Hacker News Reader

Comment by palata | Hacker News Reader

Taking the opportunity to ask: are there nice recommended resources for a beginner to start with reverse engineering (ideally using Ghidra)? Let's say for an experienced developer, but not so experienced in reverse engineering?

I guess one issue I have is that I don't have good ideas of fun projects, and that's probably something I need to actually get the motivation to learn. I can find a "hello world", that's easy, but it won't help me get an idea of what I could reverse engineer in my life.

For instance I have a smartspeaker that I would like to hack (being able to run my own software on it, for fun), but I don't know if it is a good candidate for reverse engineering... I guess I would first need to find a security flaw in order to access the OS? Or flash my own OS (hoping that it's a Linux running there), but then I would probably want to extract binary blobs that work with the buttons and the actual speaker?

View on HN

> Taking the opportunity to ask: are there nice recommended resources for a beginner to start with reverse engineering (ideally using Ghidra)? Let's say for an experienced developer, but not so experienced in reverse engineering?

The good news is that there has never been MORE resources out there. If you want to use this learning expedition as an excuse to also build up a small electronics lab then $100 on ali express to buy whatever looks cheap and interesting and then tear it apart and start poking around to find where the firmware lives. Pull the firmware, examine it, modify it and put it back :)

This guy has a discord server with a specific "book club" section where they all choose a cheap $thing and reverse engineer it: https://www.youtube.com/@mattbrwn/about

I can't help much with "traditional" app/software RE work, sorry.

Oh, it feels like it may be what I want! Find some cheap electronic device and hack it!

Thanks a lot!

I would also suggest spending a few minutes to set up an mCP server with ghidra once you've learned the basics of navigating and working inside of ghidra.

Turns out that frontier grade llms are absolutely fantastic for extremely advanced static analysis. If you go one step further and manage to get your firmware running inside of an emulator or other place where you can attach GDB... Then putting an mCP server on that as well unlocks so much insane potential.

Would that include free use LLMs. I assume getting into something would be tricky if you are assuming they're going to drop several hundreds of tokens a month on it.

I feel like the tendency for people to assume others have nearly $500 or so of credits on their AI to blow every month is kinda crazy.

Reminds me of the "just get Netflix, Prime, etc." ending up with a $100/m bill.

> Would that include free use LLMs.

I can't comment on the self-hosted models but if they support tool calling / MCP then it should work. How well may be a function of model size/arch/quant ... etc though.

> I feel like the tendency for people to assume others have nearly $500 or so of credits on their AI to blow every month is kinda crazy.

My use is hobby level so $20/mo chatGPT sub is enough. I do hit my 5hr limits on a regular-ish interval but that's usually a sign that I need to step away from the work anyways.

The Nightmare Course [1], so named because someone with that skillset (developing zero-days) is a nightmare for security, not because the course itself is a nightmare, and Roppers Academy [2] are both good for learning how to reverse engineer software and look for vulnerabilities.

The nightmare course explicitly talks about how to use Ghidra.

1: https://guyinatuxedo.github.io 2: https://www.roppers.org

The first is certainly interesting, but it won't help you develop 0day. I would think of it like more of a collection of fun puzzles and esoterica. For example all the heap unliking/metadata attacks and House of X stuff is pretty antiquated. These will help you win ctfs but are certainly not a prerequisite or even all that relevant to contemporary vuln research. Most of the public research I see is probably at least a year behind the current meta (and I expect the public internet will only grow more quiet over time)

What resources would you recommend now? Even if they're a year behind the meta, it's a lot easier to start a year behind than 6+

Somewhat unconventional (and i'm not really a seasoned reverse engineer so take it with some salt) but I started by hacking old video games (nes, gameboy, arcade.. that kind of thing). You could start with making basic action replay RAM cheats to e.g. give Mario infinite lives, then you can use breakpoints, the debugger, and a 6502 ISA reference to edit instructions and make ROM patches.

from then you can use things like Ghidra (which supports a lot of those old CPU arches) for more advanced analysis and make the game do almost whatever the hell you want if you have the patience.

I think a lot of the skills will transfer quite well (obviously not 1:1, you will need to learn some things) to the more employable side of RE if that's what you're interested in

Thanks! I have been "hacking" with games in the past (getting infinite lives and such) or bypassing some licence check (back then it was with OllyDbg).

I guess I'm struggling to transfer that to "real-life" scenarios. Like getting something useful out of reverse engineering (getting infinite lives is interesting to see that I can tamper with the game, but it's not exactly useful).

Honestly unless you're working in low-level fields, such as embedded hardware, or optimized code generation, those are real-life scenarios!

(Thinking more of license-checking, and serial-number generation rather than infinite lives.)

I started reverse engineering at 13 with an IDA Pro of questionable provenance - at that time, I found it quite difficult.

One thing which really helped me (and I wholeheartedly recommend) is to write simple programs, run them through the compiler and then in the disassembler. It really helps build a correspondence between program structure and its object code.

Eventually, you can make it even more fun and challenging by stripping debug symbols and turning on compiler optimisations.

Happy reversing!

If you are into the book, I would recommend The Ghidra Book from No Starch publisher https://nostarch.com/ghidra-book-2e.

The book is designed for beginner and advance users.

Finding something with symbols will help a lot. Symbols end up getting left in Linux and macOS builds fairly often.

The reverse engineering I've learned has generally been to fix something that has annoyed me - for example I reverse engineered part of RCT3 to fix mouse input with high poll rates and allow for resizable windows [0]. Certainly easier to approach than trying to get into a closed device since you can attach a debugger.

[0] - https://mastodon.social/@benpye/109261545643008493

https://pwn.college has really good modules/dojos that cover a bunch of reverse engineering concepts.

See if there is an OTA package available for your speaker that you can extract and figure out what goes where.

Then figure out what SoC your smart speaker is running.

A lot of soc vendors just provide SDKs for IoT applications. Maybe you'll find something like that you can flash.

Also if there's a separate SPI flash chip, you can simply dump it and study the firmware.

You can start here to learn reverse engineering.

https://beginners.re/

So a couple things. Bruce Dang’s book, while a little old, is still a great spot to get started. Another great book is Blue Fox by Maria Markstedter for ARM. From there, finding small binaries and just trying to get the “flow” is a good next step, for me this is largely renaming functions and variables and essentially trying to work the decompiled code into something readable, then you can find flaws.

So for the second thing, pulling the data off chips like that typically involves some specialized hardware, and you have to potentially deal with a bunch of cryptographic safeguards to read from the chip’s memory. Not impossible though, and there are not always good safeguards, but might be worth checking out some simpler programs and working up to it, or learning some basic hardware hacking to get an idea of how that process works.

Interesting! Yeah maybe my first step is on the hardware side, which I guess is what is blocking me right now.

I personally learn best by doing which is why I love learning with LLMs. They're going to be wrong a lot, and give bad advice, and do things in silly ways. I learn well from the process of working with them, seeing them fail constantly, then learn the tool yourself by researching what it's doing wrong to fix it. I just attempted to use Ghidra to reverse engineer the game Shenmue from Dreamcast. I was previously unfamiliar with Ghidra and I mostly did it as a learning exercise, but it wasn't really the right tool for the job. However the project itself made lots of progress without it:

https://www.newyokosuka.com/

Find an old piece of software you care about that is broken somehow, and abandoned. Most of my friends use these types of tools to reverse engineer abandoned MMOs and remake servers for them.

That's very deep water to dive into. I suggest something simpler, like an ancient irc client that asks you to sign up, or an archive extractor.

Well I didnt mean dive into an MMO right away, but yes I recommend smaller programs.

Allow me to shamelessly plug my blog, I have been (very slowly!) re-visiting microcorruption and writing up the solutions in a tutorial-esque fashion.

https://lovesexsecretgod.com

Can I ask why the name

https://www.imdb.com/title/tt0113243/quotes/?item=qt0448592#...

Nice.

Go through the katas at https://pwn.college

Reply on news.ycombinator.com