0xZ0F / Z0FCourse_ReverseEngineering

Reverse engineering focusing on x64 Windows.
GNU Affero General Public License v3.0
5.2k stars 505 forks source link

Make the course radare2/cutter-friendly #2

Closed XVilka closed 4 years ago

XVilka commented 4 years ago

I noticed you recommend Ghidra, but it is not the only one tool available. Radare2 is a highly-portable cross-platform reverse engineering framework and a toolkit without dependencies. It has support for analyzing binaries, disassembling code, debugging programs, attaching to remote GDB/LLDB, WinDbg servers, rich plugin system (see r2pm), and integration with various decompilers. For example, ghidra decompiler plugin - r2ghidra-dec. It is actively developed and can be easily integrated in various open source and commercial products.

image

For general documentation I recommend our constantly updated Radare2 Book. For documentation on writing plugins for radare2 see Scripting and Plugins Radare2 Book chapters.

Cutter is a crossplatform Qt/C++ GUI frontend to radare2:

image

For documentation on writing plugins for Cutter see the official tutorial and the curated list of various popular plugins.

0xZ0F commented 4 years ago

Thank you for the recommendation. I'm aware of Radare2, and I did mention it (well, Radare not Radare2 so I'll update that) in 0x002-Setup.md. I'm all for open source and community-focused software like Radare2. I have used Radare2 and Cutter in the past. Unfortunately, I don't have much experience with it, which is why I use Ghidra and x64dbg which I do have experience with. I've wanted to get back into Radare2 because I liked it, however, right now I'm focused on other things. In the future, I will definitely learn how to use Radare2 and from there I will consider if I want to use it for the course.

Also, it's difficult to teach while showing multiple different reversing tools doing the same thing. It creates a lot of clutter very quickly. So that's another thing I will have to consider.

Once again, thank you for the suggestion!