Reverse Engineering
Static and dynamic analysis, decompilation, and the patterns that make a binary readable again.
- •7 min read•elfreverse-engineering
Mini-Readelf: Gluing It All Together
The capstone. Four parts of pieces, headers, sections, symbols, relocations, joined into one tool that reads any ELF. The only new mechanic is the sh_link chain: offset into a table that holds offsets into a table that holds strings.
- •6 min read•elfreverse-engineering
Relocations: How PIE Binaries Fix Their Addresses
A PIE binary can't write final addresses because ASLR moves it. The linker leaves placeholders and the loader patches them after mapping. That's a relocation: R_X86_64_RELATIVE, GLOB_DAT and JUMP_SLOT.
- •7 min read•elfreverse-engineering
Symbol Tables: What Function Names Actually Are
Function names in a binary are just entries in a table. Two tables actually: .symtab and .dynsym. Here's what each is for, how the struct works, and how to resolve a name from an address.
- •12 min read•elfreverse-engineering
Building a Custom ELF Loader from Scratch, in C
You type ./program and the kernel loads it. Here's how that works: we build a userspace ELF loader in ~300 lines of C that maps PT_LOAD segments, builds a stack by hand, and jumps to the entry point.
- •8 min read•elfreverse-engineering
Parsing ELF Binaries in C
The first step to actually understanding what runs on your machine: read an ELF file yourself. No libelf, no readelf — just mmap and pointer casts. I walk the header and section table of a real binary, and diff my output against the tools that already exist.
- •5 min read•elfreverse-engineering
Easy Elf (reversing.kr)
Find the password that makes the binary print `Correct!`.
- •8 min read•reverse-engineeringsystems-programming
Why C still matters for Reverse Engineering
C is still the GOAT of reverse engineering
- •11 min read•reverse-engineeringos-internals
Syscall-Level Reversing, Part 2: Unhooking and Direct Syscalls
Edr and AV products hook ntdll to sit between a program and the kernel. Here is how that hooking works, how it gets spotted, and how direct syscalls are used to slip past it.
- •9 min read•reverse-engineeringos-internals
Syscall-Level Reversing, Part 1: Why the Kernel Boundary Matters
What actually happens when a program asks the kernel for something, how to recognise a syscall in a disassembly, and why malware unhooks this layer first.
- •3 min read•reverse-engineeringstatic-analysis
Binary Whisper: Beginner Binary Analysis Walkthrough
A friendly, step-by-step writeup of the Binary Whisper challenge using basic static analysis and a tiny XOR decode script.