Reverse › Module 1 › Lesson 1
What RE Is
Reverse engineering reads binaries to understand behavior — literacy on $RE_LAB crackmes and CTF, never commercial piracy.
Visual · re_what_re_is
RE definition literacy. $RE_LAB only. Original Cyberlium.
Opening
Reverse engineering answers what a binary does and how — not how to steal licenses.
Reverse engineering (RE) is the disciplined study of compiled programs to recover logic, data structures, and control flow without source code. Analysts combine static review (disassembly, headers) with dynamic observation (debuggers, traces) on authorized targets. The goal is understanding for CTF, crackmes, and YOUR toy binaries — not bypassing paid software. Cyberlium Topic 23 teaches RE literacy on $RE_LAB with crackmes, CTF challenges, and binaries you authored. You will NOT reverse commercial apps for piracy, share license keys, or treat RE as warez. Next: Legal Targets.
1. Static vs dynamic RE (named)
Static RE inspects binaries without running them — disassembly, headers, strings, cross-references. Dynamic RE runs the program under a debugger or tracer and observes registers, memory, and syscalls at runtime.
Professional workflows use both: static maps the terrain; dynamic confirms branches and inputs on $RE_LAB. Neither replaces ethics — authorized targets only.
Command guide
Try these commands — Static vs dynamic RE (named)
═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══
Inspect PE / ELF binary headers and sections
Command — copy this
readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin
Check binary entropy (high entropy often signals packed or encrypted payloads)
Command — copy this
python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/nullPrimary tools to practice this lesson: python3, curl. Reference sites: Ghidra (https://ghidra.re/); LiveOverflow RE playlist (https://www.youtube.com/c/LiveOverflow); GNU binutils manual (https://sourceware.org/binutils/docs/binutils/); crackmes.one (https://crackmes.one/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Who performs RE and why
CTF players solve challenges; security researchers audit firmware; malware analysts complement triage; developers debug crashes. Output feeds writeups, patches on YOUR binaries, and defensive insight — not license theft.
Cyberlium assumes YOU are building literacy on $RE_LAB with crackmes, CTF repos, and toy programs you compiled — not cracked Adobe installers.
3. What this topic will never call practice
Patching commercial games for piracy, keygenning paid tools, bypassing DRM on software you do not own rights to analyze, or distributing cracks to classmates. Those violate law and license — not homework.
Ship a sentence: RE here means understanding authorized binaries on MY $RE_LAB for CTF and learning. Next lesson: Legal Targets.
4. What you ship: RE definition scoped to $RE_LAB
Write static vs dynamic in one line each. Dest = $RE_LAB crackmes/CTF/toy binaries. NEVER commercial piracy. Notes chmod 600.
5. What you record before the next lesson
Date (UTC). RE definition. Lab = $RE_LAB. NEVER commercial license bypass. Path: $HOME/cyberlium-lab/t23-m01-l01-what-re-is.txt chmod 600.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Reverse a paid app 'to learn.' Share a keygen tutorial in class chat.
Right
Define RE and name $RE_LAB as the only target class. Next: Legal Targets.
Mission: define RE for YOUR lab
1) Write static vs dynamic in one paragraph each. 2) Write a NEVER list (commercial piracy, DRM bypass on paid software, keygen distribution). 3) Name $RE_LAB as your placeholder. Never analyze binaries you lack rights to study.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: 'Hint only: static vs dynamic?' — not how to patch paid apps.
Knowledge Check
APPLY: Reverse engineering on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Static RE requires running the binary.
True or False
Knowledge Check
APPLY: RE output should primarily support:
Multiple choice