Reverse engineering, hands on.

From zero to a confident grounding: how bytes, code and files work, how programs hide their logic, the analyst's toolbox, and the ethics and law that bound all of it.

1. 1What static analysis isReading a program without running it, why 'evidence, not verdict' is the whole discipline, and how static and dynamic analysis differ.6m
2. 2Binary, hex and bytesComputers count in twos and analysts read in sixteens: binary, hexadecimal, bits, bytes, words, alignment and byte order.9m
3. 3Text encodings: ASCII, UTF-8, UTF-16 and base64Bytes are not text until you pick an encoding: how ASCII, UTF-8, UTF-16 and base64 map bytes to characters, and why it decides whether you find a string.8m
4. 4How a program becomes bytesSource becomes machine code or bytecode, then a structured container. Which of those you are looking at decides how readable it will be.7m
5. 5What a file format isMagic bytes, headers and sections: how a file tells the operating system what it is and where its parts live.8m
6. 6Entropy: measuring randomnessEntropy scores how unpredictable a chunk of bytes is, and a high score is the classic tell for compression or encryption.6m
7. 7How code runs: the CPU, the stack and memoryA conceptual model of execution: instructions, registers, the stack, and how a running process is laid out in memory.11m
8. 8Control flow and functionsHow branches, loops and calls build a program's logic, and why the function is the unit an analyst reads.8m
9. 9Symbols, linking and importsHow separate pieces of code find each other: symbols, the linker, and why an import list is a map of what a program can do.8m
10. 10Strings, encodings & obfuscationText is the fastest evidence in a binary, until someone hides it. How obfuscation works and how recovery undoes the simple schemes.9m
11. 11Obfuscation familiesThe main ways code hides from static analysis: packing, string encryption, control-flow flattening and anti-analysis, and what each costs the attacker.9m
12. 12Hashing, checksums and integrityOne-way fingerprints of data: how hashes and checksums prove integrity, back digital signatures, and why they cannot be reversed.8m
13. 13The reverse-engineering toolboxThe programs every analyst reaches for, what each is for, and how to start. Install the ones your track needs.10m
14. 14Authentication & licensing, conceptuallyWhere a program decides 'are you allowed?', how those checks are built, and why mapping a check is not defeating it.8m
15. 15Patching & bypassing: how it works, and the lineThe mechanics of modifying a binary, the difference between legitimate and circumvention use, and the safe, legal way to practise.9m
16. 16Ethics, authorization and the lawThe one non-technical skill that keeps this legal: only analyse what you are allowed to, and know where the lines are.8m
17. 17Practise safelyA throwaway VM, legal practice targets, and the built-in sample: how to get hands-on without risk.5m
18. 18Resources & further studyReputable external places to go deeper: tools, structured courses, practice platforms and reference material, all legitimate.7m

How Windows executables are built and read: the PE format field by field, imports and the Windows API, disassembly and control flow, packing and triage, recovered strings, ATT&CK mapping, and Authenticode signing.

1. 1Anatomy of a PE fileMZ, the PE header, the optional header, and the sections that make up every .exe and .dll.9m
2. 2The DOS, COFF, and optional headersThe header region field by field: the MZ stub and e_lfanew, machine type and characteristics, entry point, image base, subsystem, and the data directories.10m
3. 3Sections and the file-to-memory mapSection characteristics, the difference between raw and virtual, how an RVA maps to a file offset, and the two things the loader rewrites: relocations and TLS callbacks.11m
4. 4Imports, the IAT, and the Windows APIThe import table is a capability manifest, and the IAT is how those calls reach real Windows code.9m
5. 5Exports, ordinals, and forwardersHow a DLL advertises its functions, why ordinals and forwarders exist, and what an export table tells you about a binary's role.7m
6. 6Resources and version infoThe .rsrc tree, where icons, manifests and version metadata live, and why that metadata is a claim rather than proof.8m
7. 7Reading disassemblyEnough x86/x64 to follow control flow: registers, calling conventions, the common instruction patterns, and how a call or branch looks.11m
8. 8Cross-references and control flowHow to pivot from a string or import to the code that uses it, and how to build a mental control-flow graph of a function.8m
9. 9Auth and licence decision pointsHow the app surfaces the branches where a program decides allowed or denied, as read-only evidence you describe, never bypass.9m
10. 10Packing and entropyWhy some binaries hide their real code, how to spot it, and what to do next.7m
11. 11Triage: imphash, TLSH, overlay, and .NETThe fast first-look signals that classify a PE before you read any code: import hashing, fuzzy hashing, overlays, and native versus managed.9m
12. 12Strings and recovered secretsPlain strings are the fastest map of a binary, and the app also recovers strings hidden by simple obfuscation, as evidence.9m
13. 13MITRE ATT&CK from imports and stringsHow capabilities seen in imports and strings map to named adversary techniques, and how to read that mapping honestly.8m
14. 14Authenticode signingHow Windows code signing works, and the crucial difference between integrity and trust.7m
15. 15Practice: trace a check in a PE you ownPut it together on your own build: map, understand, change your source, and prove it with a diff.8m
16. 16Resources and further studyThe industry-standard tools and references to go deeper, all pointers, used responsibly and on authorized targets.8m

How APKs are built and analysed, fundamentals to mastery: the package as a ZIP, binary XML and the resource table, DEX/Dalvik and smali, native libraries and JNI, components and attack surface, signing, obfuscation, and hidden endpoints.

1. 1Anatomy of an APKAn APK is a ZIP. Learn its strata, manifest, resources, DEX, native libs, signing, the way this app excavates them.9m
2. 2The APK as a ZIPEntries, the central directory, alignment, META-INF and the signing block, and how an .aab differs from an installable APK.7m
3. 3The binary manifest (AXML)AndroidManifest.xml ships as chunked binary XML with a string pool and resource-id attribute names. How it is decoded back to readable XML.7m
4. 4The resource table (resources.arsc)Resource ids, the type/entry structure, and how one id resolves to different values per configuration (locale, density, night mode).8m
5. 5Manifest, permissions & attack surfaceWhat the app declares it can do and what it exposes, the first read for security posture.8m
6. 6App components & the intent surfaceActivities, services, receivers and providers; the exported attribute and its defaults; intent filters, deep links, and provider exposure.8m
7. 7DEX, Dalvik bytecode & smaliInside classes.dex: classes, methods, registers, and smali, the human-readable form you'll actually read.11m
8. 8Inside the DEX fileThe DEX header, the shared id tables (strings, types, protos, fields, methods), class defs, and why multidex exists.9m
9. 9Smali & source reconstructionRegisters versus the JVM stack, the p/v register convention, reading a real method, and why reconstructed source is labelled, never called original.10m
10. 10Native libraries & JNIWhy the real secrets hide in .so files, and how a Java-declared native method maps to C. The hidden-endpoint case.10m
11. 11Obfuscation on AndroidR8/ProGuard renaming, string encryption, packers and runtime DEX loading, conceptually, and why obfuscation is not proof of malice.9m
12. 12Mapping auth & licence checksHow the app locates authentication, licence and integrity checks and reports them as evidence, read-only, and where the ethical and legal line sits.9m
13. 13Signing & certificatesAPK signature schemes, what integrity verified does and does not mean, why re-signing changes identity, and legitimate repackaging as yourself.8m
14. 14Practice: excavate the sampleRun the whole flow on a safe target: the built-in fixture, then a legal UnCrackable app.9m
15. 15Static analysis toolsThe industry-standard readers for APKs and .so files: jadx, apktool, dex2jar, Ghidra, and MobSF. Pointers only.6m
16. 16Resources & further studyWhere to go next: dynamic analysis (responsibly), the official app-signing docs, and the OWASP mobile testing standard.6m

How Windows executables gate features behind license keys, trial timers, hardware locks, registry flags, anti-debug and online activation — and how those gates are actually bypassed. Recon in the inspector, jump-flipping, call-neutralizing, IAT hooks, keygen for HMAC schemes, weak-crypto attacks, and running the patched binary in a Job Object sandbox first.

1. 1The core loopRecon, locate, patch, verify. Windows PE is friendlier than Android — no repackage/resign chain unless the app self-verifies Authenticode.6m
2. 2PE anatomy — where things liveDOS + NT headers, sections (`.text`/`.rdata`/`.data`), imports (IAT), exports, the Authenticode data directory. Know the file layout before you edit bytes in it.8m
3. 3License Hunter — one-click reconThe inspector's License Hunter categorises every API import and every license/trial keyword. Turns a 500-import binary into a short list of check candidates.5m
4. 4Patch Jump — the single-opcode flipThe smallest possible patch: change one byte and flip the branch. `74` becomes `75`. The check still runs; only the decision reverses.7m
5. 5Neutralize Calls — kill every callerScan .text for every `call CheckLicense`. Replace each with `xor eax,eax; inc eax; nop; nop` (returns 1). The check is never actually invoked.6m
6. 6IAT Hook — redirect an imported APIRewrite an import table slot to point at your own tiny trampoline. Every call to `IsDebuggerPresent` returns 0. Every `RegQueryValueEx` returns ERROR_SUCCESS. No caller changes needed.7m
7. 7Keygen — mint valid keys when the scheme is symmetricIf the check is `hash(user_key + secret) == expected_tail`, you don't need to patch. You extract the constants and generate valid keys forever.7m
8. 8Crypto Crack — XOR keys and weak KDFsEncrypted resources / credentials in an exe often use repeating-XOR or PBKDF2 with an empty salt. Both fall in seconds.7m
9. 9Re-sign — when the app self-verifies its AuthenticodeRare but real. If the app checks its own signing certificate on launch and refuses to run when patched, strip and re-sign with your own cert.6m
10. 10x86/x64 assembler primer for crackingTen opcodes cover 90% of cracking. Memorize them; you'll read them constantly and want to write short stubs by hand.8m
11. 11Packers, protectors, and when to walk awayUPX unpacks in seconds. VMProtect and Themida require weeks. Learn to identify the wall before spending days on the wrong tool.7m
12. 12.NET / CIL — a different world.NET assemblies aren't native code. They're CIL bytecode in a PE wrapper. dnSpy edits them in a debugger-style UI — no smali/apktool needed.6m
13. 13DLL cracking — same file format, different rulesA DLL is a PE with `IMAGE_FILE_DLL` set and exports instead of a single entry point. Everything you learned about EXE patching applies — plus some DLL-specific patterns.7m
14. 14Staying invisible — anti-detection of cracked binariesSerious licensed software checks whether IT ITSELF has been cracked. Every check has a defeat; every crack has a fingerprint. Learn both sides.7m
15. 15Detonate — test the patched exe in a Job Object sandboxBefore running a patched (or unknown) exe on your bench, spawn it inside a Job Object with a wall-clock timeout so it can't escape.5m

How Android apps gate features behind login, license keys, subscriptions and root detection — and how those gates are actually bypassed. Recon in the inspector, DEX bytecode surgery, ARM64 .so patching, apktool + apksigner pipeline, Firebase-backed checks, integrity self-checks, and the debug loop that turns a broken crack into a working one. Includes a full walkthrough of a real activation-key crack.

1. 1The core loopEvery Android crack follows the same five stages: recon, locate, patch, repackage, debug. Understand the loop before touching a byte.6m
2. 2Recon — read before you touchStatic-analysis pass in the inspector: manifest, auth findings, URLs, strings, storage class. Narrow twelve candidates to two.8m
3. 3The five check shapesEvery gated feature is one of five patterns. Attack difficulty rises with the row.7m
4. 4DEX bytecode surgeryOverwrite a Java method's first instructions with `return true` / `return false` / `return-void`. Four bytes of Dalvik and you own the check.8m
5. 5AArch64 native `.so` patchingWhen the check is in JNI, DEX patching does nothing. AArch64 is fixed 4-byte instructions — easier than x86, once you know the four you need.6m
6. 6Repackage + sign, the four-step pipelineapktool → zipalign → apksigner → pm install. Skip any step and modern Android refuses the install with a cryptic error.8m
7. 7The crash loop — first launch usually crashes60% of first cracks crash on launch. Read logcat, find the lateinit / NPE, understand what you skipped, put it back.7m
8. 8Anti-tamper: integrity, root, cert pinningSerious apps fight back with signature self-check, root detection, and SSL pinning. Three defeats you'll reach for repeatedly.8m
9. 9Frida — runtime hooks (when static fails)When the APK is heavily obfuscated, self-verifies its bytes, or can't be re-signed, hook it at runtime instead.7m
10. 10Manifest editing — the invisible attack surfaceFlip debuggable, add a network_security_config that trusts user CAs, hijack deep links, drop permission enforcement. All from AndroidManifest.xml.7m
11. 11SharedPreferences — seeding activation state from adbThe Sem6 pattern: pre-populate `isActivated=true`, `activationKey`, `keyExpiry`, `uniqueSystemID` before the app ever runs its validator. Works when debuggable.6m
12. 12Reading obfuscated smali — ProGuard/R8 survivalAfter ProGuard, everything is `a.b.c` and `Lo/e7`. Learn to navigate obfuscated code by evidence (strings, imports, exception messages), not names.7m
13. 13Case study: cracking Sem6.apkA start-to-finish walkthrough of cracking `com.jiraiya.autotyper`, a real Android app with offline key + Firebase check + integrity self-check + lateinit trap. All five stages, all three failures, all three fixes.12m