Reverse Engineering Resources ⚡

Highest quality resources to learn Reverse Engineering from start to end!

Roadmap

Table of contents

• Assembly
  • Linux specific
  • Windows specific
  • Miscellaneous
• Operating System Internals
• Assembly Projects
• Getting started
• Getting your hands dirty
• Deobfuscation
• Anti-debug and Anti-analysis
• Anti-analysis
• C++ Reversing
• Great blogs on Windows Internals
• Others
• Symbolic Execution

Assembly

My personal favourite assembly resource is the Chapter 3 in the Computer Systems: A Programmer's Perspective book, but if you're not into books, you can check the following resources:

Linux specific

• Assembly Tutorial
• Art of Assembly

Windows specific

• https://www.plantation-productions.com/Webster/www.artofasm.com/Windows/index.html
• Assembly tutorial

Miscellaneous

• Learn how CPUs work
• https://www.felixcloutier.com/x86/index.html
• https://cs.lmu.edu/~ray/notes/x86assembly/
• https://godbolt.org
• https://p.ost2.fyi/courses/course-v1:OpenSecurityTraining2+Arch1001_x86-64_Asm+2021_v1/about

Assembly Projects

After learning assembly, you can try some projects like making a bootloader or a whole simple Operating System. I have wrote a blog on this topic, here.

• http://brokenthorn.com/Resources/OSDev1.html
• https://raw.githubusercontent.com/tuhdo/os01/master/Operating_Systems_From_0_to_1.pdf
• https://cs.bham.ac.uk/~exr/lectures/opsys/10_11/lectures/os-dev.pdf
• Learn x86-64 assembly by writing a GUI from scratch

Operating System Internals

If you want to read books to learn OS then you can go in this order:

1. The Elements of Computer Science (TECS) & Nand2Tetris (Lectures)
2. Computer Systems: A Programmer's Perspective & Lectures
3. Operating Systems: Three Easy Pieces & Lectures

If you are not into books, you can check the following resources:

• https://www.youtube.com/playlist?list=PLmbPuZ0NsyGS8ef6zaHd2qYylzsHxL63x
• https://www.youtube.com/playlist?list=PLgre7dUq8DGKbtnlMuJPvPYlvLdXOC9uh
• https://pages.cs.wisc.edu/~remzi/OSTEP/
• Operating Systems Course (Recommended)

Getting started

• Free crackmes
• Roadmap for RE
• COMPSCI 390R - Reverse Engineering & Vulnerability Analysis
• https://www.begin.re
• https://artik.blue/reversing
• https://legend.octopuslabs.io/sample-page.html
• https://www.youtube.com/watch?v=mDyQBM-_T1g
• https://www.youtube.com/watch?v=gPsYkV7-yJk
• https://www.youtube.com/watch?v=d4Pgi5XML8E
• https://www.youtube.com/watch?v=9vKG8-TnawY (Recommended)

Getting your hands dirty

• https://crackmes.one
• http://reversing.kr/challenge.php
• https://github.com/Maijin/radare2-workshop-2015/tree/master/IOLI-crackme
• http://reversing.kr/challenge.php
• https://0x00sec.org/t/challenge-collection-reverse-engineering-and-crackme/3027
• Youtube playlist on Malware Analysis
• Binary Analysis Free Course

Deobfuscation

• https://www.vadesecure.com/en/blog/malware-analysis-understanding-code-obfuscation-techniques
• https://www.youtube.com/watch?v=bEsQ8UYioU4
• https://0x00sec.org/t/packers-executable-compression-and-data-obfuscation/847
• https://www.blackhat.com/presentations/bh-usa-07/Yason/Whitepaper/bh-usa-07-yason-WP.pdf
• https://www.varonis.com/blog/x64dbg-unpack-malware
• https://apr4h.github.io/2021-05-01-Manually-Unpacking-Remcos-Malware/
• https://www.youtube.com/watch?v=EdchPEHnohw
• https://www.youtube.com/playlist?list=PLynb9SXC4yER8NinXJwV4GHUM9-jaIsN_

Anti-debug and Anti-analysis

• https://iopscience.iop.org/article/10.1088/1742-6596/1744/4/042186/pdf
• https://wikileaks.org/vault7/document/2015-07-PoC-Anti_Debugging_and_Anti_Emulation/2015-07-PoC-Anti_Debugging_and_Anti_Emulation.pdf
• https://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf
• https://anti-debug.checkpoint.com/
• https://www.youtube.com/watch?v=WlE8abc8V-4&feature=emb_title

Anti-analysis

• https://www.malwarebytes.com/blog/news/2014/09/five-anti-debugging-tricks-that-sometimes-fool-analysts
• https://www.oic-cert.org/en/download/Anti-Analysis techniques (OIC Talk).pdf
• https://www.cynet.com/attack-techniques-hands-on/malware-anti-vm-techniques/
• https://www.youtube.com/watch?v=5NO-W3SVjak&feature=emb_title

C++ Reversing

• Reversing C++ Virtual Functions
• Reversing C++

Windows Research

If you want to get into Windows Research, then you need to learn Windows Internals.

• My blog on Windows Internals
• Book on Windows Internals published by MS. Use it like a reference to learn about specific topics when needed
• Has the best video courses
• Windows Process Internals
• Windows Internals Overview
• Intro to Windows Internals
• Win32 programming with code examples
• Notes for Windows API programming
• Windows undocumented functions documentation
• Windows undocumented stuff's documentation
• Windows Internals Book 7th edition Tools
• Full source code of ReactOS (open-source reimplementation of Windows)
• Explanation of key data structures used by device drivers, kernel, and HAL
• Take a look at more than 6000 Windows Undocumented structures
• Resources For Advanced Windows Development
• Understanding the EPROCESS data structure
• The NT Handle Table
• Anatomy of the thread suspension mechanism in Windows.
• Automatically generated diff of Windows structures
• Thread Scheduling Windows
• Kernel Callback Functions
• Decompilation of NT API functions

Great blogs on Windows Internals

• https://secret.club
• wumb0.in
• voidsec.com
• https://poppopret.blogspot.com/?m=1
• https://www.ragestorm.net/blogs/?cat=13
• https://www.x86matthew.com
• https://www.tiraniddo.dev
• https://googleprojectzero.blogspot.com

Others

• GuidedHacking
• Compiler Optimizations for Reverse Engineers.
• Reversing Stories: Updating the Undocumented ESTROBJ and STROBJ Structures for Windows 10 x64.
• Methodology for Static Reverse Engineering of Windows Kernel Drivers.
• What I Have Learned from Reverse Engineering Windows Containers.
• A Syscall Journey in the Windows Kernel.
• Reversing with HyperDbg (Dbg3301) - OpenSecurityTraining

Symbolic Execution

• Introduction to SMT Solvers - an overview of z3
• Video lecture on Symbolic Execution by MIT
• Video lectures on Symbolic Execution
• Youtube video covering the basics of z3
• Learn z3
• Course on Symbolic Analysis
• https://sat-smt.codes/SAT_SMT_by_example.pdf