Reverse Engineering Basics: Your First Steps

This guide is for learning. Run these commands only on your own lab or servers.

Reverse engineering means working out how a program behaves when you only have the compiled file. It is useful for CTFs, malware defence and understanding software. The best way to start is with a program you wrote yourself.

Legal note: only reverse engineer your own programs, practice binaries and CTF challenges. Do not use these skills to break licences or protections of software you do not own.

1. Make a tiny program

cat > hello.c << 'EOF'
#include <stdio.h>
int main(void){ puts("secret-lab-key"); return 0; }
EOF
gcc hello.c -o hello

2. Look from the outside

file hello
strings hello | grep secret
ltrace ./hello

file shows the type, strings reveals readable text inside the binary, and ltrace shows library calls. Often this alone answers the question.

3. Read the assembly

objdump -d -M intel hello | less
gdb ./hello

Inside gdb, try break main, then run, then disassemble. Do not worry about every instruction. Learn to spot function calls, comparisons and jumps.

4. Use a decompiler

Ghidra is a free tool from the NSA that turns machine code into readable C-like code. Open your hello program in it and compare what it shows with your source.

5. Practise safely

Move on to beginner reversing challenges in CTFs. They are made to be solved, so you learn without breaking any rules.

Keep practising on your own code and CTF binaries, and write down what you learn after each one.