Lion Cipher Lab
Recover a hidden algorithm with Ghidra (reverse engineering, part 2)
- Digital Forensics & IR (DFIR)
- Intermediate
- ~50 min
- Free · no account required
Why it matters
The first thing a malware author does to hide a secret — a command-and-control address, a decryption key, an unlock code — is stop storing it in plaintext, because plaintext falls out of a five-second `strings` scan. They store it transformed and reconstruct it at runtime. So the analyst's real job is rarely "spot the constant"; it is "read what the code DOES and undo it." This lab is that skill in miniature. On a binary you built and understand, you follow a loop's control flow in Ghidra's decompiler, recognise a simple XOR transform, read the hardcoded target bytes, and invert the transform…
What you'll learn
- reading control flow in a decompiler
- recovering an algorithm from machine code
- identifying an XOR transform
- inverting a transform to recover a secret
- reading a hardcoded byte array in the Listing
- renaming variables to make decompiled code readable
- why listing strings fails on transformed secrets
Steps in this lab
- What changed since part 1 — and the words you need
- The safety envelope, unchanged — reverse only what you own
- Confirm your toolchain from part 1 is ready
- Write and compile the transformed-key checker
- Import, analyze, and prove the strings trick fails
- Read the control flow: find the loop and the transform
- Read the target bytes and invert the transform
- What you just learned — and where it goes next