Learning resource
linux-re-101
Michal Malik’s single-README reading list for Linux reverse engineering, with about 230 links and book titles that run from quick references on system calls, ELF and processor ABIs through 101 and 201 tiers on program start-up, linking and relocations. Later sections gather material on packers and obfuscation, anti-debugging, ELF infection, kernel modules and rootkits, exploitation, crackmes, radare2 walkthroughs, detection tools and books. It is a lightly annotated link list last changed in January 2022, useful as a background syllabus rather than a maintained course.
- Targets
- Binary
- Category
- Learning resources
- Relationship
- Learning resource
- Sources reviewed
Requirements & limits
- The reviewed master commit f858da0, dated 2022-01-16, contains a single file, README.md, which calls the list a work in progress. It holds 231 bullet entries under 15 headings; the largest are Linux kernel, rootkits and LKM development (40), 101 (22) and viruses and infection techniques (20), and several articles appear in more than one section.
- Entries give a title and a link, sometimes marked Optional or followed by a short remark; beyond the 101 and 201 headings they state no level, prerequisites or exercises. 148 of the 229 URLs use plain HTTP, and most dated links point to posts from 2008–2017.
- The material centres on Linux ELF binaries on x86, x86-64, ARM, ARM64 and MIPS, and the hands-on section mostly uses radare2, with GDB, IDA and LIEF references elsewhere. The repository supplies no labs, sample binaries or setup; crackme and challenge links lead to external archives, and readers need a Linux system plus whatever tools each linked article names.
- The packer, anti-debugging, infection, rootkit and exploitation sections link offensive write-ups, rootkit source repositories and external virus collections alongside detection material; linked code and samples are third-party material with their own risks and terms.
- GitHub detects no license and the repository has no license file, so the list states no reuse terms; linked articles, books and code keep their own rights. An independent learning list.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · michalmalik/linux-re-101 · Revision f858da0
More in References and learning
- Frida Labs · Learning resource
- osx & ios re 101 · Learning resource
- AndroidReverse101 · Learning resource
- Ghidra Snippets · Learning resource
- Frida Boot: a beginner binary instrumentation workshop · Learning resource
- Embedded Hacking (mytechnotalent) · Learning resource