Open your project folder
Choose a working folder that holds your C source, a copy of the compiled file and, later, the exported listing.
Workflows
Practical reverse engineering, one function at a time
03
How to get started with practical reverse engineering
Pick one small function from a C program you compiled yourself and study it from the first instruction to the final return. Law and licence terms differ by country, so use only your own code or practice files. Four steps follow below.
Export a text listing
Let Shell run your disassembler's export command on the copy, or save the listing yourself, so the result is a text file.
Ask for an explanation
Ask the agent to read the listing and explain the function line by line, then save the notes with write_file.
Check the answer
Compare the notes with your source and listing, read the diff in Ask first, and test the result in a lab if that is lawful.
A teaching listing to read
Explain add_numbers.asm line by line and write notes to notes/add_numbers.md.
- read_file
add_numbers.asmtext read - grep
edx add_numbers.asm2 matches - write_file
notes/add_numbers.mdsaved - edit_file
notes/add_numbers.md+4 lines
Waiting for your OK before the next stepRejectAccept
add_numbers.asm
; add_numbers.asm - teaching listing, x64 Windows
; Returns the sum of its first two integer arguments.
; Argument 1 arrives in ecx (low half of rcx).
; Argument 2 arrives in edx (low half of rdx).
add_numbers:
mov eax, ecx ; copy argument 1 into eax
add eax, edx ; add argument 2, the sum stays in eax
ret ; return to the caller, result in eaxThis function adds two integers. Under the Windows x64 convention the arguments arrive in ecx and edx, the sum is built in eax, and ret returns control to the caller.
Two exercises for a reverse engineering class
Begin with a function you wrote
A common beginner question is how to start assembly, and the answer is a function you wrote yourself. Write a short C function, compile it and export the listing as text. read_file opens the listing and the agent explains each instruction: which register holds each argument, what the stack does and where the result returns. write_file saves those explanations in notes/begin.md. In Plan only, the agent first lists these steps. Nothing runs yet. Then switch to Ask first and read the diff before each save. Finally compare the notes against your source and, if it is lawful, test the compiled function in a lab.
Document the functions of your own library
A good exercise in reverse engineering APIs is to list the functions your own library exposes and write down what each argument does. Save the list of imported and exposed functions from your own tool as text, then the agent uses grep to find every call to one function and read_file to open the lines around it. It drafts a table in notes/api.md, and edit_file shows each change as a diff. Start with one function. The same method helps you recover how your own old code worked. The agent can be wrong about a type or a purpose, so compare each row with your source and with a test of your own before you accept it.
