Reverse Engineering
Index of all reversing pages - static analysis, dynamic analysis, decompilers, and platform-specific techniques.
Reverse Engineering
Reverse engineering (RE) challenges give you a compiled binary. Your goal: understand what it does, find the flag, or generate valid input that makes the program print "Correct!". Unlike pwn (where you exploit memory bugs) or web (where you attack services), RE is about understanding compiled code — reading assembly, decompiling to pseudocode, and reversing algorithms.
The key insight: you don't need to understand every instruction. You need to find the comparison, understand what's being compared, and extract the answer.
Pages in This Section
| Page | Difficulty | What You'll Learn |
|---|---|---|
| Static Analysis | Beginner | Analyze without running: strings, objdump, Ghidra |
| Dynamic Analysis | Intermediate | Debug and trace at runtime: GDB, strace, ltrace |
| Decompilers | Beginner | Ghidra, IDA, Binary Ninja, dnSpy comparison |
| ELF Binaries | Beginner | Linux binary format analysis |
| PE Binaries | Intermediate | Windows binary format analysis |
| Crackmes | Beginner | License check methodology — the core RE challenge type |
| Anti-Debugging | Intermediate | Detect and bypass anti-debug tricks |
| Obfuscation | Intermediate | Identify and defeat code obfuscation |
| ARM Reversing | Intermediate | Mobile/embedded ARM binaries |
| MIPS Reversing | Intermediate | Router/IoT MIPS binaries |
| Android APK | Intermediate | jadx, apktool, Frida for APK challenges |
| WASM Reversing | Intermediate | WebAssembly analysis |
The Universal First Step
Before opening a decompiler, run these commands on every challenge binary:
file ./binary # what is it?
checksec --file=./binary # what protections?
strings ./binary | grep -iE "(flag|ctf|correct|wrong|pass)" # quick win
ltrace ./binary <<< "test" # see library callsstrings and ltrace alone solve a surprising number of beginner RE challenges. Don't overcomplicate things.
New to RE? Start with strings and ltrace — these two commands alone solve a surprising number of beginner CTF challenges without any deeper analysis.
Quick Methodology
Learning Path
Beginner — Static Analysis
Start with strings, file, checksec, then learn Ghidra basics for decompilation.
See Static Analysis and ELF Binaries.
Beginner — Crackmes & Decompilers
Apply the methodology to license-check challenges. Compare Ghidra, IDA Free, and Binary Ninja. See Crackmes and Decompilers.
Intermediate — Dynamic Analysis
Run binaries under GDB, strace, ltrace. Set breakpoints at comparisons. See Dynamic Analysis.
Intermediate — Anti-Debug & Obfuscation
Bypass ptrace checks, timing detections, and packed binaries. See Anti-Debugging and Obfuscation.
Specialized — Platform-Specific
Android APKs with jadx/Frida, ARM/MIPS embedded targets via QEMU, browser WASM, Windows PE. See Android APK, ARM Reversing, WASM, PE Binaries.
Tool Quick Reference
# File identification
file ./binary
xxd ./binary | head -20
# String extraction
strings ./binary
strings -n 8 ./binary
strings -e l ./binary # UTF-16 (Windows)
# ELF inspection
readelf -h ./binary # ELF header
readelf -S ./binary # sections
readelf -s ./binary # symbols
nm ./binary # symbol table
objdump -d ./binary # disassembly
# Decompilers
ghidra # GUI decompiler (recommended)
r2 -A ./binary # radare2 CLILast updated on