reverse-engineer

• SKILL.mdcore · 7,004 bytes

## Overview

Reverse engineering is the disciplined study of how software *actually* works by examining its compiled form: disassembly, decompilation, and behavioral observation. Defenders use it to understand malware, find vulnerabilities in software they must protect, verify vendor claims, and build interoperable tools. It is slow, methodical work — and one of the highest-leverage defensive skills.

This skill covers the defensive methodology: legal boundaries, lab setup, static/dynamic techniques, and turning findings into protections. It stays at the standard published methodology level — no exploit development, no circumvention of DRM or access controls.

Reverse engineering rewards patience and punishes ego — the binary does not care how clever you are, only how carefully you observe. The analysts who excel build systems: consistent naming conventions, structured notes, hypothesis logs, and verification discipline. Speed comes from method, not from staring harder at disassembly.

## When to use

- Understanding malware or a suspicious binary's true behavior (with malware-analyst).
- Vulnerability research on software you are authorized to assess (your products, bounty scope, contracted assessments).
- Verifying what a third-party agent, driver, or firmware actually does before deployment.
- Interoperability work: documenting a protocol or file format you must integrate with.