5 ms·
Taking the opportunity to ask: are there nice recommended resources for a beginner to start with reverse engineering (ideally using Ghidra)? Let's say for an ex
by palata 9mo ago
Taking the opportunity to ask: are there nice recommended resources for a beginner to start with reverse engineering (ideally using Ghidra)? Let's say for an experienced developer, but not so experienced in reverse engineering?
I guess one issue I have is that I don't have good ideas of fun projects, and that's probably something I need to actually get the motivation to learn. I can find a "hello world", that's easy, but it won't help me get an idea of what I could reverse engineer in my life.
For instance I have a smartspeaker that I would like to hack (being able to run my own software on it, for fun), but I don't know if it is a good candidate for reverse engineering... I guess I would first need to find a security flaw in order to access the OS? Or flash my own OS (hoping that it's a Linux running there), but then I would probably want to extract binary blobs that work with the buttons and the actual speaker?
- gray_charger 9mo agoYou can start here to learn reverse engineering. https://beginners.re/ https://beginners.re/
- 0x54MUR41 9mo agoIf you are into the book, I would recommend The Ghidra Book from No Starch publisher https://nostarch.com/ghidra-book-2e https://nostarch.com/ghidra-book-2e. The book is designed for beginner and advance users.
- quux0r 9mo agoSo a couple things. Bruce Dang’s book, while a little old, is still a great spot to get started. Another great book is Blue Fox by Maria Markstedter for ARM. From there, finding small binaries and just trying to get the “flow” is a good next step, for me this is largely renaming functions and variables and essentially trying to work the decompiled code into something readable, then you can find flaws. So for the second thing, pulling the data off chips like that typically involves some specialized hardware, and you have to potentially deal with a bunch of cryptographic safeguards to read from the chip’s memory. Not impossible though, and there are not always good safeguards, but might be worth checking out some simpler programs and working up to it, or learning some basic hardware hacking to get an idea of how that process works.
- palata 9mo agoInteresting! Yeah maybe my first step is on the hardware side, which I guess is what is blocking me right now.
- ramuel 9mo agohttps://pwn.college https://pwn.college has really good modules/dojos that cover a bunch of reverse engineering concepts.
- baby_souffle 9mo ago> Taking the opportunity to ask: are there nice recommended resources for a beginner to start with reverse engineering (ideally using Ghidra)? Let's say for an experienced developer, but not so experienced in reverse engineering? The good news is that there has never been MORE resources out there. If you want to use this learning expedition as an excuse to also build up a small electronics lab then $100 on ali express to buy whatever looks cheap and interesting and then tear it apart and start poking around to find where the firmware lives. Pull the firmware, examine it, modify it and put it back :) This guy has a discord server with a specific "book club" section where they all choose a cheap $thing and reverse engineer it: https://www.youtube.com/@mattbrwn/about https://www.youtube.com/@mattbrwn/about I can't help much with "traditional" app/software RE work, sorry.
- palata 9mo agoOh, it feels like it may be what I want! Find some cheap electronic device and hack it! Thanks a lot!
- baby_souffle 9mo agoI would also suggest spending a few minutes to set up an mCP server with ghidra once you've learned the basics of navigating and working inside of ghidra. Turns out that frontier grade llms are absolutely fantastic for extremely advanced static analysis. If you go one step further and manage to get your firmware running inside of an emulator or other place where you can attach GDB... Then putting an mCP server on that as well unlocks so much insane potential.
- throwerxyz 9mo agoWould that include free use LLMs. I assume getting into something would be tricky if you are assuming they're going to drop several hundreds of tokens a month on it. I feel like the tendency for people to assume others have nearly $500 or so of credits on their AI to blow every month is kinda crazy. Reminds me of the "just get Netflix, Prime, etc." ending up with a $100/m bill.
- unleaded 9mo agoSomewhat unconventional (and i'm not really a seasoned reverse engineer so take it with some salt) but I started by hacking old video games (nes, gameboy, arcade.. that kind of thing). You could start with making basic action replay RAM cheats to e.g. give Mario infinite lives, then you can use breakpoints, the debugger, and a 6502 ISA reference to edit instructions and make ROM patches. from then you can use things like Ghidra (which supports a lot of those old CPU arches) for more advanced analysis and make the game do almost whatever the hell you want if you have the patience. I think a lot of the skills will transfer quite well (obviously not 1:1, you will need to learn some things) to the more employable side of RE if that's what you're interested in
- palata 9mo agoThanks! I have been "hacking" with games in the past (getting infinite lives and such) or bypassing some licence check (back then it was with OllyDbg). I guess I'm struggling to transfer that to "real-life" scenarios. Like getting something useful out of reverse engineering (getting infinite lives is interesting to see that I can tamper with the game, but it's not exactly useful).
- stevekemp 9mo agoHonestly unless you're working in low-level fields, such as embedded hardware, or optimized code generation, those are real-life scenarios! (Thinking more of license-checking, and serial-number generation rather than infinite lives.)
- ActorNightly 9mo ago[flagged]
- megraf 9mo agoHow interesting. Anyway, I would recommend YouTube. Find a series you can follow along. Best of luck!
- palata 9mo agoSince we're judging each other, I'm genuinely wondering how bad you are at making friends. I mean, non-LLM friends. Relatives don't count.
- ActorNightly 9mo agoIm neurodivergent as hell, so good at all. But I also don't really require friendships, as people interactions are very draining on me.
- palata 9mo ago> Im neurodivergent as hell Well that may explain it, then, thanks for letting me know. I realise that my question was not super clear because... well I didn't really know what to ask :-). I was just trying to engage in a human interaction. Say I am at a party with friends and strangers, and when I get introduced to a stranger, they say "I am a professional reverse engineer". Because I find that interesting, I will start asking questions. And I may well start trying to explain what I find interesting, giving the expert an angle to start talking about it. Of course I could just go home and read about reverse engineering. But at that moment, in that party, I want to enjoy a discussion about it with a human being. Part of the experience is that I get to hear what some other human thinks about it. I am not there for a formal course, I am there to listen to what a human being has to say about it. And obviously an LLM cannot do that job :-).
- salawat 9mo agoI often wonder why on this forum of alleged hacker types, there seems to be such an impetus to push what all VC's are desperately bought into at the moment, whether it be crypto, or AI nonsense. Oh wait... Right. Asking for resources or asking "does anyone know where I can start?" Followed by a description of "here's where I'm at" has been table stakes for the uninitiated since time immemorial. When I see "ask the LLM", all I hear is "prop up my investment portfolio". To this OP in particular: try playing around with different binaries you already have source to, and using the RE tools to get a feel for their post compilation structure and flow; start by compiling with no compiler optimization. You'll want an understanding of what the structural primitives of "nothing up my sleeve" code reads and looks like post-compilation to build off of. Then start enabling different layers of optimization, again, to continue familiarizing yourself with output of modern compilers when dealing with fundamentally "honest" code. Once you can eyeball things and get an intuitive sense for that sort of thing is where you jump off into dealing with dishonest code. Stuff put through obfuscators. Stuff designed to work in ways that hide what the actual intent of the code is, or things designed in ways that make it clear that the author had something up their sleeve. It'll be a lot of work and memorization and pattern recognition building, and you'll have to put in the effort to get to know the hardware and memory architecture, and opcodes and ISA's, and virtual machines you're reversing for, but it will click eventually. Just remember; odds are it won't make you money, and it will set time on fire. I cut my teeth on reversing some security firm's snake oil, and just trying to figure out why the code I wrote was acting weird after the compiler got done with it. (I have cursed at more compiler writers than about anyone but myself). Then just remember that if someone got it to run, then it's gotta eventually make sense. The rest is all persistence on your part of laying bare their true, usually perverted motivations (generally boiling down to greed, job security, or wasting your goddamn time). Would the world be nicer if that wasn't the case? Absolutely. I lived through a period where a lot of code wasn't "something up my sleeve" code. Now is not so much that time anymore. We've made programming too accessible to business types that now the interests of organization's at securing their power has a non-trivial distortion on how code gets written; which generally means user hostile in one way or another.
- deleted 9mo ago[deleted]
- brynnbee 9mo agoI personally learn best by doing which is why I love learning with LLMs. They're going to be wrong a lot, and give bad advice, and do things in silly ways. I learn well from the process of working with them, seeing them fail constantly, then learn the tool yourself by researching what it's doing wrong to fix it. I just attempted to use Ghidra to reverse engineer the game Shenmue from Dreamcast. I was previously unfamiliar with Ghidra and I mostly did it as a learning exercise, but it wasn't really the right tool for the job. However the project itself made lots of progress without it: https://www.newyokosuka.com/ https://www.newyokosuka.com/
- hxtk 9mo agoThe Nightmare Course [1], so named because someone with that skillset (developing zero-days) is a nightmare for security, not because the course itself is a nightmare, and Roppers Academy [2] are both good for learning how to reverse engineer software and look for vulnerabilities. The nightmare course explicitly talks about how to use Ghidra. 1: https://guyinatuxedo.github.io https://guyinatuxedo.github.io 2: https://www.roppers.org https://www.roppers.org
- decidu0us9034 9mo agoThe first is certainly interesting, but it won't help you develop 0day. I would think of it like more of a collection of fun puzzles and esoterica. For example all the heap unliking/metadata attacks and House of X stuff is pretty antiquated. These will help you win ctfs but are certainly not a prerequisite or even all that relevant to contemporary vuln research. Most of the public research I see is probably at least a year behind the current meta (and I expect the public internet will only grow more quiet over time)
- pertique 9mo agoWhat resources would you recommend now? Even if they're a year behind the meta, it's a lot easier to start a year behind than 6+
- giancarlostoro 9mo agoFind an old piece of software you care about that is broken somehow, and abandoned. Most of my friends use these types of tools to reverse engineer abandoned MMOs and remake servers for them.
- boltzmann-brain 9mo agoThat's very deep water to dive into. I suggest something simpler, like an ancient irc client that asks you to sign up, or an archive extractor.
- giancarlostoro 9mo agoWell I didnt mean dive into an MMO right away, but yes I recommend smaller programs.
- umanghere 9mo agoI started reverse engineering at 13 with an IDA Pro of questionable provenance - at that time, I found it quite difficult. One thing which really helped me (and I wholeheartedly recommend) is to write simple programs, run them through the compiler and then in the disassembler. It really helps build a correspondence between program structure and its object code. Eventually, you can make it even more fun and challenging by stripping debug symbols and turning on compiler optimisations. Happy reversing!
- bpye 9mo agoFinding something with symbols will help a lot. Symbols end up getting left in Linux and macOS builds fairly often. The reverse engineering I've learned has generally been to fix something that has annoyed me - for example I reverse engineered part of RCT3 to fix mouse input with high poll rates and allow for resizable windows [0]. Certainly easier to approach than trying to get into a closed device since you can attach a debugger. [0] - https://mastodon.social/@benpye/109261545643008493 https://mastodon.social/@benpye/109261545643008493
- wrboyce 9mo agoAllow me to shamelessly plug my blog, I have been (very slowly!) re-visiting microcorruption and writing up the solutions in a tutorial-esque fashion. https://lovesexsecretgod.com https://lovesexsecretgod.com
- commandersaki 9mo agoGo through the katas at https://pwn.college https://pwn.college
- saidinesh5 9mo agoSee if there is an OTA package available for your speaker that you can extract and figure out what goes where. Then figure out what SoC your smart speaker is running. A lot of soc vendors just provide SDKs for IoT applications. Maybe you'll find something like that you can flash. Also if there's a separate SPI flash chip, you can simply dump it and study the firmware.