0xz0f/z0fcourse_reverseengineering

Reverse engineering focusing on x64 Windows.

Website Version

I will be mirroring this repository onto my website, https://www.debugxp.com/posts/RECourse. This repository will still be updated, however, I belive the website offers a better experience.

The website is a GitHub pages site hosted with CloudFlare. This is the link to the GitHub pages site repository: https://github.com/0xZ0F/0xZ0F.github.io

Reverse Engineering Course

This course aims to take an individual from beginner to intermediate (advanced is really only achieved through experience) in reverse engineering. While this course focuses on Windows 64-bit, the technical knowledge applies to 32-bit Windows and the theory to any OS.

The choice has been made for 64-bit Windows since it's modern and the most common OS and architecture. In addition, we only have to deal with one calling convention.

For a more interactive experience with the initial portion of the course (chapters 1 through 6), try out the course on TryHackMe:

1. Windows x64 Assembly
2. Windows Reverse Engineering Intro

PDF ZIP Password

There are some PDFs created and provided in ZIP files. They may not be up to date, so it's recommended to follow the normal markdown version of the course. The PDFs were provided due to a high number of requests for them.

The password for the ZIP files is "reverse" (without the quotes).

Before You Begin

• Please take a moment to read BeforeYouBegin.
• Join the Discord server: https://discord.gg/73tkPGv
  • Use the Discord server to ask for help and stay updated with the course!

What We'll Do/Learn:

This course is going to teach anyone how to reverse engineer x64 Windows. We will start by covering some basics of binaries, then reverse some small samples, reverse a DLL and implement it into our own program, reverse some malware, then look at some realistic situations.

The goal is not to teach you how to smash your head against assembly. Rather, I want to teach how to use tools to enhance your skills and capabilities. For example, we will cover how to log function calls for easier analysis using a debugger or writing our own code for more control.

Table Of Contents

Why I Made This Course

Reversing is made so much harder because of the lack of resources to learn it. Most content is outdated, overpriced, hard to follow, or low quality. Reversing is already considered by many to be a difficult field to get into. Something being difficult isn't an issue, but when it gets needlessly difficult there is an issue. After reading multiple books, countless blog posts, extensive documentation, following multiple YouTube "tutorials", and much more, I feel like it's time for someone to make a dedicated course. I don't think it should be that hard to learn one topic. I certainly don't want people to have to go through the mess I went through, so I decided to make this course. I love this field and I wanted to give back to the community. Here's my gift to you and the rest of the community. Hopefully there are a few people out there that this course can help.

Contact/Stay Updated:

Follow me on Twitter @0xZ0F!
Discord Server: https://discord.gg/73tkPGv

Please give me any and all honest feedback you have. Don't worry about hurting my feelings, I want to make this course as good as I can. I can't do that alone, that's why your feedback is so important.

The best way to stay up-to-date is to support me on Patreon which will give you access to the Patreon-only feed. The feed includes the latest updates, upcoming updates, and more.

Table Of Contents:

• License

• Contributing

• Credit

• FAQ

• Lingo

• Readme

• @BeforeYouBegin

• TableOfContents

• Documentation

  • DOC
  • Plan
  • TODO

• Files Needed

  • Files Needed
  • Chapter 6 - DLL
  • Chapter WIP - Malware

• Chapter 1 - Introduction

  • 1.0 Introduction
  • 1.1 HowTo
  • 1.2 Setup

• Chapter 2 - BinaryBasics

  • 2.0 BinaryBasics
  • 2.1 NumberSystems
  • 2.2 ASCII
  • 2.3 BitsAndBytes
  • 2.4 ProgrammingLanguages
  • 2.5 Bitwise Operations
  • 2.6 Mindset

• Chapter 3 - Assembly

  • 3.0 Assembly
  • 3.1 Registers
  • 3.2 MemoryLayout
  • 3.3 Instructions
  • 3.4 Flags
  • 3.5 CallingConventions
  • 3.6 FinalNotes

• Chapter 4 - Tools

  • 4.0 Tools
  • 4.1 ToolTypes
  • 4.2 Debugging
  • 4.3 ToolGuides

• Chapter 5 - Basic Reversing

  • 5.0 BasicReversing
  • 5.1 BeforeWeBegin
  • 5.2 FunctionCall
  • 5.3 HelloWorld
  • 5.4 Loops

• Chapter 6 - DLL

  • 6.00 DLL
  • 6.01 BeforeWeBegin
  • 6.02 DLLBasics
  • 6.03 Exports
  • 6.04 SayHello
  • 6.05 PrintArray
  • 6.06 InitializePlayer
  • 6.07 PrintPlayerStats
  • 6.08 MysteryFunc
  • 6.09 ImplementingPlayer
  • 6.10 FinalNotes

• Chapter 7 - Windows - WIP

  • 7.0 Windows
  • 7.1 Virtual Memory
  • 7.2 Privileges
  • 7.3 Architecture - WIP

• Chapter 8 - Generic Table - WIP

  • 8.00 Generic Table
  • 8.01 InitializeTable
  • 8.02 NumberGenericTableElements.md
  • 8.03 IsGenericTableEmpty.md
  • 8.04 GetElement

z0fcourse_reverseengineering's Issues

Why only windows?

Why are you just focusing on teaching reversing for x64 windows? Why not ELF binaries?

I want to say...

Thank you very much man, I really enjoyed this course.

Fastcall argument passing convention

In Section 3.5,

This space is going to be 32 bytes, 8 bytes for each of the 4 registers. Because of that, accessing parameters beyond the 4th parameter is done starting with the offset of 0x20. In other words, the fourth parameter is accessed via RSP+0x20, the third RSP+0x28, etc.

You say that fourth is at 0x20 and third at 0x28, is it not fifth at 0x20 and sixth at 0x28 and so on..?

Chapter 9

Topics to cover:

1. Logging function calls.
   • Hooking.
   • To console.
   • To file.
   • Using debugger.
2. Manually calling functions.
3. Providing a custom API/SDK for interoperability.
   • Useful for debugging.

Possible mistake in chapter 6.03

in chapter 6.03:

Function overriding allows for multiple functions of the same name that take different parameters. For example, you might want to have a function for addition. You'll probably want the ability to add integers or floats.

In my opinion, this chapter confuses funciton overriding and function overloading.

Such as in wiki:

Method overriding:
The implementation in the subclass overrides (replaces) the implementation in the superclass by providing a method that has same name, same parameters or signature, and same return type as the method in the parent class.

Function overloading:
In some programming languages, function overloading or method overloading is the ability to create multiple functions of the same name with different implementations. Calls to an overloaded function will run a specific implementation of that function appropriate to the context of the call, allowing one function call to perform different tasks depending on context.

I am new to reverse engineering, so maybe I made a mistake. Let me know if I am getting it wrong.

Update Docs

README needs to be updated as well as various docs.

Link invalid in Chapter 3.2

The following link returns a 404 error code

https://docs.microsoft.com/en-us/windows/desktop/api/winternl/ns-winternl-_peb

You probably meant
https://docs.microsoft.com/en-us/windows/desktop/api/winternl/ns-winternl-peb

How to download all pdf as one pdf?

please

Remove _DOC

This folder is not needed.

Linux can run 32bit applications on 64bit machines

in this section you mentioned that Linux is not backward compatible and that you cannot run 32bit applications on 64bit, but certainly you can when you install 32bit libs.
correct me if i'm wrong.
Good work though.

Make the course radare2/cutter-friendly

I noticed you recommend Ghidra, but it is not the only one tool available.
Radare2 is a highly-portable cross-platform reverse engineering framework and a toolkit without dependencies. It has support for analyzing binaries, disassembling code, debugging programs, attaching to remote GDB/LLDB, WinDbg servers, rich plugin system (see r2pm), and integration with various decompilers. For example, ghidra decompiler plugin - r2ghidra-dec. It is actively developed and can be easily integrated in various open source and commercial products.

For general documentation I recommend our constantly updated Radare2 Book.
For documentation on writing plugins for radare2 see Scripting and Plugins Radare2 Book chapters.

Cutter is a crossplatform Qt/C++ GUI frontend to radare2:

For documentation on writing plugins for Cutter see the official tutorial and the curated list of various popular plugins.

Consider using Cutter or IDA (Freeware or Pro) for example along with x64dbg.

Hey 0xZ0F,
this is great tutorials for beginners like me. I want to suggest you to consider using Cutter or IDA (Freeware or Pro) for the assembly part.
Q. : Why..??? any particular reason..??
A. : Most of the malware analyst spent their time with IDA or students like me who want to learn malware analysis with opensource tools use Cutter for initial days in their learning journey and I see most of the exploit developers are using x64dgb.
So, adding IDA and Cutter examples would help in both MA and RE.
I know their would be no difference in assembly part. but, if we add, then it'd cover most probably entire RE and MA field.

Consider using GH pages

As the title says, consider using github pages to have an improved interface for the course. You should be able to pretty much enable GH pages and forget about it, since it supports markdown.

Possible mistake in chapter 3.2

First of all, thank you so much for writing this material, it is amazing.

I am a beginner with these low level topics so I might be wrong, but when I was reading the Stack explanation, these two parts seemed contradictory to me:

• When data is pushed onto the stack, the stack grows up, towards lower memory addresses.

• The stack pointer (RSP/ESP/SP) is used to keep track of the top of the stack and the base pointer (RBP/EBP/BP) is used to keep track of the base/bottom of the stack. This means that when data is pushed onto the stack, the stack pointer is increased since the stack grew towards higher addresses.

I think that the second quote should be,

The stack pointer (RSP/ESP/SP) is used to keep track of the top of the stack and the base pointer (RBP/EBP/BP) is used to keep track of the base/bottom of the stack. This means that when data is pushed onto the stack, the stack pointer is decreased since the stack grew towards lower addresses.

Let me know if I am getting it wrong :)