Mario's Sandbox / Reverse Engineering Lab

Reverse Engineering Lab

A workbench for taking things apart to see how they work. Programs, protocols, and devices all get the same treatment: observe, decompose, guess, test.

00000000 52 65 76 65 72 73 65 20 65 6e 67 69 6e 65 65 72 |Reverse engineer| 00000010 69 6e 67 3a 20 6f 62 73 65 72 76 65 20 69 74 2c |ing: observe it,| 00000020 20 74 61 6b 65 20 69 74 20 61 70 61 72 74 2c 20 | take it apart, | 00000030 67 75 65 73 73 20 68 6f 77 20 69 74 20 77 6f 72 |guess how it wor| 00000040 6b 73 2c 20 74 65 73 74 20 74 68 65 20 67 75 65 |ks, test the gue| 00000050 73 73 2e |ss.|

Practice loop

Write a tiny C program on the IDE, compile it, then read what the compiler made of it.

gcc -g -O0 hello.c -o hello
objdump -d -M intel hello | less
gdb ./hello

Change one line of C, rebuild, and diff the disassembly. That teaches more than any tutorial.

Start here

Reverse Engineering for BeginnersFree book by Dennis Yurichev. Assembly taught through reversing.
GhidraFree disassembler and decompiler. The standard first tool.
WiresharkFor figuring out protocols from captured traffic.

Practice targets

crackmes.oneSmall programs written to be reversed, sorted by difficulty.
pwn.collegeFree structured course from Arizona State University.
picoCTFBeginner-friendly capture-the-flag challenges.

Ground rules

Only analyze software and devices you own or have permission to examine. Run unknown binaries in a throwaway VM, never on this server.