Key Takeaways

  • Static analysis: Examine code without execution.
  • Dynamic analysis: Debug and trace execution.
  • Learn x86 assembly basics: registers, instructions, calling conventions.
  • Essential tools: Ghidra, IDA Pro, x64dbg, radare2.

Reverse engineering is the art of understanding software without source code. It's essential for malware analysis, vulnerability research, and exploit development.

x86 Assembly Basics

; Key registers (x86-64)
RAX, RBX, RCX, RDX  ; General purpose
RSP                  ; Stack pointer
RBP                  ; Base pointer
RIP                  ; Instruction pointer

; Common instructions
mov rax, rbx        ; Copy rbx to rax
push rax            ; Push rax to stack
pop rbx             ; Pop stack to rbx
call 0x401000       ; Call function
ret                 ; Return from function
jmp 0x401050        ; Unconditional jump
cmp rax, rbx        ; Compare
je 0x401060         ; Jump if equal

Static Analysis Workflow

  1. File identification: file binary.exe
  2. Strings extraction: strings -a binary.exe
  3. Import/Export analysis: Check API calls
  4. Disassembly: Open in Ghidra/IDA
  5. Decompilation: Read pseudo-C code

Dynamic Analysis

# Run in isolated environment (VM with snapshots!)

# Windows debugging with x64dbg
- Set breakpoints on suspicious APIs
- Trace execution step-by-step
- Monitor memory and registry changes

# Linux debugging with GDB
gdb ./binary
(gdb) break main
(gdb) run
(gdb) x/20i $rip    # Disassemble 20 instructions
(gdb) info registers

Essential Tools

  • Ghidra: Free, NSA-developed disassembler (excellent decompiler)
  • IDA Pro: Industry standard (expensive, free version available)
  • x64dbg: Windows debugger
  • radare2: Command-line reverse engineering framework
  • Binary Ninja: Modern, user-friendly alternative

Frequently Asked Questions

Where should I start learning?
Start with Ghidra (free), follow along with crackmes.one challenges, and read "Practical Malware Analysis" by Sikorski & Honig. Build strong C programming and assembly fundamentals first.

Analyze malicious software.
Malware Analysis Guide