10.6K ·GitHub
What is this?
A curated list of reverse engineering resources: books, courses, practice grounds, and a big toolbox section spanning hex editors, disassemblers, debuggers, and dynamic analysis tools.
A curated list of reverse engineering resources: books, courses, practice grounds, and a big toolbox section spanning hex editors, disassemblers, debuggers, and dynamic analysis tools.Is it software I install, or just a reading list?It's not software — just a Markdown catalog of links on GitHub, grouped by category. You browse it and follow the links to each book, course, or tool; nothing to install.
It's not software — just a Markdown catalog of links on GitHub, grouped by category. You browse it and follow the links to each book, course, or tool; nothing to install.Where should a beginner start with it?There's nothing to set up — start with the Courses section: it opens with Lenas Reversing for Newbies and Open Security Training, while Books includes 'Reverse Engineering for Beginners' and 'Practical Malware Analysis'.
There's nothing to set up — start with the Courses section: it opens with Lenas Reversing for Newbies and Open Security Training, while Books includes 'Reverse Engineering for Beginners' and 'Practical Malware Analysis'.Is anything on this list risky to actually try?Yes — the Practice section links live malware sources like Virusshare, Contagio and malwr.com, and the README itself warns to be careful with malware, so that material deserves an isolated environment.
Yes — the Practice section links live malware sources like Virusshare, Contagio and malwr.com, and the README itself warns to be careful with malware, so that material deserves an isolated environment.Is this Windows-centric, or does it cover macOS and mobile too?Windows dominates — the PE format tools, WinDbg, x64dbg, Process Monitor — but there are dedicated Mac Decrypt and Android sections, plus cross-platform picks like gdb, lldb, Ghidra and radare.
Windows dominates — the PE format tools, WinDbg, x64dbg, Process Monitor — but there are dedicated Mac Decrypt and Android sections, plus cross-platform picks like gdb, lldb, Ghidra and radare.How can I watch what a suspicious program does at runtime?The Dynamic Analysis section is dedicated to that: Process Monitor, API Monitor, Wireshark and Fakenet for tracing behavior and network traffic, Volatility and LiME for memory forensics, and the Cuckoo sandbox for automated analysis.
The Dynamic Analysis section is dedicated to that: Process Monitor, API Monitor, Wireshark and Fakenet for tracing behavior and network traffic, Volatility and LiME for memory forensics, and the Cuckoo sandbox for automated analysis.Does it have anything on scripting IDA Pro?Yes — the Scripting section collects IDAPython tutorials like 'The Beginner's Guide to IDA Python', IDC function docs, an IDA plugin list, and the pefile Python library.
Yes — the Scripting section collects IDAPython tutorials like 'The Beginner's Guide to IDA Python', IDC function docs, an IDA plugin list, and the pefile Python library.What is the Yara section about?It gathers Yara resources — the official docs, a cheatsheet and yarGen. Yara is a rule-based pattern matching tool that malware analysts use to describe and detect malware families, so it pairs naturally with the reversing material here.
It gathers Yara resources — the official docs, a cheatsheet and yarGen. Yara is a rule-based pattern matching tool that malware analysts use to describe and detect malware families, so it pairs naturally with the reversing material here.What are similar projects?awesome-reverse-engineering, hacker-roadmap, x64dbg, Awesome-Hacking-Resources, ablation, ghidra, Claude-Red, pwndbg
awesome-reverse-engineering, hacker-roadmap, x64dbg, Awesome-Hacking-Resources, ablation, ghidra, Claude-Red, pwndbgWhich topics is it in?disassembler, malware, forensics, decompiler, malware-analysis, ctf, binary-analysis, infosec, exploit, low-level, debugging, static-analysis
disassembler, malware, forensics, decompiler, malware-analysis, ctf, binary-analysis, infosec, exploit, low-level, debugging, static-analysis