Lion Cipher Lab
Read Ghidra's decompiled functions: find the config parser, the network code, and the persistence routine
- Digital Forensics & IR (DFIR)
- Advanced
- ~55 min
- Free · no account required
Why it matters
Strings and imports tell you what a binary CAN do; the decompiled functions tell you what it is actually wired to do, and in what order. But decompilation is the slow, expensive move in reverse engineering — reading reconstructed C function by function can burn an hour, so the professional skill is not 'read everything', it is triaging first and then decompiling only the two or three functions that matter. This lab builds the eye that makes that pay off: given a screen of Ghidra pseudocode, you learn to read a function's API calls and its loops and say 'this one decodes the config', 'this one…
What you'll learn
- reading Ghidra's decompiler pseudocode (FUN_ names, DAT_ globals, param_ arguments) without knowing assembly
- inferring a function's PURPOSE from the Windows APIs it calls and its control flow
- recognising a config/string decoder: an XOR loop over an embedded data blob with no API calls
- recognising a C2 beacon: WinINet calls wrapped in an infinite Sleep loop, versus a one-shot downloader
- recognising a persistence routine: a Run-key write via RegCreateKeyExA / RegSetValueExA
- recognising an execution/launch routine: CreateProcessA
- reading main()'s calls in order to reconstruct the program's story (the call graph)
- navigating by cross-reference from a string or import to the function that uses it, not top to bottom
- judgment: when decompiling a function is worth the time and when strings / imports / dynamic answers faster
Steps in this lab
- What this drill is — reading decompiled functions, a layer below strings and imports
- The third rule: WHEN decompiling a function is worth the time (triage first)
- How to read Ghidra's pseudocode — a 60-second orientation
- Function 1 — read it and name it (the one with no API calls)
- Function 2 — read it and name it (the one that loops forever)
- Function 3 — read it and name it (the one that writes the registry)
- Function 4 — read it and name it (the one that starts something)
- Map the call graph — read main() as the program's story
- HOW a pro navigates — xref from a clue to the function, not top to bottom
- The limits — when NOT to decompile, and confirming before you believe