Reverse Engineering Cheat Sheet

Goal: understand what a binary does without source. Start with strings/analysis → static disassembly → dynamic debugging.

First Look (quick triage)

• File type & protections file ./bin, checksec ./bin (or readelf)
• Interesting strings strings -n 8 ./bin | grep -iE "flag|pass|secret|key|/bin/sh"
• Imports & sym objdump -T ./bin, nm -D ./bin (dynamic symbols)
• Sections readelf -h -l -S ./bin

Static Analysis (disassembly)

• objdump text + source interleave objdump -d -M intel ./bin
• Symbol table (if not stripped) nm ./bin
• Full graph visual: Ghidra (free, GUI) — decompile: open, auto-analysis, Functions → main → “Decompile”
• IDA (paid) same workflow in C decompiler
• radare2 / rizin CLI: r2 -A ./bin → aaa; afl; s main; pdf

Dynamic Analysis (debugger)

• GDB quick: run with input, break at cmp after user input, read stack/registers
• pwndbg/GEF helpers: checksec, context, ropper
• Trace interesting calls: break at system, strcmp, write — b system, then continue
• Patch & re-run quickly: change jz to nop / jnz to jne in gdb (set writes on not built-in — use binary patch with radare2 wx eb 00 @ 0x401234)

Deobfuscation / unpacking

• Detect packer: upx -d ./bin if UPX; strings still junk → likely packed
• Unpacking with gdb caveat: break at OEP (Original Entry Point) — run, watch for popad; jmp (upx), Dump + fix imports
• PowerShell/JS/obfuscated Python: decode iteratively (base64 layers, exec/eval scan, de4py for python)

Android/Java

• APK: unzip, jadx-gui app.apk → decompile dex to Java, search strings for flags/keys
• Native lib: same GDB/IDA on .so

ELF/PE essentials

• ELF header magic 7f 45 4c 46; PE 4d 5a (MZ)
• Entry point: ELF .entry, PE AddressOfEntryPoint
• Sections to inspect: .text code, .rodata strings, .bss zero-init data
• strings offset then find in disasm: info functions + x/20i <addr>

Ghidra quick-start commands (headless / script)

# GUI
File → Import File → OK → double-click → Analyze → Yes
# decompile: click function → press F5 (or Window → Decompile)

• Scripting: analyzeHeadless <proj> <tmp> -import ./bin -scriptPath . -postScript ExportFuncs.java

Basic Rev-of-CTF checklist

1. Strings → the flag/secret is usually there
2. If encoded: base64/hex/xor — detect via look, xxd, or radare2 rar-ish enc
3. If function checks: load in GDB, run, feed input, single-step to cmp/jne, read compare value (often plaintext or adjacent in memory)
4. If packed: packer detect → unpack → repeat
5. If encrypted: find key material in data section and the crypto used (AES/RSA detect via imports)

Tools

• Free: Ghidra, rizin/radare2, gdb+pwndbg, objdump, readelf, hopper (trial), retdec (decompiler), cyberchef (decode kit)
• Paid: IDA Pro, Binary Ninja, Hopper, JEB (Android)

Tips

• Always checksec before exploit-writing (NX/PIE/Canary/RELRO)
• Note base address for PIE: vmmap (GEF) or pwndbg — read adds base+offset
• For 64-bit passes: ROP, pop rdi; ret, ret2libc — craft with ropper --search "pop rdi"
• Cross-compile test objects with same libc: pwninit or libc-database find