# The 5 Levels of Reverse Engineering

Source: https://www.youtube.com/watch?v=8vk5z9VAaBQ
Recap page: https://rapidrecap.app/video/8vk5z9VAaBQ
Generated: 2025-10-29T16:02:52.6+00:00

---
## Quick Overview

The video successfully reverse engineers a program across five levels, starting with static analysis of strings (Level 1), moving to static analysis of assembly code (Level 2), then dynamic analysis using GDB (Level 3), symbolic execution with Angr (Level 4), and concluding with finding real bugs in firmware using symbolic execution (Level 5).

**Key Points:**
- Level 1 reverse engineering involved using the 'strings' utility on the initial binary to extract human-readable content, revealing error codes and strings like 'bad kitty!' and 'good kitty!'.
- Level 2 static analysis used 'objdump -d' to disassemble the binary, revealing functions like 'main', 'factorial', and 'pppeuler_3', which hinted at the program's logic.
- Level 3 dynamic analysis utilized GDB to set breakpoints (like at the start of 'main') and observe the program's execution flow and stack contents to manually determine the correct input.
- Level 4 symbolic execution employed the Angr Python library, setting up a project, defining constraints on the flag input (ASCII characters between 0x20 and 0x7F), and using a solver to find valid inputs.
- The symbolic execution script identified that the correct input for the 'crack' challenge was '00sGo4M8' by analyzing the program's branches.
- Level 5 involved extracting firmware from a physical device (a Wi-Fi repeater) and recursively analyzing its contents using 'binwalk -Me' to find executables and configuration files like 'rc.d' scripts.
- The final analysis of the firmware's startup scripts revealed a service running 'commuos', which was then analyzed to find potential vulnerabilities using symbolic execution.

![Screenshot at 03:04: Static analysis of the 'crack' binary using objdump shows disassembled assembly instructions, which the presenter analyzes to understand the program's logic flow, such as comparisons and function calls like 'factorial'.](https://ss.rapidrecap.app/screens/8vk5z9VAaBQ/00-03-04.png)

**Context:** This video serves as a tutorial demonstrating a five-level progression in reverse engineering a program, starting from basic string extraction to advanced symbolic execution and finally applying these techniques to analyze real-world embedded device firmware. The presenter guides the viewer through each level, progressively revealing more complex techniques.

## Detailed Analysis

The video outlines a five-level approach to reverse engineering, starting with Level 1 (String Analysis) where the 'strings' utility on the initial binary revealed hardcoded strings like 'bad kitty!' and 'good kitty!' (00:21). Level 2 (Static Analysis) involved using 'objdump -d' on the 'crack' executable to view assembly code, identifying key functions such as 'main', 'factorial', and 'pppeuler_3' (03:06). Level 3 (Dynamic Analysis) used GDB to set a breakpoint at 'main' (12:01), run the program, and inspect the stack context (13:15) to manually trace execution flow and find the correct input ('00sGo4M8' at 13:49). Level 4 introduced Symbolic Execution using the Angr Python library (17:55), where the input was treated as symbolic variables, constraints were added (17:58), and the solver found the valid input that satisfied all paths (18:39). Finally, Level 5 transitioned to analyzing real-world software by extracting firmware from a Wi-Fi device using 'binwalk -Me' (22:24), revealing a filesystem containing startup scripts in '/etc/rc.d' (22:57) that launched a 'commuos' service, which was then subject to symbolic execution to find potential bugs (23:41).

### Level 1

- String Analysis: Used 'strings -n 10' on the initial binary to find potential clues like 'bad kitty!' and 'good kitty!' (00:57).

### Level 2

- Static Analysis: Employed 'objdump -d ./crack
- less' to examine assembly, noting functions like 'main' and 'factorial' (03:07, 04:23).

### Level 3

- Dynamic Analysis: Set a breakpoint at the start of 'main' using GDB (12:01) and ran the program to observe stack contents (13:15) and logic leading to the correct input '00sGo4M8' (13:49).

### Level 4

- Symbolic Execution: Used Angr's Python API to project the 'engine' binary, defined symbolic input constraints (ASCII printable chars 0x20 to 0x7F) (17:58), and employed the Z3 solver to find the valid input (20:36).

### Level 5

- Real World Bugs: Extracted firmware using 'binwalk -Me' (22:24), navigated the extracted filesystem (22:43), identified startup scripts in '/etc/rc.d' (22:57), and highlighted the 'commuos' service as a target for symbolic analysis (23:33).

![Screenshot at 00:02: The initial Python code snippet used as an example of a program structure \(Level 1 context\) \(00:02\).](https://ss.rapidrecap.app/screens/8vk5z9VAaBQ/00-00-02.png)
![Screenshot at 00:12: The output of 'xxd' on the initial binary, showing raw hexadecimal and ASCII data \(00:12\).](https://ss.rapidrecap.app/screens/8vk5z9VAaBQ/00-00-12.png)
![Screenshot at 03:06: The transition screen indicating the move from Level 1 to Level 2: Static Analysis \(03:06\).](https://ss.rapidrecap.app/screens/8vk5z9VAaBQ/00-03-06.png)
![Screenshot at 03:31: Running the 'crack' executable which prompts for input, demonstrating the program's basic functionality \(03:31\).](https://ss.rapidrecap.app/screens/8vk5z9VAaBQ/00-03-31.png)
![Screenshot at 06:17: The Ghidra disassembler view showing the control flow graph and assembly instructions of the 'crack' binary \(06:17\).](https://ss.rapidrecap.app/screens/8vk5z9VAaBQ/00-06-17.png)
![Screenshot at 10:16: The transition screen indicating the move to Level 4: Symbolic Execution \(10:16\).](https://ss.rapidrecap.app/screens/8vk5z9VAaBQ/00-10-16.png)
![Screenshot at 17:55: The Angr Python script used to automate symbolic execution, showing project initialization and solver constraints \(17:55\).](https://ss.rapidrecap.app/screens/8vk5z9VAaBQ/00-17-55.png)
![Screenshot at 21:36: Using 'binwalk -Me' on the extracted full binary file to recursively extract embedded filesystem content \(21:36\).](https://ss.rapidrecap.app/screens/8vk5z9VAaBQ/00-21-36.png)
![Screenshot at 22:57: Listing files in the extracted '/etc/rc.d' directory, revealing startup scripts like 'S50commuos' \(22:57\).](https://ss.rapidrecap.app/screens/8vk5z9VAaBQ/00-22-57.png)