# Z0FCourse Reverse Engineering > A free English course by Z0F on reverse engineering 64-bit Windows programs, which its README pitches as taking learners from beginner to intermediate. Markdown lessons move from number systems, x64 registers, memory layout and calling conventions to x64dbg and Ghidra, then reverse small samples and an author-written DLL, recovering a Player class and calling the DLL's exports from a program of one's own. The unfinished later chapters introduce Windows internals and reverse ntdll's generic-table functions. - Type: Learning resource - Targets: Binary - Category: Learning resources - Relationship: Learning resource - Sources reviewed: 2026-10-19 - Added to the catalog: 2026-10-19 - Original resource: - Primary source: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/z0f-reverse-engineering-course/index.md) ## Requirements & limits - Reviewed at commit ee4b070 (2026-07-25). Most lessons were written in 2019–2020, and the table of contents marks Chapter 7 (Windows) and Chapter 8 (Generic Table) as work in progress; the .NET and other-architecture material promised by the setup and Before You Begin pages is not in the tree. Later commits are small fixes, formatting, refreshed PDF copies and new links. The README points to two TryHackMe rooms as an interactive version of chapters 1–6. - Chapter 1 lists a good understanding of C/C++, object-oriented programming and pointers as prerequisites and highly recommends prior x86/x64 assembly. The course needs a 64-bit Windows system, a virtual machine being optional until the malware material; setup names the Microsoft Visual C++ Redistributable, x64dbg (with the optional xAnalyzer plugin) and dnSpy or ILSpy as required, with Ghidra and Visual Studio highly recommended. - The target programs are the author's own and ship with their source in FilesNeeded: the Chapter 6 DLL with two host programs and debug symbols, plus a sample malware program and dropper for a chapter not yet written, which FilesNeeded marks as use-at-your-own-risk. Chapter 8 instead analyzes Windows's own ntdll.dll, which is not included. PDF copies of the chapters are also committed, and the README warns they may lag the Markdown lessons. - The repository's License.md is the AGPL-3.0 text; the FAQ adds that downloading is allowed for personal use only and defers redistribution and teaching use to the license. ## Primary sources 1. 2. 3. 4. 5. 6. 7. 8. ## More in References and learning - [OWASP Mobile Application Security Testing Guide (MASTG)](https://awesomerea.org/resources/owasp-mastg/index.md) · Learning resource - [The Decompilation Wiki](https://awesomerea.org/resources/decompilation-wiki/index.md) · Learning resource - [Frontkick vs Rikugan: a CREBench agent comparison](https://awesomerea.org/resources/frontkick-rikugan-crebench-comparison/index.md) · Learning resource - [FLARE Learning Hub](https://awesomerea.org/resources/flare-learning-hub/index.md) · Learning resource - [Nintendo Switch Reverse Engineering](https://awesomerea.org/resources/nintendo-switch-joycon-re-notes/index.md) · Learning resource - [Android App Reverse Engineering 101](https://awesomerea.org/resources/android-app-re-101/index.md) · Learning resource ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.