2-hour introduction to Ghidra (by evaluating the copy protections of two 8-bit 1980s games)

[c64cryptoboy]

Here: https://youtu.be/3wW1una5Pgg

TOC:
0:00 Introduction
3:11 Basics of Ghidra and 6502 assembly
11:12 Introducing floppy disk copy protection schemes
----
16:39 Start of Robots of Dawn copy protection analysis
25:52 Using python window to perform deobfuscation
30:13 Introducing custom scripts
34:57 Crash course in CBM DOS calls
39:45 Code relocation using the python window
42:35 Searching binary for strings
54:11 Protection revealed
----
58:15 Start of Bride of Frankenstein copy protection analysis
59:12 Custom Ghidra loader and Ghidra/Eclipse integration
1:14:46 Using a script for deobfuscation
1:17:54 Yet another deobfuscation loop
1:20:20 And yet another deobfuscation loop
1:26:12 Code relocation using the GUI
1:27:08 Analysis of code sent to floppy drive
1:32:28 Protection revealed
1:37:38 Jumping into the middle of an instruction
----
1:39:55 Custom Ghidra Analyzer (used on Bride of Frankenstein)
1:43:17 Emulating assembly code (used on Robots of Dawn)
1:48:34 Extending CPU instructions by changing the Sleigh
1:58:04 Close

[nsadeveloper789]

Wow! It's very throrough for an "introduction," but this is great work. My one gripe: He (you?) claims the Emulator is not available in the GUI. It is, but in the Debugger tool. We have #4931 open to make the Emulator's existence more obvious, but it is there:

1. Open the Debugger (bug icon in the Ghidra Project window)
2. Drag the program into the "Debugger" tool.
   • Be especially careful with malware, because this puts you one click away from detonating it, which is another motivation for the separate tool
3. Go to the start address and Right-click.
4. Select "Emulate Program in New Trace"
5. Use the step buttons in the "Threads" window near the bottom to step.
   • These have moved to the global toolbar in master

Unfortunately, in 10.2 you can only step (no run / continue) making it a bit sluggish. That and many other improvements to the emulation UI are in master, including breakpoints and p-code injection.

[c64cryptoboy]

Ah, mea culpa, there it is in the GUI. That's my bad for not taking the debugger functionality for a spin yet, I would have seen it. I'll add an errata section to my video description and include this clarification.

Yes, it's my video -- hopefully an entertaining (albeit unconventional) introduction. Only one gripe? I was expecting the Ghidra crowd to say "well, his Ghidra's a little rough, but he seems to know his 8-bit", and the 8-bit crowd to say the opposite. :D

Amazing tool, and I'm looking forward to learning more about it.

[sarnau]

Ghidra for 8-bit has some issues, which make it harder than it probably should to use it with 8-bit CPUs. Several have been fixed over the years, but e.g. 16-bit pointers are annoying, because they are not resolved. IDA Pro is much much better/easier with that. Sometimes in Ghidra you can get around that by declaring a function and defining a prototype for an address e.g. in X/Y. But for zero-page pointers I do not know an easy way.