{
  "added_at": "2026-11-02",
  "category": "learning",
  "description_en": "Michal Malik’s single-README reading list for Linux reverse engineering, with about 230 links and book titles that run from quick references on system calls, ELF and processor ABIs through 101 and 201 tiers on program start-up, linking and relocations. Later sections gather material on packers and obfuscation, anti-debugging, ELF infection, kernel modules and rootkits, exploitation, crackmes, radare2 walkthroughs, detection tools and books. It is a lightly annotated link list last changed in January 2022, useful as a background syllabus rather than a maintained course.",
  "description_zh": "Michal Malik 以单个 README 维护的 Linux 逆向工程阅读清单，收录约 230 条链接与书目：从系统调用、ELF 和各处理器 ABI 的速查资料，到讲解程序启动、链接与重定位的 101、201 两级阅读。后续部分汇集加壳与混淆、反调试、ELF 感染、内核模块与 rootkit、漏洞利用、crackme、radare2 实战、检测工具及书籍等资料。这是一份注释很少、最后改动于 2022 年 1 月的链接清单，适合作为背景阅读提纲，而不是持续维护的课程。",
  "entry_url": "https://awesomerea.org/resources/linux-re-101/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/linux-re-101/",
  "evidence_url": "https://github.com/michalmalik/linux-re-101/blob/f858da0f325aa4eb77008ba63d1bddfaf8d53d80/README.md",
  "group": "learn",
  "id": "linux-re-101",
  "json_url": "https://awesomerea.org/resources/linux-re-101/record.json",
  "kind": "learning-resource",
  "markdown_url": "https://awesomerea.org/resources/linux-re-101/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/linux-re-101/index.md",
  "name": "linux-re-101",
  "name_zh": "linux-re-101 Linux 逆向工程阅读清单",
  "record_type": "resource",
  "relationship": "learning",
  "requirements": [
    "The reviewed master commit f858da0, dated 2022-01-16, contains a single file, README.md, which calls the list a work in progress. It holds 231 bullet entries under 15 headings; the largest are Linux kernel, rootkits and LKM development (40), 101 (22) and viruses and infection techniques (20), and several articles appear in more than one section.",
    "Entries give a title and a link, sometimes marked Optional or followed by a short remark; beyond the 101 and 201 headings they state no level, prerequisites or exercises. 148 of the 229 URLs use plain HTTP, and most dated links point to posts from 2008–2017.",
    "The material centres on Linux ELF binaries on x86, x86-64, ARM, ARM64 and MIPS, and the hands-on section mostly uses radare2, with GDB, IDA and LIEF references elsewhere. The repository supplies no labs, sample binaries or setup; crackme and challenge links lead to external archives, and readers need a Linux system plus whatever tools each linked article names.",
    "The packer, anti-debugging, infection, rootkit and exploitation sections link offensive write-ups, rootkit source repositories and external virus collections alongside detection material; linked code and samples are third-party material with their own risks and terms.",
    "GitHub detects no license and the repository has no license file, so the list states no reuse terms; linked articles, books and code keep their own rights. An independent learning list."
  ],
  "requirements_zh": [
    "所审阅的 master 分支提交 f858da0 日期为 2022-01-16，仓库只有 README.md 一个文件，并自称仍在整理中。清单在 15 个标题下共有 231 个条目，最多的是「Linux 内核、rootkit 与 LKM 开发」（40 条）、「101」（22 条）和「病毒与感染技术」（20 条），部分文章在多个部分重复出现。",
    "条目只给出标题和链接，偶尔标注 Optional 或附简短评语；除 101、201 两级标题外，没有说明难度、前置知识或练习。229 个 URL 中有 148 个使用明文 HTTP，可辨日期的链接大多指向 2008–2017 年的文章。",
    "内容以 x86、x86-64、ARM、ARM64 和 MIPS 上的 Linux ELF 二进制为中心，实战部分主要使用 radare2，其他部分也提到 GDB、IDA 和 LIEF。仓库不提供实验环境、样本二进制或配置说明；crackme 与挑战题链接指向外部压缩包，读者需要自备 Linux 系统及各篇文章所用的工具。",
    "加壳、反调试、感染、rootkit 与漏洞利用等部分在检测资料之外，也链接了攻击性文章、rootkit 源码仓库和外部病毒合集；所链接的代码和样本属于第三方材料，各有风险与使用条款。",
    "GitHub 未检测到许可证，仓库也没有许可证文件，因此清单未说明复用条款；所链接的文章、书籍和代码保留各自权利。这是独立的学习清单。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/michalmalik/linux-re-101",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}