Overhall w/ slides

WEEK01/WEEK01-02.md

@@ -1,4 +1,4 @@
-# Embedded Systems Reverse Engineering
+# Embedded Systems Reverse Engineering
 [Repository](https://github.com/mytechnotalent/Embedded-Hacking)
 
 ## Week 1
@@ -99,7 +99,7 @@ Based on what you found:
 - Is each character one byte or more? __________
 - What does `\r` and `\n` represent? (Hint: `\r` = carriage return, `\n` = newline)
 
-## Expected Output
+#### Expected Output
 
 You should be able to fill in a summary like:
 
@@ -112,40 +112,40 @@ Referenced by: [Function names]
 Used in: [How the program uses it]
 ```
 
-## Deeper Exploration (Optional Challenge)
+#### Deeper Exploration (Optional Challenge)
 
-### Challenge 1: Follow the String Usage
+##### Challenge 1: Follow the String Usage
 1. From the cross-references you found, click on the instruction that uses the string
 2. You should navigate to the `ldr` (load) instruction that loads the string's address into register `r0`
 3. This is how the `printf` function gets the pointer to the string!
 
-### Challenge 2: Find Other Strings
+##### Challenge 2: Find Other Strings
 1. Go back to the Defined Strings window
 2. Look for other strings in the binary
 3. Are there any other text strings besides "hello, world"?
 4. If yes, where are they and what are they used for?
 
-### Challenge 3: Understand Little-Endian
+##### Challenge 3: Understand Little-Endian
 1. When Ghidra shows the string address in the `ldr` instruction, it's showing a number
 2. Look at the raw bytes of that address value
 3. Notice how the bytes are stored in "backwards" order? That's little-endian!
 4. Can you convert the hex bytes to the actual address?
 
-## Questions for Reflection
+#### Questions for Reflection
 
 1. **Why is the string stored in Flash memory?** Why not in RAM?
 2. **How does `printf()` know where to find the string?** (Hint: The address is loaded into `r0`)
 3. **What would happen if we didn't have the `\r\n` at the end?** How would the output look?
 4. **Could we modify this string at runtime?** Why or why not?
 
-## Tips and Hints
+#### Tips and Hints
 
 - Strings in compiled binaries are often stored in read-only memory (Flash) to save RAM
 - The `\r` and `\n` characters are special: they're single bytes (0x0D and 0x0A in hex)
 - When you see a string in Ghidra's listing, the ASCII representation is shown on the right side
 - You can scroll left/right in the Listing view to see different representations (hex, ASCII, disassembly)
 
-## Real-World Application
+#### Real-World Application
 
 Understanding where strings are stored is crucial for:
 - **Firmware modification**: Finding text messages to modify
@@ -153,7 +153,7 @@ Understanding where strings are stored is crucial for:
 - **Vulnerability analysis**: Finding format string bugs or hardcoded credentials
 - **Localization**: Finding where text needs to be translated
 
-## Summary
+#### Summary
 
 By completing this exercise, you've learned:
 1. How to find strings in a binary using Ghidra's Defined Strings window