Reverse Engineering Learning Path

⚠️ Ethical Reminder: Reverse engineering is a powerful skill. Always practice within legal and ethical boundaries. Only analyze software you own or have explicit permission to analyze.

---

Apa Itu Reverse Engineering?

Reverse Engineering (RE) adalah proses menganalisis produk/sofware untuk memahami:

• Cara kerjanya (algoritma, logic flow)
• Strukturnya (file format, protocol)
• Vulnerabilities (security flaws)
• Compatibility (interoperability)

Contoh Penggunaan Ethical RE:

• Menganalisis malware untuk incident response
• Memahami format file proprietary untuk interoperability
• Security research dengan responsible disclosure
• Recovering lost source code (seperti kasus Anda dengan ClashFarmer)
• Learning and education

---

Kenapa AI Tidak Cukup?

AI (ChatGPT, Claude, dll) bisa membantu RE, tapi tidak bisa menggantikan skill fundamental:

Aspek	Bisa AI Bantu	Harus Kamu Pahami
Membaca assembly	✅ Explain instruction meaning	❌ Calling conventions, stack frame, register usage
Decompile C code	✅ Explain function logic	❌ Compiler optimizations, obfuscation patterns
Identifikasi algoritma	✅ Recognize crypto/hash patterns	❌ Custom algorithms, proprietary logic
Debugging runtime	✅ Suggest breakpoints	❌ Memory layout, heap corruption, race conditions
Bypass protections	✅ Explain technique concepts	❌ Anti-debug, packer unpacking, VM analysis
Protocol RE	✅ Parse captured packets	❌ State machines, encryption schemes

Rule of thumb: AI = asisten yang menjelaskan apa yang kamu lihat. Tapi kamu harus tahu apa yang harus dilihat.

---

🎯 Learning Roadmap (6-12 Bulan)

📌 Phase 0: Prerequisites (1-2 bulan)

Sebelum nyentuh tools RE, kuasai dulu fondasi ini:

0.1 Computer Architecture

• CPU: Registers (eax, ebx, ecx, edx, rsp, rbp, rip), flags register
• Memory: Stack vs Heap, virtual memory, paging, segments
• Instruction Cycle: Fetch-decode-execute
• Calling Conventions: cdecl, stdcall, fastcall, x64 calling convention

Resource:

• x86-64 Assembly Programming
• Computer Systems: A Programmer's Perspective (CS:APP)
• OSDev Wiki

0.2 Operating Systems

• Process: Virtual address space, PE/ELF format, sections
• Threads: Context switching, synchronization
• System Calls: How userland ↔ kernelland berkomunikasi
• Memory Management: Paging, segmentation, ASLR, DEP/NX

Resource:

• Windows Internals Book
• Linux Kernel Documentation

0.3 Programming (You should be comfortable with):

• C/C++: Pointers, memory management, structs
• Python: Scripting automation
• Assembly basics: Enough to read simple functions

Latihan:

• Tulis program C sederhana, compile, lalu baca assembly outputnya (gcc -S)
• Pahami perbedaan antara debug build dan release build

---

📌 Phase 1: Static Analysis (2-3 bulan)

Menganalisis binary tanpa menjalankannya.

1.1 File Format Analysis

• PE (Portable Executable): Headers, sections, imports, exports, resources
• ELF (Executable and Linkable Format): Segments, sections, dynamic linking
• Mach-O: macOS/iOS binary format

Tools:

• CFF Explorer — PE analysis (Windows)
• readelf / objdump — ELF analysis (Linux)
• file, strings, hexdump — Basic inspection

Latihan:

• Analisis notepad.exe dengan CFF Explorer
• Identifikasi: Entry point, imports (DLL apa saja), sections, entropy
• Cari string menarik dengan strings command

1.2 Disassembly

• Membaca assembly x86/x64
• Mengenali pola compiler (VC++, GCC, Clang)
• Control flow: jumps, calls, loops, conditions
• Data structures: arrays, structs, vtables

Tools:

• Ghidra — Free, NSA-developed, powerful decompiler
• IDA Pro — Industry standard (paid, ada versi free)
• Binary Ninja — Modern, cloud-based collaboration
• radare2 — CLI-based, scriptable

Latihan:

• Compile program C sederhana (kalkulator, string reversal)
• Buka di Ghidra/IDA
• Bandingkan source code C dengan assembly/disassembly
• Identifikasi: function prologue/epilogue, local variables, parameters

1.3 Decompilation

• Memahami keterbatasan decompiler
• Reconstructing data types
• Recognizing compiler idioms
• Manual type recovery

Latihan:

• Decompile function sederhana, lalu tulis ulang dalam C
• Bandingkan hasil decompile dengan source asli
• Perhatikan: loop unrolling, inlining, dead code elimination

1.4 Obfuscation Recognition

• Packing: UPX, Themida, VMProtect
• Code obfuscation: Control flow flattening, opaque predicates
• String encryption: Encrypted strings decrypted at runtime
• Anti-analysis: Anti-debug, anti-VM, timing checks

Resource:

• Practical Binary Analysis
• Reversing: Secrets of Reverse Engineering

---

📌 Phase 2: Dynamic Analysis (2-3 bulan)

Menganalisis binary saat berjalan.

2.1 Debugging

• Breakpoints: Software, hardware, memory, conditional
• Stepping: Step into, step over, step out
• Registers & Memory: Watch memory regions, stack view
• Call Stack: Trace execution flow

Tools:

• x64dbg — Modern Windows debugger (free)
• OllyDbg — Classic (legacy, use x64dbg instead)
• WinDbg — Microsoft's kernel debugger
• GDB — Linux debugger
• LLDB — macOS debugger

Latihan:

• Debug simple crackme (cari di crackmes.one)
• Trace execution dari entry point sampai message box muncul
• Identifikasi: password check routine, anti-debug checks

2.2 Runtime Instrumentation

• Hooking: IAT hooking, inline hooking, API hooking
• DLL Injection: Remote thread, SetWindowsHookEx, manual map
• Process Monitoring: File access, registry access, network calls

Tools:

• Frida — Dynamic instrumentation toolkit (cross-platform)
• API Monitor — Windows API tracing
• Process Monitor (ProcMon) — File/registry monitoring

Latihan:

• Inject DLL ke Notepad menggunakan Frida
• Hook MessageBoxA untuk intercept teks
• Monitor semua file yang dibuka oleh aplikasi target

2.3 Network Analysis

• Packet Capture: Wireshark, tcpdump
• Protocol Analysis: HTTP/HTTPS, custom binary protocols
• Man-in-the-Middle: Burp Suite, mitmproxy, Fiddler

Latihan:

• Capture traffic aplikasi desktop/mobile
• Identifikasi: protocol structure, encryption method, API endpoints

---

📌 Phase 3: Specialized Topics (2-3 bulan)

3.1 Malware Analysis

• Static: Identifikasi packer, strings encrypted, imports
• Dynamic: Sandbox analysis (Any.Run, Hybrid Analysis)
• Behavior: Persistence mechanisms, C2 communication, payload extraction

Resource:

• Practical Malware Analysis
• Malware Analysis Bootcamp

3.2 Mobile RE

• Android: APK decompilation (JADX), Dalvik bytecode, Frida for Android
• iOS: IPA analysis, Mach-O, dyld, jailbreak tools

Tools:

• JADX — APK decompiler
• APKTool — APK disassembly
• Frida — Mobile instrumentation
• ** objection** — iOS/Android runtime exploration

3.3 Game RE & Botting

• Memory Scanning: Cheat Engine, pattern scanning
• Client-Server Protocol: Packet interception, crypto analysis
• Anti-Cheat Bypass: Kernel drivers, integrity checks (educational only!)

⚠️ Legal Warning: Game RE untuk bypass anti-cheat atau bikin cheat = illegal. Educational analysis of single-player/offline games = acceptable.

3.4 Cryptography in RE

• Identifikasi algoritma: AES, RSA, RC4, custom XOR
• Key extraction dari memory
• Protocol decryption

---

📌 Phase 4: Advanced (Ongoing)

• Kernel Driver RE: Windows drivers, rootkits
• VM-based Obfuscation: VMProtect, Themida, custom VMs
• Exploit Development: Buffer overflow, ROP chains, shellcoding
• Hardware RE: Firmware analysis, embedded systems
• Automated Analysis: Scripting Ghidra/IDA, signature generation

---

🛠️ Essential Tools Setup

Must-Have Tools (Free)

Tool	Purpose	Platform
Ghidra	Disassembly + Decompilation	Cross-platform
x64dbg	User-mode debugger	Windows
GDB + PEDA/GEF	Debugger with enhanced UI	Linux
IDA Free	Industry-standard disassembler	Cross-platform
CFF Explorer	PE analysis	Windows
Detect It Easy (DIE)	Packer/Compiler identification	Cross-platform
PE-bear	PE analysis	Cross-platform
HxD	Hex editor	Windows
010 Editor	Advanced hex editor (trial)	Cross-platform
Frida	Dynamic instrumentation	Cross-platform
API Monitor	API tracing	Windows
Wireshark	Network analysis	Cross-platform
JADX	Android APK decompiler	Cross-platform
dnSpy/dnSpyEx	.NET decompiler	Windows

Scripts & Utilities

• Python: pefile, capstone, unicorn, pwntools
• YARA: Signature-based detection
• LIEF: Library to Instrument Executable Formats

---

🎓 Practice Platforms

Platform	Difficulty	Focus
crackmes.one	Easy-Hard	Crackmes, keygens
pwnable.kr	Medium-Hard	Binary exploitation
pwnable.tw	Medium-Hard	CTF challenges
ReverseEngineering StackExchange	All levels	Q&A community
Flare-On Challenge	Hard	FireEye's annual RE CTF
Crackmes.de	Easy-Medium	Classic crackmes

---

📚 Recommended Reading

Books

1. "Reversing: Secrets of Reverse Engineering" — Eldad Eilam
2. "Practical Reverse Engineering" — Dang, Gazet, Bachaalany
3. "Practical Binary Analysis" — Dennis Andriesse
4. "Practical Malware Analysis" — Sikorski & Honig
5. "The IDA Pro Book" — Chris Eagle

Online Resources

• OpenSecurityTraining — Free video courses
• LiveOverflow YouTube — Binary exploitation & RE
• OALabs YouTube — Malware analysis
• MalwareUnicorn — Workshops & guides
• Begin.re — Reverse engineering for beginners

---

🔄 How AI Fits Into Your RE Workflow

✅ AI Bantu Banget di:

• Menjelaskan assembly: "What does mov eax, [ebp+8] do?"
• Pattern recognition: "This looks like AES key schedule, right?"
• Script generation: "Write a Ghidra script to find all XOR loops"
• Deobfuscation hints: "How do I approach VMProtect-ed code?"
• Documentation: "Summarize what this function likely does"

❌ AI Gak Bisa di:

• Experience: Feel-nya debugging, intuisi flow program
• Novel obfuscation: Custom protection schemes belum pernah AI lihat
• Complex context: Hubungan antar 50+ functions dalam large binary
• Live adaptation: Real-time decision making saat debugging
• Physical access: Hardware analysis, JTAG, firmware extraction

💡 Best Practice: Hybrid Approach

1. Kamu analyze binary → identify interesting function
2. AI explain assembly → save time reading docs
3. Kamu validate → test in debugger
4. AI suggest approach → "How to bypass this check?"
5. Kamu implement → manual patching/hooking
6. Document → AI help write notes (like this repo!)

---

🗂️ This Repo Structure

reverse-engineering/
├── README.md                 # This learning plan
├── notes/
│   ├── phase0-prerequisites/
│   ├── phase1-static-analysis/
│   ├── phase2-dynamic-analysis/
│   ├── phase3-specialized/
│   └── phase4-advanced/
├── tools/
│   ├── scripts/              # Python/AutoIt helper scripts
│   └── configs/              # Tool configurations
├── exercises/
│   ├── crackmes/             # Your crackme solutions
│   ├── binaries/             # Target binaries for practice
│   └── writeups/             # Analysis writeups
└── references/
    ├── cheat-sheets/
    └── bookmarks.md

---

🚀 Your First Week Action Plan

Day 1-2: Setup

• Install Ghidra + x64dbg + Python
• Baca Begin.re introduction
• Compile program C sederhana, lihat assembly output

Day 3-4: First Disassembly

• Download crackme easy dari crackmes.one
• Buka di Ghidra, lihat decompilation
• Cari password check routine

Day 5-7: First Debug

• Buka crackme di x64dbg
• Set breakpoint di password check
• Trace execution sampai ke password comparison
• Tulis writeup pertama Anda

---

📝 Notes & Changelog

Date	Note
2026-06-01	Initial learning plan created

---

"Reverse engineering is not about memorizing instructions — it's about understanding intent."