3 ms·

> Taking the opportunity to ask: are there nice recommended resources for a beginner to start with reverse engineering (ideally using Ghidra)? Let's say for an

> Taking the opportunity to ask: are there nice recommended resources for a beginner to start with reverse engineering (ideally using Ghidra)? Let's say for an experienced developer, but not so experienced in reverse engineering? The good news is that there has never been MORE resources out there. If you want to use this learning expedition as an excuse to also build up a small electronics lab then $100 on ali express to buy whatever looks cheap and interesting and then tear it apart and start poking around to find where the firmware lives. Pull the firmware, examine it, modify it and put it back :) This guy has a discord server with a specific "book club" section where they all choose a cheap $thing and reverse engineer it: https://www.youtube.com/@mattbrwn/about https://www.youtube.com/@mattbrwn/about I can't help much with "traditional" app/software RE work, sorry.

palata 8mo ago
Oh, it feels like it may be what I want! Find some cheap electronic device and hack it! Thanks a lot!
- baby_souffle 8mo ago
  I would also suggest spending a few minutes to set up an mCP server with ghidra once you've learned the basics of navigating and working inside of ghidra. Turns out that frontier grade llms are absolutely fantastic for extremely advanced static analysis. If you go one step further and manage to get your firmware running inside of an emulator or other place where you can attach GDB... Then putting an mCP server on that as well unlocks so much insane potential.
  - throwerxyz 8mo ago
    Would that include free use LLMs. I assume getting into something would be tricky if you are assuming they're going to drop several hundreds of tokens a month on it. I feel like the tendency for people to assume others have nearly $500 or so of credits on their AI to blow every month is kinda crazy. Reminds me of the "just get Netflix, Prime, etc." ending up with a $100/m bill.
    - baby_souffle 8mo ago
      > Would that include free use LLMs. I can't comment on the self-hosted models but if they support tool calling / MCP then it should work. How well may be a function of model size/arch/quant ... etc though. > I feel like the tendency for people to assume others have nearly $500 or so of credits on their AI to blow every month is kinda crazy. My use is hobby level so $20/mo chatGPT sub is enough. I do hit my 5hr limits on a regular-ish interval but that's usually a sign that I need to step away from the work anyways.

palata 8mo ago

Oh, it feels like it may be what I want! Find some cheap electronic device and hack it! Thanks a lot!

baby_souffle 8mo ago
I would also suggest spending a few minutes to set up an mCP server with ghidra once you've learned the basics of navigating and working inside of ghidra. Turns out that frontier grade llms are absolutely fantastic for extremely advanced static analysis. If you go one step further and manage to get your firmware running inside of an emulator or other place where you can attach GDB... Then putting an mCP server on that as well unlocks so much insane potential.
- throwerxyz 8mo ago
  Would that include free use LLMs. I assume getting into something would be tricky if you are assuming they're going to drop several hundreds of tokens a month on it. I feel like the tendency for people to assume others have nearly $500 or so of credits on their AI to blow every month is kinda crazy. Reminds me of the "just get Netflix, Prime, etc." ending up with a $100/m bill.
  - baby_souffle 8mo ago
    > Would that include free use LLMs. I can't comment on the self-hosted models but if they support tool calling / MCP then it should work. How well may be a function of model size/arch/quant ... etc though. > I feel like the tendency for people to assume others have nearly $500 or so of credits on their AI to blow every month is kinda crazy. My use is hobby level so $20/mo chatGPT sub is enough. I do hit my 5hr limits on a regular-ish interval but that's usually a sign that I need to step away from the work anyways.