{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/0xZ0F/Z0FCourse_ReverseEngineering/blob/ee4b07095d6f81ba5e5c7e0b70f7cb39e3af83b1/TableOfContents.md",
    "https://github.com/0xZ0F/Z0FCourse_ReverseEngineering/blob/ee4b07095d6f81ba5e5c7e0b70f7cb39e3af83b1/Chapter%201%20-%20Introduction/1.0%20Introduction.md",
    "https://github.com/0xZ0F/Z0FCourse_ReverseEngineering/blob/ee4b07095d6f81ba5e5c7e0b70f7cb39e3af83b1/Chapter%201%20-%20Introduction/1.2%20Setup.md",
    "https://github.com/0xZ0F/Z0FCourse_ReverseEngineering/blob/ee4b07095d6f81ba5e5c7e0b70f7cb39e3af83b1/FilesNeeded/FilesNeeded.md",
    "https://github.com/0xZ0F/Z0FCourse_ReverseEngineering/blob/ee4b07095d6f81ba5e5c7e0b70f7cb39e3af83b1/Chapter%208%20-%20Generic%20Table/8.00%20GenericTable.md",
    "https://github.com/0xZ0F/Z0FCourse_ReverseEngineering/blob/ee4b07095d6f81ba5e5c7e0b70f7cb39e3af83b1/FAQ.md",
    "https://github.com/0xZ0F/Z0FCourse_ReverseEngineering/blob/ee4b07095d6f81ba5e5c7e0b70f7cb39e3af83b1/License.md"
  ],
  "category": "learning",
  "description_en": "A free English course by Z0F on reverse engineering 64-bit Windows programs, which its README pitches as taking learners from beginner to intermediate. Markdown lessons move from number systems, x64 registers, memory layout and calling conventions to x64dbg and Ghidra, then reverse small samples and an author-written DLL, recovering a Player class and calling the DLL's exports from a program of one's own. The unfinished later chapters introduce Windows internals and reverse ntdll's generic-table functions.",
  "description_zh": "Z0F 编写的免费英文课程，讲解如何逆向 64 位 Windows 程序，README 称目标是帮助学习者从入门进阶到中级。Markdown 课程从数制、x64 寄存器、内存布局和调用约定讲起，过渡到 x64dbg 与 Ghidra，再逆向若干小样本以及作者自己编写的 DLL，还原其中的 Player 类，并在自己编写的程序中调用该 DLL 的导出函数。尚未完成的后续章节介绍 Windows 内部机制，并逆向 ntdll 中的 generic table 系列函数。",
  "entry_url": "https://awesomerea.org/resources/z0f-reverse-engineering-course/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/z0f-reverse-engineering-course/",
  "evidence_url": "https://github.com/0xZ0F/Z0FCourse_ReverseEngineering/blob/ee4b07095d6f81ba5e5c7e0b70f7cb39e3af83b1/README.md",
  "group": "learn",
  "id": "z0f-reverse-engineering-course",
  "json_url": "https://awesomerea.org/resources/z0f-reverse-engineering-course/record.json",
  "kind": "learning-resource",
  "markdown_url": "https://awesomerea.org/resources/z0f-reverse-engineering-course/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/z0f-reverse-engineering-course/index.md",
  "name": "Z0FCourse Reverse Engineering",
  "name_zh": "Z0FCourse 逆向工程课程",
  "record_type": "resource",
  "relationship": "learning",
  "requirements": [
    "Reviewed at commit ee4b070 (2026-07-25). Most lessons were written in 2019–2020, and the table of contents marks Chapter 7 (Windows) and Chapter 8 (Generic Table) as work in progress; the .NET and other-architecture material promised by the setup and Before You Begin pages is not in the tree. Later commits are small fixes, formatting, refreshed PDF copies and new links. The README points to two TryHackMe rooms as an interactive version of chapters 1–6.",
    "Chapter 1 lists a good understanding of C/C++, object-oriented programming and pointers as prerequisites and highly recommends prior x86/x64 assembly. The course needs a 64-bit Windows system, a virtual machine being optional until the malware material; setup names the Microsoft Visual C++ Redistributable, x64dbg (with the optional xAnalyzer plugin) and dnSpy or ILSpy as required, with Ghidra and Visual Studio highly recommended.",
    "The target programs are the author's own and ship with their source in FilesNeeded: the Chapter 6 DLL with two host programs and debug symbols, plus a sample malware program and dropper for a chapter not yet written, which FilesNeeded marks as use-at-your-own-risk. Chapter 8 instead analyzes Windows's own ntdll.dll, which is not included. PDF copies of the chapters are also committed, and the README warns they may lag the Markdown lessons.",
    "The repository's License.md is the AGPL-3.0 text; the FAQ adds that downloading is allowed for personal use only and defers redistribution and teaching use to the license."
  ],
  "requirements_zh": [
    "审阅提交为 ee4b070（2026-07-25）。大部分课程写于 2019–2020 年，目录将第 7 章（Windows）和第 8 章（Generic Table）标为未完成；环境配置页和 Before You Begin 页面预告的 .NET 及其他架构内容并不在仓库中。之后的提交多为小修正、格式整理、更新 PDF 副本和添加链接。README 推荐两个 TryHackMe 房间，作为第 1–6 章的交互式版本。",
    "第 1 章列出的前置要求是熟练掌握 C/C++、面向对象编程和指针，并强烈建议先学过 x86/x64 汇编。课程需要 64 位 Windows 系统，在进入恶意软件内容之前虚拟机并非必需；环境配置页列为必需的有 Microsoft Visual C++ Redistributable、x64dbg（可选 xAnalyzer 插件），以及 dnSpy 或 ILSpy，并强烈推荐 Ghidra 和 Visual Studio。",
    "课程中的目标程序均由作者编写，并连同源码放在 FilesNeeded 中：第 6 章的 DLL、两个调用它的宿主程序及调试符号，另有一个恶意软件样本程序及其投放器，对应尚未撰写的章节，FilesNeeded 注明使用风险自负。第 8 章则分析 Windows 自带的 ntdll.dll，仓库并未包含该文件。仓库还提交了各章的 PDF 副本，README 提醒这些 PDF 可能落后于 Markdown 课程。",
    "仓库中的 License.md 为 AGPL-3.0 全文；FAQ 另称仅允许为个人使用而下载，再分发和教学使用则以许可证为准。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/0xZ0F/Z0FCourse_ReverseEngineering",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}