0xz0f/z0fcourse_reverseengineering

This repository is a free reverse engineering course focused on 64-bit Windows. Reverse engineering in this context means taking a compiled program, one where you don't have the original source code, and figuring out what it does by reading the low-level instructions the computer executes. This skill is used in security research, malware analysis, and understanding software at a deep level. The course is structured to take someone from beginner to intermediate level. It starts with the basics of how compiled programs are structured, then works through progressively more complex examples: reversing small programs, reversing a DLL (a type of Windows library file) and incorporating it into a custom program, and eventually reversing real malware samples. The course specifically covers 64-bit Windows because it is the most common environment today and has only one calling convention to worry about, which simplifies the learning process. The theory and concepts carry over to 32-bit Windows and other operating systems as well. The author created the course because they found existing resources on reverse engineering to be outdated, expensive, or difficult to follow. The course is written in Markdown and stored as files in the repository, making it readable directly on GitHub. PDF versions are also available in ZIP archives with the password "reverse" for people who prefer that format. The PDFs may not be fully up to date, so the Markdown version is recommended. The first six chapters of the course are also available interactively on TryHackMe, a platform for hands-on security learning, through two dedicated rooms. A Discord server accompanies the course for questions and updates.