Content about reverse engineering

• Sep 9, 2026•7 min read•

  elfreadelf

  Mini-Readelf: Gluing It All Together

  The capstone. Four parts of pieces, headers, sections, symbols, relocations, joined into one tool that reads any ELF. The only new mechanic is the sh_link chain: offset into a table that holds offsets into a table that holds strings.

• Sep 5, 2026•6 min read•

  elfrelocations

  Relocations: How PIE Binaries Fix Their Addresses

  A PIE binary can't write final addresses because ASLR moves it. The linker leaves placeholders and the loader patches them after mapping. That's a relocation: R_X86_64_RELATIVE, GLOB_DAT and JUMP_SLOT.

• Sep 4, 2026•7 min read•

  elfsymbols

  Symbol Tables: What Function Names Actually Are

  Function names in a binary are just entries in a table. Two tables actually: .symtab and .dynsym. Here's what each is for, how the struct works, and how to resolve a name from an address.

• Sep 3, 2026•12 min read•

  elfloader

  Building a Custom ELF Loader from Scratch, in C

  You type ./program and the kernel loads it. Here's how that works: we build a userspace ELF loader in ~300 lines of C that maps PT_LOAD segments, builds a stack by hand, and jumps to the entry point.

• Aug 6, 2026•5 min read•

  reverse engineeringbinaries

  Easy Elf (reversing.kr)

  Find the password that makes the binary print `Correct!`.

• Jun 30, 2026•8 min read•

  reverse engineeringc programming

  Why C still matters for Reverse Engineering

  C is still the GOAT of reverse engineering

• Jun 26, 2026•11 min read•

  syscallskernel

  Mastering Syscall-Level Reversing pt2; The Art of Unhooking & Direct Syscalls

  The hook is the problem