Reverse Engineering Basics on Linux

For learning only. Practise on programs you wrote or on CTF challenges that invite you to analyse them. Do not remove licence checks from software you do not own.

Reverse engineering means working out how a program behaves when you only have the compiled file and not the source code. Malware analysts, CTF players and defenders all use it.

1. Make a practice program

#include <stdio.h>
#include <string.h>
int main(void){
  char in[64];
  printf("Password: ");
  scanf("%63s", in);
  puts(strcmp(in, "labpass") ? "Denied" : "Access granted");
  return 0;
}

gcc -o practice practice.c

2. Static analysis

file practice
readelf -h practice
strings practice | head -30
objdump -d -M intel practice | less

strings already shows the text compiled into the file. This is why developers should never hard-code secrets in a program.

3. Dynamic analysis

ltrace ./practice
gdb ./practice

ltrace shows library calls such as strcmp. Inside gdb you can use these commands:

break main
run
disassemble main
info registers

4. A decompiler

Ghidra is a free tool that turns machine code into readable C-like code. Open your practice file, find main and rename the variables as you understand them.

5. Skills to build

Learn the basics of assembly (registers, cmp, jmp, call), then try the Reverse category of beginner CTFs and write notes on every challenge you solve.

Always analyse unknown or suspicious files inside an isolated virtual machine.