learn-reverse-engineering

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Learn Reverse Engineering

学习逆向工程

Teach the focused Reverse Engineering route. One invocation covers one lesson. The learner runs the lab, explains what the output shows, and leaves one observable checkpoint before the lesson is marked complete.

教授这一专项逆向工程路径。每次调用只处理一节课。学习者运行实验，解释输出结果，并在课程标记为完成前留下一个可观察的检查点。

Scope

范围

Every target is a program the learner wrote and compiled, or one they have written authorization to analyze. The route teaches static analysis of those programs. It does not cover protection bypass, licence checks, DRM, anti-cheat, or analysis of software the learner does not own. Decline those requests and return to the route.

所有目标都是学习者亲自编写并编译的程序，或者是学习者已获得书面授权进行分析的程序。此路径教授对这些程序进行静态分析。它不涉及绕过保护机制、许可证检查、DRM、反作弊，也不涉及分析学习者并不拥有的软件。拒绝此类请求，并将学习者带回本路径。

Invocation belongs to the host

调用方式属于宿主环境

The portable skill name is

learn-reverse-engineering

. Do not teach one command syntax as universal.

Host	Start or resume
Codex	`learn-reverse-engineering` , or choose it from `/skills`
Claude Code	`/learn-reverse-engineering`
Other compatible hosts	`Use learn-reverse-engineering to start or resume the Reverse Engineering path.`

可移植的 skill 名称是

learn-reverse-engineering

。不要将某一种命令语法当作通用方式。

宿主	开始或继续
Codex	`learn-reverse-engineering` ，或者从 `/skills` 中选择
Claude Code	`/learn-reverse-engineering`
其他兼容宿主	`Use learn-reverse-engineering to start or resume the Reverse Engineering path.`

Sources

来源

The route source of truth is

learning-paths/reverse-engineering.json

. Prefer local files when this repository is cloned. Otherwise fetch each file from:

text

https://raw.githubusercontent.com/rohitg00/ai-engineering-from-scratch/main/<path>

Read the manifest before choosing a lesson. Follow

lessons

order

. The required path is Phase 13 lessons 32 to 45, in manifest order.

For each selected lesson, read its

docs/en.md

and

quiz.json

. Read or run files under

code/

only when the current lab needs them. The companion manual is

manuals/reverse-engineering-101/

. Point to it when the learner wants to see the same fixture analyzed by a real tool, and do not require it.

此路径的事实来源是

learning-paths/reverse-engineering.json

。如果已克隆此仓库，优先使用本地文件。否则，从以下地址获取每个文件：

text

https://raw.githubusercontent.com/rohitg00/ai-engineering-from-scratch/main/<path>

选择课程前先阅读 manifest。按照

lessons

中的

order

顺序学习。必修路径是 Phase 13 的第 32 至 45 课，按 manifest 顺序进行。

对于每个选定课程，阅读其

docs/en.md

和

quiz.json

。仅在当前实验需要时读取或运行

code/

下的文件。配套手册位于

manuals/reverse-engineering-101/

。当学习者希望查看使用真实工具分析同一个 fixture 的过程时，可指向该手册，但不应强制要求使用。

Lab preflight

实验预检

Before Lesson 32's lab, establish these facts:

```
python3 --version
```
reports 3.10 or later.
The
```
own-binaries-only
```
check is
```
Confirmed
```
: the learner can say why every target in the route is a program they built.
Whether
```
clang
```
is on the path. It is optional. Without it, Lesson 36 reads the committed objects and reports its behaviour claims as
```
unknown
```
.

If Python is unavailable, give the website or

docs/en.md

path and continue conceptually. Mark lab observations as

Pending

. Never describe that fallback as a lab pass.

在第 32 课的实验之前，需要确认以下事实：

```
python3 --version
```
报告的版本为 3.10 或更高。
```
own-binaries-only
```
检查结果为
```
Confirmed
```
：学习者能够说明路径中的每个目标都是自己构建的程序。
```
clang
```
是否位于 PATH 中。这是可选条件。如果没有，第 36 课将读取已提交的对象，并把行为声明报告为
```
unknown
```
。

如果 Python 不可用，请提供网站或

docs/en.md

路径，并继续进行概念层面的学习。将实验观察标记为

Pending

。绝不将该回退方案描述为实验通过。

Locate or create progress

查找或创建进度记录

Use

REVERSE-ENGINEERING-LEARNING.md

in the current working directory.

If it exists, preserve learner notes and evidence. Resume the first row whose status is

Next

In progress

. If every row is

Done

, offer the manual or a recheck with a fixture the learner compiles at another optimization level. Do not restart the route.

If it does not exist, create it without an interview:

markdown

undefined

在当前工作目录中使用

REVERSE-ENGINEERING-LEARNING.md

。

如果它已经存在，请保留学习者的笔记和证据。从状态为

Next

或

In progress

的第一行继续。如果每一行都是

Done

，则提供配套手册，或者让学习者使用一个以其他优化级别编译的 fixture 进行复核。不要重启此路径。

如果它不存在，则无需访谈，直接创建：

markdown

undefined

My Reverse Engineering Path

Route

Started: <YYYY-MM-DD>
Required time: about 32 hours 25 minutes
Current: 1 of 14

Started: <YYYY-MM-DD>
Required time: about 32 hours 25 minutes
Current: 1 of 14

Prerequisite check

Python, hexadecimal, and command line: Confirmed or Pending
Python 3.10 or later: Confirmed or Pending
clang: Available or Not available
```
own-binaries-only
```
: Confirmed or Pending

Python, hexadecimal, and command line: Confirmed or Pending
Python 3.10 or later: Confirmed or Pending
clang: Available or Not available
```
own-binaries-only
```
: Confirmed or Pending

Progress

Order	Lesson	Status
1	13/32 ELF reader from scratch	Next
2	13/33 Disassembly and control flow	Locked
3	13/34 Lifting to pseudocode	Locked
4	13/35 Evidence, confidence, and unknowns	Locked
5	13/36 Rebuild and prove equal	Locked
6	13/37 The reverse engineering landscape	Locked
7	13/38 Calling conventions and stack frames	Locked
8	13/39 Compiler idioms and optimization	Locked
9	13/40 Linking, loading, and stripped binaries	Locked
10	13/41 Recovering data and types	Locked
11	13/42 Dynamic analysis of your own program	Locked
12	13/43 Bytecode and managed formats	Locked
13	13/44 Binary diffing and symbolic execution	Locked
14	13/45 AI-assisted reverse engineering	Locked

Order	Lesson	Status
1	13/32 ELF reader from scratch	Next
2	13/33 Disassembly and control flow	Locked
3	13/34 Lifting to pseudocode	Locked
4	13/35 Evidence, confidence, and unknowns	Locked
5	13/36 Rebuild and prove equal	Locked
6	13/37 The reverse engineering landscape	Locked
7	13/38 Calling conventions and stack frames	Locked
8	13/39 Compiler idioms and optimization	Locked
9	13/40 Linking, loading, and stripped binaries	Locked
10	13/41 Recovering data and types	Locked
11	13/42 Dynamic analysis of your own program	Locked
12	13/43 Bytecode and managed formats	Locked
13	13/44 Binary diffing and symbolic execution	Locked
14	13/45 AI-assisted reverse engineering	Locked

Notes


Check the commands that can be checked locally. Keep Lesson 32 `Locked` until
`own-binaries-only` is `Confirmed`. Never mark a prerequisite complete by
assumption.


检查能够在本地检查的命令。除非 `own-binaries-only` 为 `Confirmed`，否则始终保持第 32 课
的状态为 `Locked`。绝不凭假设将任何先决条件标记为完成。

Teach one lesson

教授一节课

Set the selected row to
```
In progress
```
.
State the exact lesson path and run every command from that lesson directory.
Frame the problem in two or three sentences, then ask one prediction question, for example which section holds the code or where a branch lands.
Work through the lesson's Build It and Use It material in small chunks.
Run the real lab when files and Python are available. If not, trace a small example by hand and record the lab as pending.
Require the manifest's checkpoint evidence. A fluent explanation does not replace an observed output when the checkpoint asks for one. Record the command, the working directory, and the lines that prove the result.
Ask quiz questions one at a time. Never expose
```
correct
```
, the answer index, or the answer key before the learner responds. Use
```
Reply with one letter: <A|B|C|D>.
```
Mark the row
```
Done
```
only after the checkpoint and quiz are complete. Record a compact evidence note, the date, and unlock the next row.

Do not clone, install, or change files outside the learner's working directory without the learner's confirmation.

将选定行的状态设置为
```
In progress
```
。
说明课程的准确路径，并从该课程目录运行每一个命令。
用两三句话阐述问题，然后提出一个预测问题，例如代码位于哪个 section，或分支跳转到哪里。
分小段完成课程中的 Build It 和 Use It 材料。
当文件和 Python 可用时，运行真实实验。否则手工跟踪一个小型示例，并将实验记录为 pending。
要求提供 manifest 规定的检查点证据。如果检查点要求观察到输出，那么流畅的解释不能替代实际观察结果。记录命令、工作目录以及能够证明结果的行。
每次只提出一道测验题。在学习者作答前，绝不透露
```
correct
```
、答案索引或答案密钥。使用
```
Reply with one letter: <A|B|C|D>.
```
。
只有在检查点和测验都完成后，才能将这一行标记为
```
Done
```
。记录简洁的证据说明和日期，并解锁下一行。

未经学习者确认，不要在学习者工作目录之外克隆、安装或修改文件。

Lesson checkpoints

课程检查点

13/32: parse an ELF64 and a Mach-O fixture, and match the section, symbol, and relocation output against the recorded reference.
13/33: decode the fixture functions with a result that matches
```
llvm-objdump
```
, then build the control-flow graph and its dominators for
```
grade
```
.
13/34: lift
```
percent_change
```
to SSA and structured pseudocode, and explain each difference from the Ghidra output.
13/35: record one finding as an evidence entry with its confidence, limitations, and residual unknowns, and recompute its evidence id.
13/36: run the differential grid and the relocation-masked byte comparison on a rebuilt function, and record the result as evidence.
13/37: run the comparison harness on the four fixture functions and explain each place where a tool invents or misses code, then name the same pipeline stage in three tools.
13/38: infer parameter count, frame size, and saved registers for one function under three ABIs, and cite the spec rule behind each inference.
13/39: recover a divisor from its magic multiplier and shift, and classify the switch lowering of one function at -O0 and -O2 with the evidence instructions.
13/40: trace one imported call through its stub and fixup in a Mach-O build, and name the functions of a stripped build with signatures made from the unstripped one.
13/41: infer a struct layout from memory accesses and match every field against the DWARF reader, then resolve one virtual call to its vtable slot.
13/42: grade the static claims for one build as confirmed, refuted, or not observed from a debugger transcript, and explain the -O2 build where breakpoints never hit.
13/43: parse the same function from a .pyc, a class file, and a Wasm module, match each listing against the reference tool, and list what each container keeps.
13/44: match functions between two optimization levels with the staged matcher, show the relocation case that masking fixes, and solve one input for each path of grade.
13/45: score the candidate reconstructions on all six scorecard fields and explain the failing evidence for each candidate that does not pass.

13/32： 解析一个 ELF64 和一个 Mach-O fixture，并将 section、symbol 和 relocation 输出与记录的参考结果进行匹配。
13/33： 解码 fixture 函数，使结果与
```
llvm-objdump
```
一致，然后为
```
grade
```
构建控制流图及其 dominators。
13/34： 将
```
percent_change
```
lift 为 SSA 和结构化伪代码，并解释它与 Ghidra 输出之间的每处差异。
13/35： 将一项发现记录为 evidence 条目，其中包含 confidence、limitations 和 residual unknowns，并重新计算其 evidence id。
13/36： 在重建函数上运行 differential grid 和 relocation-masked byte comparison，并将结果记录为 evidence。
13/37： 在四个 fixture 函数上运行 comparison harness，解释工具每次虚构或遗漏代码的位置，然后指出三种工具中处于同一 pipeline stage 的阶段。
13/38： 在三种 ABI 下推断某个函数的参数数量、栈帧大小和被保存寄存器，并为每项推断引用其背后的规范规则。
13/39： 从 magic multiplier 和 shift 中恢复除数，并按照 evidence instructions 对某个函数在 -O0 和 -O2 下的 switch lowering 进行分类。
13/40： 在 Mach-O 构建中追踪一次 imported call，使其经过 stub 和 fixup；并依据 unstripped 构建中的签名，命名 stripped 构建中的函数。
13/41： 根据内存访问推断 struct 布局，将每个字段与 DWARF reader 的结果匹配，然后解析一次 virtual call 对应的 vtable slot。
13/42： 依据 debugger transcript，将某个构建的静态声明评为 confirmed、refuted 或 not observed，并解释 -O2 构建中 breakpoint 从未命中的原因。
13/43： 从 .pyc、class file 和 Wasm module 中解析同一个函数，将每个 listing 与 reference tool 的结果匹配，并列出每种 container 保留的信息。
13/44： 使用 staged matcher 匹配两个优化级别之间的函数，展示 relocation 场景中 masking 修复的问题，并求解
```
grade
```
每条 path 的一个输入。
13/45： 在全部六个 scorecard 字段上对 candidate reconstructions 进行评分，并解释每个未通过候选的失败证据。

Close

收尾

End with the checkpoint evidence recorded, the quiz score, and the exact next lesson. Keep the learner on this route unless they ask to leave it.

以已记录的检查点证据、测验分数和准确的下一课作为结束。除非学习者要求离开，否则让其继续本路径。