awesome-reversing

that can be used to train you up in the necessary foundations for you to understand modern exlpoits with a bit of your own leg work. The "From 0x90 to 0x4c454554" article actually looks like a very good collection of resources. Dates resources are still valuable as modern exploits are still doing the same thing (trying to get control of the IP register) its just now there are mitigations in place that require extra steps or to follow certain restrictions to be successful, but if you don't understand the foundation you can't learn the modern stuff. > I want to understand what are the ACTUALLY NECESSARY topics required and in RIGHT ORDER to MINIMIZE the TIME WASTING and wandering in between topics The problem with that is that that time wasting and learning other topics that are not immediately useful are immensely beneficial on a whole. Honestly, a big part of exploit development is spending hours researching dead ends...seriously that's a big part of it. It requires a wide breadth of knowledge not just a bunch of tips and tricks specific to exploit development. In order to craft sophisticated exploits against a system you need to understand that system, how its built and how it works. This comes from that wandering research, it may not be immediately valuable but doing it often leads to building up a set of topics that you are deeply knowledgeable in. And, you you can draw from that knowledge in exploiting certain interactions later on. That wandering, beating your head against a wall, getting stuck not knowing what to do is part of exploit development. Trying to avoid it honestly doesn't sound like a good idea, you'll end up knowing a bunch of tricks but lacking the background to apply them creatively. None the less, the first thing you need is some development background. If you want to break software start by learning how software is built. So, I recommend starting by learning C. First C is the lingua franca of exploit development and reverse engineering. If you understand C you can break any high level software down into its 'C parts' and from that C you can determine what the machine code probably looks like. C is the perfect middle ground, thinking in machine code or assembly is too tedious and languages like Python or Java are too high level to capture whats going on at the CPU level. Software exploits ultimately are about controlling the IP register on the CPU that is why being able to understand the whole stack is important. Start with C, but learn a higher level scripting language, something that is used for quick jobs, prototyping, etc. While C is nice it also requires a lot of lines to do some tasks that are very simple in higher level languages (string manipulation and network communication for example). So, its useful to know a scripting language to actually do quick jobs in. Python and Ruby are the two common choices right now, historically Perl was the most common choice. Now everyone I work with knows Python, but Ruby has its place too. If you struggle to learn C, you might find it useful to start with a scripting language which are often said to be better for learning to program with. Maybe it is but I tend to side with Evan Miller who writes: http://www.evanmiller.org/you-cant-dig-upwards.html in that C is a better place to start even if the results are not as immediate. Still, if C isn't working for you start with the scripting language then learn C. Further, once you know C and a scripting language, learn one of the modern work-horses, Java or C# (I lean towards Java). Most developers will know one or both of the languages and getting an understanding of Object Oriented Programming is useful to understanding how software is built. You find OOP design patterns in most software. Once you know a native language (C, C++) an intermediate language (Java, C#, etc) and a scripting language (Python, Ruby, Perl, etc) you'll be able to work with the majority of code-bases out there even if you don't know the specific language in use you'll understand the core concepts that underline most languages. There are some other paradigms seen in less common languages like prolog (logic programming) or haskell (functional programming) that you won't understand but those three languages cover practically all modern software you'll encounter. Recommended Books: you don't need to read all of these but its a selection you might find useful. Also, I am a fan of the Head First series which usually are not very thorough and some find the writing to be too casual and annoying so YMMV. 1. Head First C, covers the basics of C in an easily digested format. Some I've recommended it to have found its section on pointers useful. 2. The C Programming Language, the Bible of the C language, you'll pick up some bad habits from it, and its dated but its a concise overview of C. 3. Violent Python, Its a bit steep of a learning curve but its teaching Python with a security focus so it fits in very well. 4. Head First Programming - If you struggle with the basics of coding, it might be worth checking this book out. 5. Dive Into Python - http://www.diveintopython.net 6. Design Patterns: Elements of Reusable Object-Oriented Software - Once you understand the programming its time to learn the architecture of software, this is the classic book on the topic. 7. Head First Design Patterns - if the last book was a bit too steep for you the Head First book might be a bit easier. 8. Beej's Guide to Network Programming - You need to understand sockets, and socket programming, no exceptions and for C this is the best guide available. While you're learning to code you should also be trying to get some experience working with Linux. Even if Windows is your daily driver (as it is mine) Linux is inescapable you'll rarely come across a network that doesn't use Linux anything (and similarly, you'll rarely come across a corporate network without some Windows servers too, so don't ignore Windows server). I don't have any book recommendations on this, just setup your own Linux box learn the different package managers and how to do what you need from the terminal. I do recommend working through the following to get some general experience. 1. http://overthewire.org/wargames/leviathan/ - You'll learn about Linux with this one, and it doesn't require any programming ability so its a fair starting place. 2. http://overthewire.org/wargames/bandit/ - Bandit is a easy server/wargame to start with, and it'll teach you a bit about Linux and require a bit of coding but there is nothing that requires technical exploit development knowledge. 3. https://exploit-exercises.com/nebula/ - Nebula is a little more difficult than Bandit but still non-technical and imo a little more fun. Working through these give you some comfort working in a terminal and some experience getting the attacker's mindset and breaking things. You can do these while learning the stuff above. You may also want to get some practice programming with challenges such as those at: 1. ProjectEuler.net - These often require some mathematical insight but they're fun so I'm including it 2. https://leetcode.com - This is used by some developers to practice before an interview, various levels so it'll work just for getting some experience with programming.

90-to-0x4c454554-journey-into.html but it is quite outdated. Your opinions along with updated resource links and views on them will be greatly appreciated. Please, only focus only on topics that are actually necessary because RE and Exploit development are vast topics in themselve (for eg: Do I actually need to learn computer architecture or organization? AFAIK those circuits and architecture specific thing is more helpful for a electrical or electronics engineer rathen a RE. We need to learn the intricacies of a particular architecture like x86 or ARM but in my opinion those circuits won't help any RE in his daily reversing schedule, so please foucs on the only required part like one I know: OS fundamentals.