Linux Reverse Engineering CTFs for Beginners

"CTFs are computer security/hacking competitions which generally consist of participants breaking, investigating, reverse engineering and doing anything they can to reach the end goal, a 'flag' which is usually found as a string of text." https://ctfs.github.io/resources/

Some companies have security departments that analyze malware that targets their employees or the users of their services. Penetration testers might also use reverse engineering because people who hired them don't have the source code of some relevant thing, or because they want to see what an attacker who didn't have it could do, or because for some kinds of attacks looking at the actual binary might be more informative than looking at source code.

There are also antivirus developers who reverse engineer malware that doesn't necessarily target a particular class or group of users.

I've also met a reverse engineer who works with cases where proprietary software publishers have lost their old source code (this is really a thing!).

Vulnerability research & exploit dev. To break a system you must first know how it works.

There are also things like anti-cheat which requires reversing the cheats that are used and reversing the os to figure out methods you can use for detection.

Somewhat related to that, there's antimalware which is based upon the same principles.

Competitive analysis, reversing someone else's product so you can determine how they do stuff compares to how you do stuff. Some companies will even analyze a competitors product and then reimplement parts of it, you just have to be careful with copyrights and patents.

Fixing compatibility issues is also a thing. For example, GOG hires reverse engineers to get old games running on modern versions of windows.

Reverse engineers are also sometimes hired to make two pieces of software interoperate. Take for example, an oscilloscope that saves traces in a proprietary format, and a data visualization tool that uses a different proprietary format. A reverse engineer could reverse the details of the two formats and make a tool that converts in-between.

While some people might post such comments for the sake of "intelligence signaling", the GP seemed to not know what "CTF" meant. I think he offered a fair and simple criticism, and I found your comment needlessly harsh and presumptuous.

Even if some people post comments like that as a trope, some - if not many - post them sincerely. I think the original criticism makes perfect sense: an article for beginners might better benefit its readers if it offers just a simple sentence or even link that briefly explains what the topic is before delving into its details. I personally have read a number of articles where I've encountered this problem, despite my familiarity with the given topic.

Also, I think it benefits the HN community at large if we try our best to read people's comments in a positive light, within reasonable, and encourage giving and receiving constructive criticism from one another.

I see the reverse engineering skillset as not essentially different from low level systems programming, and as such it's very valuable even outside of "pure" security research.

I work as a Python programmer building scientific apps (so not security-related or systems programming at all), but at work every so often we're confronted with legacy code in binary form, or particularly nasty segfaults, etc. The thing with abstractions is that every so often the lower levels bleed through. At times like these, if you know your way around gdb, the ELF format, linking conventions, and can reason in assembly, you'll find yourself highly sought-after.

It gets even more fun when things work nicely on Linux and go haywire on Windows. Often there are no docs on Windows, so you need something who is ready to crack their knuckles, fire up IDA pro, and descend into the 7 circles of hell.