by hashing and so on.
So we will discover all of these analyzers in this course.
And now after that, let's be the default because it's almost.
Everything is checked on enabled.
And now after that, we will click on Analyze.
And here, in order to click analyze, in order to perform, analyze, you first need to click on analyze.
And then you will see this code browser window.
And don't worry, if you forget to analyze something, you can re analyze the program later in order
to do that here.
And let's find the symbol you will click on.
Yes.
In order to do that, let's actually make it and let's.
Increase a little bit.
And here if you are if you have differences, seeing things on this window, you can go to settings
and here scale and layout.
You can increase this to 125 and that's it.
We can see more like the.
Font sizes a little bit bigger and so on.
And here now, we will, as I said, you can.
Select analyze these files later.
If you forgot to check or enable some analyzer and you will need to go to analysis tab.
And then here we have auto analyze simple Hello world print.
By clicking on Add, you can see the analysis.
Dialogue again and you can choose or enable or disable use analyzers.
And now let's explore the dress code browser.
So code browser has by default a pretty well chosen distribution of dock windows as shown here.
So now we will make it again.
100 recommended 100%.
And that's it.
So here I will get my pen and draw things on the screen.
We will need rectangle and balloon.
Yes.
So here first, we will discuss it here.
So here, as usual, by default in reverse engineering frameworks.
This is in the center of the screen.
Ghidra shows a disassembly view of the file.
And after that we have.
This side.
So as the disassembly level is sometimes a two level perspective too, low level perspective, Ghidra
incorporates its own decompiler, which is located to the right of the disassembly window.
The main function of the program was recognized by a signature, and then parameters were automatically
generated here.
As you can see here, this is our the compiled version of our Hello World.
Executable file like C plus plus program.
And here the main function of the program, as I said.
Was recognized by his signature here.
And then parameters were automatically generated by here.
And Ghidra allows you to manipulate the compiled code in a lot of aspects.
Of course, a hexadecimal view of the file is also available in the corresponding tab.
So these three windows disassembled the compiler and hexadecimal window are synchronized, offering
a different perspective of the same thing.
And here we also have let's actually use different color here and here.
We have this here, we have this program treats So obviously you do allows you to easily navigate in
the program.
For instance, to go to another program section, you can refer to the program trace window located
in the upper left margin of code browser.
And we also have under that under program trace, we have symbol tree.
So this symbol here.
Uh, if you prefer to navigate to the symbol, for example, a program function here, then go just
below that where the symbol tree pane is located.
And we also have the data type manager here.
So.
If you want to work with the data types, then you can just go below that again.
And here data type manager is here and after that we have console scripting here, so if you will use
different color it will be more nice for our lecture.
This is the console scripting, so a ghidra loves scripting reverse engineering tasks.
Script results are shown in this corresponding window at the bottom.
Of course, the bookmarks tab is available in the same position as well.
Loving to create a pretty well documented and organized bookmarks for over any memory location for quick
access.
And here after that we have seven seventh.
Thing we're going to discuss here is this.
So this has Ghidra is a quick access bar.
So Ghidra has also a quick access bar at the top so you can do several options from it, which you will
learn in this course and here at the.
Bottom right.
In order to see that, we will need to close that here.
Sexually do that here and here at the bottom, right.
We will use the pen.
At the bottom right.
First we will want to discuss is.
This year.
The first field indicates this is the current address.
Right.
Current address here.
And here.
Right.
On the current address, we have the.
Couldn't function here in this case.
Here, as you can see here, it's a current function.
The main current function, because obviously we don't have any other functions other than main.
Right.
And right after that, we have call something here.
So in addition to the current address and the current function, the current assembly line is shown
to complete the contextual information.
And here as the last thing we're going to.
The Scouser is this top pain?
Right.
So here at the topmost part of the code browser, the main bar is located.
Now that you know the default perspective, what ghidra it's a good time to learn how to customize it.
Now in next lecture, let's address this in next lecture here.