Overhall w/ slides

WEEK01/WEEK01-03.md

@@ -1,4 +1,4 @@
-# Embedded Systems Reverse Engineering
+# Embedded Systems Reverse Engineering
 [Repository](https://github.com/mytechnotalent/Embedded-Hacking)
 
 ## Week 1
@@ -31,7 +31,7 @@ A **cross-reference** is a link between different parts of the code:
 
 In this exercise, we're tracking **code → data** references to understand where and how the program uses the "hello, world" string.
 
-## Step-by-Step Instructions
+#### Step-by-Step Instructions
 
 ##### Step 1: Navigate to the main Function
 
@@ -94,13 +94,13 @@ This means:
 - What is the address of the data reference you found? (e.g., `DAT_10000244`)
 - __________
 
-#### Question 2: Referenced By
+###### Question 2: Referenced By
 - How many places reference this data?
 - __________
 - Which function(s) use it?
 - __________
 
-#### Question 3: Reference Type
+###### Question 3: Reference Type
 - Is it a read or write operation?
 - __________
 - Why? (What's the program doing with this data?)
@@ -119,9 +119,9 @@ This means:
 - Then a function (probably `printf` or `puts`) is called with `r0` as the argument
 - Can you trace this complete flow?
 
-## Deeper Analysis (Optional Challenge)
+#### Deeper Analysis (Optional Challenge)
 
-### Challenge 1: Find the Actual String Address
+##### Challenge 1: Find the Actual String Address
 1. Navigate to the `DAT_10000244` location
 2. Look at the value stored there
 3. Can you decode the hex bytes and find the actual address of "hello, world"?
@@ -131,7 +131,7 @@ This means:
 If you see bytes: `CC 19 00 10`
 Read backwards: `10 00 19 CC` = `0x100019CC`
 
-### Challenge 2: Understand the Indirection
+##### Challenge 2: Understand the Indirection
 1. In C, if we want to load an address, we do: `char *ptr = &some_string;`
 2. Then to use it: `printf(ptr);`
 3. In assembly, this becomes:
@@ -139,12 +139,12 @@ Read backwards: `10 00 19 CC` = `0x100019CC`
    - Call the function: `bl printf`
 4. Can you see this pattern in the assembly?
 
-### Challenge 3: Follow Multiple References
+##### Challenge 3: Follow Multiple References
 1. Try this with different data items in the binary
 2. Find a data reference that has **multiple** cross-references
 3. What data is used in more than one place?
 
-## Questions for Reflection
+#### Questions for Reflection
 
 1. **Why does the code need to load an address from memory?**
    - Why can't it just use the address directly?
@@ -164,14 +164,14 @@ Read backwards: `10 00 19 CC` = `0x100019CC`
    - Data section (constants/strings)
    - Is everything at different addresses for a reason?
 
-## Tips and Hints
+#### Tips and Hints
 
 - If you right-click and don't see "References", try right-clicking directly on the instruction address instead
 - You can also use **Search → For Cross References** from the menu for a more advanced search
 - In the Decompile view (right side), cross-references may be shown in a different format or with different colors
 - Multi-level references: You can right-click on a data item and then follow the chain to another data item
 
-## Real-World Applications
+#### Real-World Applications
 
 Understanding cross-references is crucial for:
 - **Vulnerability hunting**: Finding where user input flows through the code
@@ -179,7 +179,7 @@ Understanding cross-references is crucial for:
 - **Malware analysis**: Tracking command-and-control server addresses or encryption keys
 - **Reverse engineering**: Understanding program logic by following data dependencies
 
-## Summary
+#### Summary
 
 By completing this exercise, you've learned:
 1. How to find and interpret cross-references in Ghidra
@@ -188,7 +188,7 @@ By completing this exercise, you've learned:
 4. The relationship between high-level C code and assembly-level data flow
 5. How addresses are indirectly referenced in position-independent code
 
-## Expected Final Understanding
+#### Expected Final Understanding
 
 You should now understand this flow:
 ```