Skip to content

A systematic roadmap and collection of resources for reverse engineering

Notifications You must be signed in to change notification settings

vxsparsh/re-resources

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

6 Commits
 
 

Repository files navigation

Introduction

Reverse Engineering is a very broad field it includes decompiling and disassembling of exectuable files and libraries, and analysis of system data. In cybersecurity it is usually used to study malware activity.

The Roadmap

So here I have listed some good resources that will help you get started in revesrse engineering aswell as help you advance your existing knowledge in the field.

Getting Started

For starters you need to know about assembly language (just be able to read it) and C language. Here are some good resources to get you started.

C-Programming Crash Course

Nightmare - Intro to Assembly

Architecture 1001 - OpenSecurityTraining2

Binary Analysis

A binary file is obtained by compiling a source code and it can be executed on the platform it is compiled for. For example a You have a hello_world.c file (in linux) which prints "Hello World" to run this program you need to compile it using gcc hello_world.c -o hello_world This will create a a compiled elf executable called hello_world which you can then execute. There are two types of binary analysis:

1. Static Analysis In static analysis you analyse the binary without executing it as the name suggests. One may use tools like IDA and Ghidra for doing static analysis. Here a few resources that will get you familiar with these tools.

Ghidra Quickstart

The Basics of IDA Pro

IDA Pro Book 2nd Edition

2. Dynamic Analysis In dynamic analysis you analyse the binary by executing it in real time and observing its behaviour / looking for loopholes in real time. For dynamic analysis you can use GDB with GEF extension on linux, WinDBG and x64dbg for Windows, Binary Ninja, Angr, Z3, IDA Pro. Here are resources for dynamic analysis.

Introductory GDB - OpenSecurityTraining2

Introductory WinDBG - OpenSecurityTraining2

Debugging with GDB - Nightmare

Linux ELF

An ELF (Executable and Linkable Format) is the standard binary format on operating systems such as Linux. Now the program structure differs for different programming languages the structure of a C program will be different while the structure of a rust program will be different. This is something that will require practice to understand. It is recommened to start with C programs as they are simple. The best way to practice reversing linux elf programs is by tryping out some ctf's or crackmes online. Here are some to get you started.

crackmes.one

Flare-On CTF

Linux Reverse Engineering CTF's for Beginners - Infosecwriteups.com

Reversing ELF - TryHackMe

Windows PE

A Windows PE (Portable Executable) is a file format for executables, object code, DLLs and others used in 32-bit and 64-bit versions of Windows operating systems. Unlike linux the program structure of windows PE files are slightly complex even in C programs. Here are some good resources to help you get started.

Reverse Engineering for Beginners - Marcus Hutchins

Primary Methods of Reverse Engineering PE Files

Win64 Assembly - TryHackMe

Windows Reversing Intro - TryHackMe

Some Extra Resources

Binary Exploitation / Memory Corruption by LiveOverflow

Open Security Training 2

Quick Tips on Reverse Engineering - OALabs

Basics of x64 assembly with NASM - Undevs

Assembly Language - D3v1L4L

Reverse Engineering Series - Slava Moskvin

A collection of Assembly/Reversing Resources by Muffin

Tmpout Zines

Vx-Underground Papers

About

A systematic roadmap and collection of resources for reverse engineering

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published