Choose a target and follow source-linked tools, learning paths, REA workflows, case studies and research.
Choose the software or artifact you want to understand before choosing a tool. A Windows executable, Android package, managed assembly, website and network capture expose different kinds of evidence. Each task path below starts with a concrete question, explains the likely prerequisites and links to tools and learning material. Unknown costs, platforms and release compatibility stay labelled Unknown until a source supports them.
This hub combines original guidance with source-linked records. Begin with read-only inspection of an authorized sample, preserve its version and hash, and test important conclusions against raw evidence or a controlled run. AI-assisted analysis can organize observations, but generated prose and decompiled strings need independent verification. Use the comparison pages to choose by task fit rather than a universal ranking.
56 resources · Page 3 of 5
JADX and Apktool answer different first questions about an APK. Choose JADX when you need to follow DEX classes and methods in readable code. Choose Apktool when resources, manifest decoding or package structure are central. Many investigations use both, but neither view alone proves runtime behavior or perfectly restores the original developer source.
View evidence & requirementsLLM4Decompile studies language models trained to transform binary code or refine decompiler output. The paper is relevant when assessing whether an AI-generated program can be re-executed under benchmark tests. Read the task definitions, datasets and evaluation setup before interpreting its reported gains; a passing benchmark does not recover original source or prove equivalence for an unseen application.
View evidence & requirementsMalware Unicorn's RE101 workshop introduces practical reverse-engineering ideas through a security training format. It is useful for learners who want guided exercises before tackling an unfamiliar Windows sample. Verify the workshop's setup and downloads against the current official page, use a separate lab, and distinguish a teaching example from a claim about an active threat.
View evidence & requirementsMobSF brings static and dynamic workflows together for mobile application security assessment. It is useful for a broad authorized review that needs an inventory before narrower manual questions. Separate observations the framework extracted from its risk interpretations. Dynamic components need a correctly configured device or emulator, and automated findings should be checked against the app build and evidence.
View evidence & requirementsRPISEC's Modern Binary Exploitation course materials combine binary understanding with exploit-development practice. They are best placed in an advanced, authorized training track, after assembly, memory layout and debugger fundamentals. The repository is valuable as a historical course record, but its challenge setup and offensive emphasis make it unsuitable as an unqualified beginner path.
View evidence & requirementsNightmare is a repository of reverse-engineering and binary exploitation practice problems. It fits readers who know basic assembly and want repeated challenge-based exercises, especially in a CTF setting. The exercises are not a neutral first lesson in software architecture; choose them after fundamentals and keep their tactics inside authorized competition or laboratory targets.
View evidence & requirementsThe official REA Notion case traces a clipboard request through an Electron app's page API, preload bridge, IPC channel and main-process writer. It shows how to follow one cross-process behavior through bundled JavaScript rather than stopping at a convenient wrapper name. The page documents a specific desktop package; AI Craft Pad has not independently reproduced the trace.
View evidence & requirementsobjection is a mobile runtime exploration toolkit built on Frida. Choose it when its ready-made interaction fits an authorized device question, and use Frida directly when you need a more specific custom observation. Keep the exact app and device versions. Its presence does not bypass the setup, permission and evidence limits of the underlying instrumentation layer.
View evidence & requirementsPractical Binary Analysis teaches analysis of Linux executables through file formats, disassembly and instrumentation. It fits a reader who already knows basic programming and wants to connect binary structure to observable behavior. Its 2018 examples remain useful as methods, while package versions and build steps should be checked against a maintained environment before following them.
View evidence & requirementsPractical Malware Analysis is a foundational text for defensive investigation of suspicious Windows programs. Its strongest value is the sequence of questions, observations and controlled experiments, rather than the age of a particular utility. Read it with a separate laboratory environment and current handling guidance; the book's original tools and malware examples reflect its 2012 publication.
View evidence & requirementspwn.college is an interactive security education platform with multiple modules and hands-on challenges. It can provide deliberate practice after a learner chooses the module that matches a specific objective. A platform homepage is not a single beginner reverse-engineering course: check prerequisites and challenge scope before enrolling, and keep exploitation-oriented work separate from introductory program analysis.
View evidence & requirementspwndbg adds low-level views and commands to GDB for inspecting a running program. It can help when a native investigation requires registers, stack state and memory context around a specific event. Use a controlled sample with a recorded build and input. The added presentation helps navigation but does not replace the debugger's raw observations or prove unexplored paths.
View evidence & requirements