Reverse › Module 10 › Lesson 4
Lab — Capstone
Execute checklist on $RE_LAB RE capstone — evidence complete, pack sealed, ethics signed, no piracy anywhere.
Visual · t23_capstone_lab
Capstone: checklist × $RE_LAB RE evidence. Original Cyberlium.
Opening
Close the RE loop — authorized crackme, full artifacts, share-safe handoff — then lock the notes vault.
Walk Topic 23 checklist on YOUR $RE_LAB capstone binary: verify authorized chain and hash, lab path current, static through anti-analysis artifacts linked, crackme outcome documented, writeup and share checklist complete, evidence pack indexed, optional YOUR-toy patch documented with hashes, scan for piracy artifacts (must be zero). Update index with capstone UTC completion. Purple paragraph: detection or hardening insight from YOUR findings. No commercial targets, no DRM bypass, no keygen, no casual crackme upload. Optional mentor review — three clarity questions.
1. Execute checklist
Check each row; link artifact or N/A; confirm zero refused techniques in any file.
Scan sealed pack for live binaries and piracy patches — remove before handoff.
Command guide
Try these commands — Execute checklist
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Capstone writeup — https://ghidra.re/courses/GhidraClass/ (full RE report on YOUR toy) GDB manual — https://sourceware.org/gdb/current/onlinedocs/gdb.html/ crackmes.one — https://crackmes.one/ (legal next step after capstone) pwn.college — https://pwn.college/ (authorized advanced labs)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install build-essential sudo apt install binutils sudo apt install gdb sudo apt install openssl
Built-in (binutils)
macOS:
Command — copy this
xcode-select --install # or brew install gcc
Built-in (Xcode CLI) or brew install binutils
Command — copy this
brew install gdb
Windows: Use WSL or MinGW Use WSL binutils Use WSL gdb
Command — copy this
choco install openssl
Use WSL or install binutils
═══ LINUX / macOS ═══
Optional command
sudo apt install build-essential binutils gdb # gcc objdump gdb readelf nm
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
gcc -Wall -O0 -g -o "$LAB_RE/bin/crackme" "$LAB_RE/src/crackme.c"
file "$LAB_RE/bin/crackme"
strings "$LAB_RE/bin/crackme" | grep -E 'Enter|Access|cyberlium' | tee "$LAB_RE/report-capstone.txt"
objdump -d "$LAB_RE/bin/crackme" | grep -E 'main|strcmp' | head -8 | tee -a "$LAB_RE/report-capstone.txt"
gdb -q -batch -ex 'disassemble main' -ex quit "$LAB_RE/bin/crackme" 2>/dev/null | head -15 | tee -a "$LAB_RE/report-capstone.txt"
openssl dgst -sha256 "$LAB_RE/bin/crackme" | tee -a "$LAB_RE/report-capstone.txt"
cat >> "$LAB_RE/report-capstone.txt" <<'EOF'
capstone: compile + strings + objdump + gdb + hash on YOUR crackme
scope: LAB_RE — crackmes/YOUR toys only, never commercial
EOFCommand — copy this
grep -E 'capstone|cyberlium|strcmp|never|sha256' "$LAB_RE/report-capstone.txt" "$LAB_RE/roe.txt" | head -15
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t23-re/roe.txt | Select-String never Get-ChildItem $HOME/cyberlium-lab/t23-re/evidence -ErrorAction SilentlyContinue | Select-Object Name
Primary tools to practice this lesson: gcc, objdump, gdb, openssl, strings. Reference sites: Capstone writeup (https://ghidra.re/courses/GhidraClass/); GDB manual (https://sourceware.org/gdb/current/onlinedocs/gdb.html/); crackmes.one (https://crackmes.one/); pwn.college (https://pwn.college/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Purple paragraph
Static/dynamic/anti-analysis key → defender detection or hardening idea.
Name what breaks if you skip authorization or pursue piracy — integrity tie-in.
3. Shutdown
Notes secured chmod 600; index signed complete UTC.
Ready for Topic 24 exploit development on separate authorized lab track.
4. What you ship: capstone evidence pack complete
Checked checklist + sealed evidence pack + purple paragraph + zero piracy scan.
5. What you record before the next lesson
Capstone pack path. $RE_LAB quiet.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Capstone evidence from commercial crack and undocumented sample.
Right
Capstone complete on $RE_LAB with full teardown. Next: topic quiz.
Mission: Topic 23 capstone
1) Walk checklist with evidence links. 2) Purple paragraph from your path. 3) Seal pack scan no piracy. 4) Sign index UTC complete.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
Knowledge Check
APPLY: Capstone target:
Multiple choice
Knowledge Check
APPLY: True or False: Commercial crack capstone earns credit.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice