Technique Reverse

My reverse engineering notes, written as a series. It starts with the basics (assembly, PE/ELF, tools), then goes through each language, then packers, anti-debug, hooking and malware.

For learning, CTFs, crackmes and software you own or are allowed to analyse.

Resources

Post
Cheatsheet: shortcuts and quick reference
Reading list: the books behind these notes
Reverse Engineering technique repository (map)
Reverse Engineering tool repository (roundup)
Study materials and places to practice

The series

Part 00 · Getting Started

#	Lesson
0.1	What is reverse engineering
0.2	Legal and ethics
0.3	Setting up a safe lab
0.4	The reverse engineering workflow

Part 01 · Computer Fundamentals for RE

#	Lesson
1.1	Reading a hexdump like text
1.2	Process memory map
1.3	x86/x64 Assembly (1), registers and common instructions
1.4	x86/x64 assembly (2), stack frames and calling conventions
1.5	x86/x64 Assembly (3), if, loops, switch, arrays and structs
1.6	From source code to binary
1.7	The PE format
1.8	ELF and Mach-O
1.9	ARM/ARM64 basics for people who know x86
1.10	Windows internals (1), Win32 API and DLLs
1.11	Windows internals (2), PEB, TEB, handles and tokens
1.12	Windows internals for RE (3): SEH, TLS callbacks and syscalls
1.13	Recognizing Windows APIs when reversing

Part 02 · The Toolkit

#	Lesson
2.1	Five-minute triage with DIE, strings and PE-bear
2.2	IDA for beginners
2.3	Ghidra basics
2.4	Binary Ninja, Cutter and radare2
2.5	x64dbg basics
2.6	GDB, pwndbg and WinDbg
2.7	Hex editors and templates
2.8	System monitoring

Part 03 · C

#	Lesson
3.1	Hello world and finding the real main
3.2	Variables, pointers, arrays and strings in assembly
3.3	Structs in assembly and how to recover them
3.4	FLIRT and recognizing library functions
3.5	Lab, solving your first C crackme
3.6	Writing a keygen

Part 04 · C++

#	Lesson
4.1	C++ for reversers, name mangling and the this pointer
4.2	Classes, vtables, inheritance and RTTI
4.3	STL in binaries, std::string and std::vector
4.4	Exceptions, templates and lambdas
4.5	Plugins that rebuild C++ classes
4.6	Lab, a C++ crackme with a vtable

Part 05 · C# and .NET

#	Lesson
5.1	.NET internals
5.2	ILSpy and dnSpy
5.3	Debugging .NET without source using dnSpy
5.4	Editing a .NET assembly and saving it
5.5	.NET obfuscators and how to strip them
5.6	Modern .NET publish modes
5.7	Combined lab, solving .NET crackmes

Part 06 · Java, Kotlin and Android

#	Lesson
6.1	JVM bytecode and Java decompilers
6.2	Anatomy of an APK file
6.3	JADX-GUI in depth
6.4	Smali and apktool, patching and repacking an Android app
6.5	Kotlin in bytecode
6.6	Frida on Android
6.7	Native .so libraries and JNI
6.8	Obfuscation and packers on Android
6.9	Big lab, solving OWASP UnCrackable Level 1 to 3

Part 07 · Python

#	Lesson
7.1	Python bytecode and .pyc files
7.2	pycdc and pycdas
7.3	Python decompilers other than pycdc
7.4	Python packaged as an .exe
7.5	Nuitka, Cython and PyArmor
7.6	Lab, decompiling sample .pyc files with pycdc

Part 08 · Go

#	Lesson
8.1	What Go binaries look like
8.2	Recovering function names and types in Go binaries
8.3	Go’s string, slice, interface and goroutine in assembly
8.4	Lab, solving a Go crackme

Part 09 · Rust

#	Lesson
9.1	What Rust binaries look like
9.2	Rust’s String, Vec, iterators and trait objects
9.3	Rust crackme lab

Part 10 · Legacy: Delphi, VB6, AutoIt, AHK

#	Lesson
10.1	Reversing Delphi and C++Builder programs
10.2	Visual Basic 6
10.3	Scripts packed into exes

Part 11 · JavaScript, Electron, WebAssembly

#	Lesson
11.1	Deobfuscating JavaScript
11.2	Dissecting an Electron app
11.3	WebAssembly

Part 12 · Swift and Objective-C

#	Lesson
12.1	Objective-C and objc_msgSend
12.2	Swift reverse engineering
12.3	Reversing an iOS app from the IPA file

Part 13 · Games: Unity, Unreal, Lua

#	Lesson
13.1	Unity with the Mono backend
13.2	Unity IL2CPP
13.3	Reversing Unreal Engine games
13.4	Lua and LuaJIT bytecode
13.5	Cheat Engine and runtime memory

Part 14 · Packers and Obfuscation

#	Lesson
14.1	How packers work and how to spot one
14.2	Unpacking UPX, automatic and manual
14.3	Dumping a process and rebuilding the IAT with Scylla
14.4	Code-level obfuscation
14.5	Code virtualization
14.6	Automatic deobfuscation

Part 15 · Anti-Reversing and Bypasses

#	Lesson
15.1	Anti-debug via Windows APIs
15.2	Anti-debug by reading the PEB
15.3	Anti-debug group 3, timing and traps
15.4	Advanced anti-debug, self-debug and TLS callbacks
15.5	Anti-VM and anti-sandbox
15.6	Anti-disassembly
15.7	Anti-attach, anti-dump and anti-hook
15.8	Integrity checks and anti-tamper
15.9	Bypassing anti-debug
15.10	Handling stacked anti-analysis layers

Part 16 · Crypto and Algorithms

#	Lesson
16.1	Identifying crypto algorithms by their constants
16.2	XOR, RC4 and custom Base64
16.3	Recognizing AES, DES, TEA, ChaCha and hash functions
16.4	Rewriting the algorithm in Python and solving with Z3

Part 17 · Patching, Hooking, Injection

#	Lesson
17.1	Patching binaries
17.2	Frida, inspecting and modifying a running program
17.3	Hooking on Windows, IAT hooks and inline hooks
17.4	Recognizing DLL injection techniques
17.5	Recognizing process injection in malware
17.6	LD_PRELOAD, ptrace and DYLD_INSERT_LIBRARIES
17.7	Dynamic Binary Instrumentation

Part 18 · Advanced Topics

#	Lesson
18.1	Scripting the decompiler
18.2	Emulation, running a piece of code on its own
18.3	Symbolic execution
18.4	Binary diffing
18.5	Reversing firmware and IoT devices
18.6	Reversing Windows drivers and Linux kernel modules
18.7	Reversing network protocols and proprietary file formats
18.8	AI-assisted reverse engineering

Part 19 · Malware Analysis Basics

#	Lesson
19.1	A safe malware analysis workflow
19.2	IOC, YARA, capa and Sigma
19.3	Analyzing maldocs and loaders
19.4	Extracting config and C2

Part 20 · Real-World Practice

#	Lesson
20.1	Hands-on with crackmes.one, level 1 to level 4
20.2	Solving RE challenges in CTFs and writing a write-up
20.3	Final project, reverse a program and write the report