Cyber security student wanting to start learning reverse engineering

Question

I'm really interested in learning reverse engineering. Especially in regards to malware. Any help is much appreciated

What should I learn before I start to learn reverse engineering?

Is learning C/C++ a MUST?

Should I learn Assembly language?

If I know nothing about reverse engineering, is Ghidra a good tool to learn with or should I become familiar with IDA and OllyDbg first?

Any good sources/tutorials in particular that you recommend?

Answer 1

What should I learn before I start to learn reverse engineering?

Assembly is a must. Without deep understanding of assembly you cannot reverse engineer anything seriously. Additionally, you'll have to become familiar with relevant tools, depending on the platform; not knowing every detail of them, just basic use - you will learn more complex things in practice when you need them. I strongly recommend you to read this forum: you can, for instance sort questions by votes and read best answers - this way you'll get a basic insight on the topic.

Is learning programming with C/C++ a MUST?

If you really don't want to - no, but it's highly recommended. There are several reasons for it:

1. Most of malware is written in C/C++.
2. Decompilers will usually produce output in C or pseudo-C form, so it will be easier to understand it.
3. Writing small, test programs in C/C++ and observing produced assembly is very helpful in learning reverse engineering - you will get familiar with basic constructions, like calling conventions, loops, if-else or switch blocks, tricks performed for code optimization and many, many more.
4. You will be able to analyse several malware source codes available in the Internet (see 1.).
5. If you know the tool, you know what to expect from programs written in it.

If I know nothing about reverse engineering is Ghidra a good tool to learn with or should I become familiar with IDA and OllyDbg first?

I would say, start with IDA. Why? Because it's probably the most widely used disassembler. Additionally, if you think of a job related to reverse engineering, you may often find familiarity with IDA as a requirement. Finally, from my personal experience (I started with IDA), it's very user friendly, so you can fully focus on reverse engineering without focusing too much on how to use a tool.

OllyDbg is a tool for dynamic analysis and you should start with static one (without running a program), since you'll have to fully understand the assembly to benefit from debugger. But of course you should learn it at some moment.

Any good sources/tutorials in particular that you recommend I have a look at?

Two books: Reverse Engineering for Beginners and Practical Malware Analysis - you will get a lot of knowledge if you read them. To see malware reverse engineering in practice, you can do the course on cybrary.it.

Answer 2

First of all, welcome to the fascinating and frustrating world of malware reversing.

What should I learn before I start to learn reverse engineering?

I believe that the best way is start to learn basic reverse engineering and improve as you go.

Is learning programming with C/C++ a MUST?

No, it's not a "MUST." However, if you don't know how to program, you will become easily frustrated. Let's think about it for a second, what's malware reverse engineering? Its the process of taking samples (binaries) or other forms of malicious code and trying to understand how the code was written, what its purpose and how it achieves it. If you don't know how to program you are going to find it very difficult to reverse back code.

If I know nothing about reverse engineering is Ghidra a good tool to learn with or should I become familiar with IDA and OllyDbg first?

I would not recommend this tool, to begin with. You should probably start with a more fundamental approach, such as I described here.

Also, you probably want to go over the following StackExchange threads and for tutorials and learning paths:

• Becoming a malware analyst

• How to get started as a malware analyst

Answer 3

It's always good to have a big goal in mind, and with RE, the beginning stages of this pursuit may seem overwhelming. I see a lot of great answers here so just want to chip in with my take on what your immediate next steps should be.

I agree, asm is a must. There's pros and cons for choosing a particular one but I suggest choosing one and really stick with it, and stay with a particular syntax so you can walk away from that stage in your learning feeling confident. Don't be afraid to learn C/C++ at the same time, they can be used to understand each other! A youtuber named "What's Creel" takes this approach in his assembly tutorials.

I also want to encourage you to "go where your resources take you." If you find a great tutorial using radare2, forget ghidra and ida for now just go with the teacher that's in front of you and that you like at that moment. To me this is true for systems as well. If you are watching John Hammond complete CTFs on youtube, download an Ubuntu iso for a virtual machine and follow along. Nothing beats hands on learning, and if you are exhausted learn to rest effectively as well! Eat well, exercise, get enough sleep etc.

This brings me to my last point, know thyself! If you know what type of learner you are, seek those resources so you can learn more effectively. Personally I'm a mixture of visual, and social. That social piece really helps me whether it's listening to 2 people discuss something on a podcast or talking with someone myself over coffee, those conversations nail home the concepts I'm trying to comprehend. Some people can just read a manual and learn from that, or experiment with code till they understand what's going on. Whatever it is, just embrace and multiply it so you can avoid the (ultimate) feelings of despair technical fields like this have. These different approaches to learning might also differ depending on your mood or environment, so don't forget to be flexible! Here's a list of resources, some directly support the RE / malware goal you've stated, and some indirectly will help you be it supporting technology knowledge or technical creativity.

Podcasts

• Security Now with Steve Gibson

• Software Engineering Daily

• Kubernetes Podcast

• CppCast

• Darknet Diaries (creativity!)

YouTube tutorials

• Me, reading the intel manual and asking questions, beats reading alone

• Liveoverflow, very professional and engaging, start with his Binary Exploitation series

• Conferences, Conferences, Conferences. I learn so much from these talks maybe start with Cpp con 2018 but you'll want a really good handle on the basics first

• Ippsec, what can I say this guy does it all!

youtube is just a treasure trove, I'm sure I'm forgetting a ton...

Misc / Passive learning

• TinyCards app, I made three decks of x86 assembly instructions

• SoloLearn and Enki app, just basic programming language intro, q&a formart.

• Reddit, the AskNetSec subreddit seems to have the highest quality discussions

Active Learning

• Do! Create! Students just learning programming, hardware, networking, etc. will often complain to me about not understanding and when I ask what they've done the only things I hear are passive. You can't learn this stuff without getting your hands dirty, even if that means writing down your thoughts or questions (they don't need to be answered right away...) but if you can write programs or test malware in a VM yourself that'd be even better.

• Have a github account

• Make a learning journal for reflection

The last thing I'd like to say, and I'm not trying to discourage you at all, but try to get a strong grasp of the fundamentals, doing so should accelerate your progress. I'm often reminded of this picture when I hear students talking about their tech dreams and 1 month into class I see they don't have the mental stamina to work on something for longer than 10 minutes, in this case though just replace "bug hunting" with "reverse engineering," because they are both long term goals:

Remember, one step at a time!