How do I move from RCE being a hobby to RCE being a profession?

Question

I'm currently a high school sophomore. I haven't really done much on the RCE of malware, I've unpacked zbot and rbot, and looked at how they work, but I can manipulate practically any game to my liking by reverse engineering it and finding out which functions I need to detour, or what addresses of code I need to patch.

From what I've read on the /r/ReverseEngineering, I should create a blog, but what do what do I write on the blog? Do I just detail how I hacked the game? Or must it be purely reversing of malware?

Answer 1

Someone who does RCE as a hobby and has gathered a lot of experience and hones his/her skills with it can arguably be more experienced than someone doing it for a living but only occasionally.

Simply put: to make it a profession (i.e. what you do for a living), take up a job which requires (and subsequently fosters) your RCE expertise.

And no, by no means do you have to reverse engineer malware in order to be considered a reverse engineer. For all practical purposes in the scope of this site even people reverse engineering household electronics or other consumer goods are just that: reverse engineers. Malware is but one field of expertise within the niche subject of RCE.

And there are loads of fields within RCE. Heck, have a look on meta.RE.SE to see what some want to be within the scope of this site and others don't (and participate, please!). Given that by comparison the RCE community is a relatively small one, I don't think anyone will look down on you for being a beginner or specializing in this or that. Instead, I reckon, you'll be welcomed and the only expectation is the willingness, ability and - yes - eagerness to learn.

There is no clear line between the amateur and the professional, which I gather is what your question is all about. Except if you consider that someone makes a living from his reverse engineering skills as that line. But I think anyone with a high enough experience/skill level has to be considered a professional based on that experience/skill - not based on how s/he makes his/her living.

And no, you don't need a blog. But don't let that keep you from creating one. A blog, especially if you are a student, can be a good reference for potential future employers. So if you choose a more serious nickname than I chose here on SE, if you keep the topics and language in your blog posts professional and refrain from leet-speak, you will not only gather followers within the RCE community, you'll also show what you are capable of. And that last part is what sets the professional seasoned reverse engineer apart from the amateur or beginner: experience, loads and loads of experience. Communities such as this one, OpenRCE, kernelmode.info, Woodmann will give you a wealth of information. Crackmes and Reversemes can provide a playful incentive to improve your knowledge/skills/expertise and your blog is the shop window out into the world through which you show what you can offer.

Hint: advertise your blog on your profile here and make sure to answer and/or ask questions so that people click your profile. This should get your blog a following that knows the subject matter and will be able to comment and otherwise interact with you.

---

Since I work in the anti-X industry, currently AV, I thought I should perhaps add a few remarks concerning that particular field, since you mentioned the reverse engineering of malware in your question.

If you want to work in the anti-X industry

Rolf already pointed you to: Where can I, as an individual, get malware samples to analyze? So I'll leave it at excellent question, excellent answers for that one. Here follow my remarks

A career in AV

• most AV companies will not hire anyone who wrote malware. Some, as far as I know, did in the past. However, this only fosters the urban myth that we're writing the malware ourselves. I can tell you that we really don't have to - the commercialized malware industry, yes industry, does a pretty good job at it and we try hard to keep up. However, there is truth in that urban myth in that one of the - if not the - first AV vendor (I want give names!) offered bounties for new malware. Well what's the easiest way of getting a bounty if the few available samples are all known? Uh huh, writing your own and submitting it to cash the bounty ...
  • some companies will "tone it down" to" we will not hire anyone who wrote malware and is stupid enough to admit it - if s/he wrote one and we find out, we'll fire that person on the spot.
• analyzing malware requires some specializations that you won't have in other RCE topics. If you specialize in kernel mode malware, you are fairly specialized but there will be demand for people with these skills. Still most of the generic methodologies in RCE are applicable for malware - after all reversing malware is a subset of RCE as a whole.
• some analysts in AV labs won't have the expertise and skills to work with disassembly, for example. Some know a few basics, for some that all stopped back in DOS times (i.e. they will be able to use good ol' debug on a .com file and that's it) and others will specialize in malicious scripts and not need that skill set at all. Also many malware families these days can be identified by traits that don't require going into the nitty gritty.

Literature I find/found useful before and during my career

• The Rootkit Arsenal
• Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
• Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code
• Rootkits: Subverting the Windows Kernel
• The IDA Pro Book: The Unofficial Guide to the World's Most Popular Disassembler
• Gray Hat Python: Python Programming for Hackers and Reverse Engineers
• The Art of Computer Virus Research and Defense (classic, but a bit outdated, still good reading)

Answer 2

First of all, take heart. The skills you describe with game hacking will serve you very well in a career in reverse engineering. If you can do what you describe, you're off to a great start, and I imagine that many jobs would be available to you merely on that basis.

So now you run into the problem that confronts many hobbyist reverse engineers wanting to go professional: your expertise is kind of dirty. Take heart on this point too, as many hobbyists (e.g., crackers) face an even worse version of this problem.

The short version is that you need to parlay your existing skills into producing publications that won't get you sued or arrested. Leave the dirt behind; at least, don't publish it. I'm sure there are freeware, abandonware, and/or single-player, etc. games that you can hack that won't raise any hackles. Publish things like this on a blog and/or at conferences using your real name, and submit them to the Reverse Engineering reddit to gain some exposure.

Another piece of advice I can offer is to leverage your connections. It's not impossible that some of the people you know in the game hacking scene are doing that as a hobby, whereas their professional employment is already in computer security. Ask those people for help, and be prepared to repay favors if they can.

Furthermore, seeing as most jobs in reverse engineering don't involve hacking games explicitly (although similar skills will be utilized), it makes sense to branch out into the other parts of reverse engineering and show employers that you can in fact do those things too.

On the malware side, there are never legal concerns. See this question for places to get malware samples; bonus points if you publish your analyses in a timely fashion. For this, I recommend following the anti-virus industry on twitter and seeing what the latest threats are, or worm your way into one of the good-old-boy anti-virus sample sharing mailing lists.

Vulnerability analysis might get you sued, but that happens infrequently. Be judicious, practice responsible disclosure, and maybe use a service like ZDI or EIP if you're extremely concerned about the risks associated with disclosure.

Finally, employers in this space are more concerned with skills than they are with degrees and so on. So if you apply for a reverse engineering position somewhere, most likely what will happen is that they will give you some sort of challenge to determine whether you have the necessary skills. Therefore, don't be discouraged about applying to jobs if you haven't published anything; doing well on the interview challenges is looked upon very highly for obvious reasons. Nevertheless, I still recommend publication.

In summary: ask your game hacking buddies if they do RE professionally; publish, but don't publish dirt; diversify; and apply for jobs regardless of what the state of your published work is.

Answer 3

Taking your hobby to a profession is a bigger deal than just knowing what you're doing. Suddenly your hobby becomes 'work'. Can you deal with that? Or will the loss of enthusiasm hurt you? Also, you'll have to be much more collaborative in a job, where-as a hobby is often (mostly) a lone undertaking.

So, the most important thing is making sure you are ready to take this step. I strongly recommend trying some small contract work projects to ensure that you can work equally well at your hobby when you're under pressure!

Answer 4

So you have some skills from your hobby, and you're considering moving to the next step, but:

• it's awesome to be paid to bring your hobby further
• you are not free to do it the way you want anymore

To become a professional, you need to bring attention. 'Just' publish, then ask around to get feedback, and recognition.

publish

The format absolutely does NOT matter. Quality does.

While blogging is the standard way, but not necessarily your personal favorite (My own website started as a Knoll, then a blog, and now Wiki pages on Google code, which suits me more).

Try and publish as you prefer:

• format:
  • pure text: phrack, pastebin...
  • formatted text: wiki, blog...
  • full document: standalone PDF, articles in magazines
• code:
  • code snippets
  • full source
    • with compiled binaries
• content: it doesn't really matter, but think twice, as anything seen as offensive (even rootkit/exploit) may prevent you to get hired for good. Just get a different persona if you feel like you want to ;)

make some sound

now that you have great contents, you need to get it actively known: Twitter, HackerNews, Reddit, forums. Actively ask for feedback, and discuss about it. Good feedback is pure gold, treasure it.

Answer 5

Like many others have stated, there are many different types of professional RCE positions. I think the first step for you is to determine which aspect of RCE you would like to pursue. Getting started professionally is a lot easier if you are able to specialize in a particular area: malware, vuln research, DRM, firmware reversing for compatibility, T&E, etc... If I were you, the next thing I would try to do is find my focus. I can tell you from experience that there are plenty of incident response teams looking for good malware analysts.