I'm getting started with some reverse engineering lately, especially on Linux and ELF format, but I'm struggling here.

For now I'm only using GDB to disassemble binaries, and even though I can read and understand the assembly code in general, I don't know "where" to look, or what register to check to find the flag (I'm talking about CTFs here).

What I'm asking for are books or videos, something to get me used to GDB and give me the thinking methodology (if there's such a thing). Thanks!

  • There is no such "Look at this register to get the flag" tutorial. Every good CTF is different and require thinking out of the box. Maybe you should try to do some wargames so you can learn step by step and teach yourself by practice what you need to know : exploit-exercises.com/nebula
    – Spl3en
    Jun 23, 2015 at 15:17
  • I think CTF write-ups about reversing will help you here 1 2 also I highly recommend: Learning Linux Binary Analysis book also check LiveOverflow channel in youtube
    – adrián
    May 1, 2017 at 21:54

3 Answers 3


Special for beginners Dennis Yurichev wrote this book: Reverse Engineering for Beginners

You can find it and download on his site for free.

Topics discussed: x86/x64, ARM/ARM64, MIPS, Java/JVM.

Topics touched: Oracle RDBMS, Itanium, copy-protection dongles, LD_PRELOAD, stack overflow, ELF, win32 PE file format, x86-64, critical sections, syscalls, TLS, position-independent code (PIC), profile-guided optimization, C++ STL, OpenMP, win32 SEH.


If you want to learn reverse engineering on Linux, I highly recommend: Learning Linux Binary Analysis.

It is the only book (that I know of) that goes in depth on the ELF format.



I highly recommended this position: https://www.amazon.com/Practical-Reverse-Engineering-Reversing-Obfuscation/dp/1118787315


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.