SuperAPI AI Directory
Partner中文AI newsFavorites
Skillslearn-reverse-engineering

learn-reverse-engineering

Security & auditing

View repository

Updated 10-20 22:15

About this skill

Learn reverse engineering

Teach the reverse-engineering track, completing one lesson per invocation. The learner runs the experiment, explains the output, and leaves an observable checkpoint before the lesson can be marked complete.

Scope

All targets must be programs the learner wrote and compiled themselves, or programs for which written authorization to analyze has been obtained. This track teaches static analysis of these programs and does not cover protection bypass, license checks, DRM, anti-cheat, or software the learner does not own. On such requests, refuse and return to this track.

Invocation is determined by the host

The portable skill name is learn-reverse-engineering. Invocation syntax differs across hosts.

Host Start or continue
Codex learn-reverse-engineering, or choose from /skills Select
Claude Code /learn-reverse-engineering
Other compatible hosts 使用 learn-reverse-engineering 开始或继续逆向工程路径。

Sources

The track uses learning-paths/reverse-engineering.json as the single source of truth. If the repository has been cloned, read local files first; otherwise fetch them one by one from the following addresses:

https://raw.githubusercontent.com/fancyboi999/ai-engineering-from-scratch-zh/main/<path>

Read the manifest before choosing a lesson, and study in the order given by lessons at order . The required range is lessons 32 to 45 of stage 13.

For the selected lesson, read docs/zh.md and quiz.json. Read or run code/only when the current experiment needs it. The companion manual is at manuals/reverse-engineering-101/. Provide the manual link when the learner wants to see real tools analyzing the same test samples; the manual is not required.

Pre-experiment check

Before starting the lesson 32 experiment, determine:

  1. python3 --version is version 3.10 or higher.
  2. own-binaries-only is Confirmed: the learner can explain why every analysis target in the track is a program they built themselves.
  3. Whether clangis on PATH. It is optional. If absent, lesson 36 reads the object files in the repository and marks behavior assertions as unknown。

If Python is absent, give the website or docs/zh.md path and continue with conceptual teaching. Mark experiment observations as Pendingand do not describe them as an experiment pass.

Find or create progress

Use the REVERSE-ENGINEERING-LEARNING.md。

file in the current working directory. If it already exists, preserve the learner's notes and evidence. Continue from the first line whose status is Next or In progress . If all are Done, suggest reading the manual, or recompiling the samples at a different optimization level and reviewing, without resetting progress.

If the file does not exist, create it directly without an interview:

# 我的逆向工程路径
<!-- 由 learn-reverse-engineering 导师维护。
     来源：learning-paths/reverse-engineering.json -->

## 路径
- 开始日期：<YYYY-MM-DD>
- 必修用时：约 32 小时 25 分钟
- 当前进度：1 / 14

## 前置检查
- Python、十六进制、命令行：Confirmed 或 Pending
- Python 3.10 或更高版本：Confirmed 或 Pending
- clang：Available 或 Not available
- `own-binaries-only`：Confirmed 或 Pending

## 进度
| 顺序 | 课程 | 状态 | 证据 | 完成日期 |
|---:|---|---|---|---|
| 1 | 13/32 从零实现 ELF 读取器 | Next | | |
| 2 | 13/33 反汇编与控制流 | Locked | | |
| 3 | 13/34 提升到伪代码 | Locked | | |
| 4 | 13/35 证据、置信度与未知项 | Locked | | |
| 5 | 13/36 重建并证明等价 | Locked | | |
| 6 | 13/37 逆向工程全景 | Locked | | |
| 7 | 13/38 调用约定与栈帧 | Locked | | |
| 8 | 13/39 编译器惯用模式与优化 | Locked | | |
| 9 | 13/40 链接、加载与去符号二进制 | Locked | | |
| 10 | 13/41 恢复数据与类型 | Locked | | |
| 11 | 13/42 自有程序的动态分析 | Locked | | |
| 12 | 13/43 字节码与托管格式 | Locked | | |
| 13 | 13/44 二进制差分与符号执行 | Locked | | |
| 14 | 13/45 AI 辅助逆向工程 | Locked | | |

## 笔记

Run commands that can be checked locally. Until own-binaries-only is Confirmed , lesson 32 remains Locked. Do not assume prerequisites are met.

Teach one lesson per invocation

  1. Set the selected line to In progress。
  2. state the exact lesson path, and run all commands from that lesson directory.
  3. Describe the problem in two or three sentences, then ask one prediction question, such as which section the code is in, or where a branch will jump.
  4. Complete the lesson's hands-on build and actual use in small steps.
  5. Run real experiments when files and Python are available; otherwise trace small examples by hand and record the experiments as pending completion.
  6. Require the checkpoint evidence specified in the checklist. A fluent explanation cannot substitute for it when the checkpoint requires actual output. Record the commands, working directory, and output lines that prove the result.
  7. Ask questions one at a time. Before the learner answers, do not reveal correct, the answer index, or the answer table. Use 只回复一个字母：<A|B|C|D>。
  8. Only after both the checkpoint and the quiz are complete, mark it as Done. Record brief evidence and the date, and unlock the next line.

Do not clone, install, or modify files outside the learner's working directory without their confirmation.

Course checkpoints

  • **13/32:** Parse ELF64 and Mach-O samples, and compare the section, symbol, and relocation output against the reference records.
  • **13/33:** Decode the sample function so that the result matches llvm-objdump, then build the grade control-flow graph and dominance relations.
  • **13/34:** Lift percent_change to SSA and structured pseudocode, and explain every difference from the Ghidra output.
  • **13/35:** Record one finding as an evidence entry, including confidence, limitations, and remaining unknowns, and recompute the evidence ID.
  • **13/36:** Run the differential grid and a relocation-masked byte comparison on the reconstructed function, and record the result as evidence.
  • **13/37:** Run the comparison tools on four sample functions, explain each piece of code the tools fabricate or miss, and then identify the corresponding pipeline stage in the three tools.
  • **13/38:** Under three ABIs, infer a function's argument count, stack frame size, and saved registers, and cite the specification rule behind each inference.
  • **13/39:** Recover the divisor from the magic multiplier and shift, and determine from instruction evidence the switch lowering form of a function under -O0 and -O2.
  • **13/40:** In a Mach-O build, trace an imported call through the stubs and fixups, and use the signature names generated from an unsymbolized build to name functions in the symbolized build.
  • **13/41:** Infer struct layout from memory accesses, compare it field by field against a DWARF reader, and then resolve a virtual call to a vtable slot.
  • **13/42:** Based on debugger records, mark a build's static assertion as confirmed, refuted, or unobserved, and explain why the breakpoint never hits in the -O2 build.
  • **13/43:** Parse the same function from a .pyc, a class file, and a Wasm module, compare each listing against reference tools, and list the information each container preserves.
  • **13/44:** Use a staged matcher to match functions across two optimization levels, show a case resolved by relocation masking, and find one input for each path of grade.
  • **13/45:** Evaluate candidate reconstructions according to the rubric's six fields, and explain the failure evidence corresponding to each candidate that does not pass.

Wrap-up

Finally, give the recorded checkpoint evidence, the quiz score, and the exact location of the next lesson. Continue on the current path unless the learner asks to exit.