3

I'm getting started with some reverse engineering lately, especially on Linux and ELF format, but I'm struggling here.

For now I'm only using GDB to disassemble binaries, and even though I can read and understand the assembly code in general, I don't know "where" to look, or what register to check to find the flag (I'm talking about CTFs here).

What I'm asking for are books or videos, something to get me used to GDB and give me the thinking methodology (if there's such a thing). Thanks!

Improve this question
2
  • There is no such "Look at this register to get the flag" tutorial. Every good CTF is different and require thinking out of the box. Maybe you should try to do some wargames so you can learn step by step and teach yourself by practice what you need to know : exploit-exercises.com/nebula
    – Spl3en
    Commented Jun 23, 2015 at 15:17
  • I think CTF write-ups about reversing will help you here 1 2 also I highly recommend: Learning Linux Binary Analysis book also check LiveOverflow channel in youtube
    – adrián
    Commented May 1, 2017 at 21:54

3 Answers 3

Reset to default
5

Special for beginners Dennis Yurichev wrote this book: Reverse Engineering for Beginners

You can find it and download on his site for free.

Topics discussed: x86/x64, ARM/ARM64, MIPS, Java/JVM.

Topics touched: Oracle RDBMS, Itanium, copy-protection dongles, LD_PRELOAD, stack overflow, ELF, win32 PE file format, x86-64, critical sections, syscalls, TLS, position-independent code (PIC), profile-guided optimization, C++ STL, OpenMP, win32 SEH.

Improve this answer
0
1

If you want to learn reverse engineering on Linux, I highly recommend: Learning Linux Binary Analysis.

It is the only book (that I know of) that goes in depth on the ELF format.

https://www.amazon.com/Learning-Binary-Analysis-elfmaster-ONeill/dp/1782167102/ref=sr_1_1?ie=UTF8&qid=1493623237&sr=8-1&keywords=linux+binary+analysis

Improve this answer
1
0

I highly recommended this position: https://www.amazon.com/Practical-Reverse-Engineering-Reversing-Obfuscation/dp/1118787315

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.