## https://sploitus.com/exploit?id=E2E23888-B4D2-5829-8AE8-2D942A7524F2
# Reverse Engineering Vault
Browse the notes directly on GitHub or open the folder in [Obsidian](https://obsidian.md). Standard relative Markdown links work in both environments.
Start with the [vault guide](00-Home/README.md) or jump to the [map of content](00-Home/MOC.md).
Baseline references are collected in the [primary-source catalog](SOURCES.md). Version-sensitive notes should also cite the exact supporting page inline.
## Project status
The repository passes automated structure, metadata, and internal-link validation. A focused factual correction pass has been applied, but full source-by-source editorial certification remains in progress; see [validation status](VALIDATION_CHECKLIST.md). Treat the vault as a versioned field notebook, not an infallible specification.
## Structure
```
00-Home/ README, Map of Content
01-Foundations/ assembly, calling conventions, memory model, optimizer idioms
02-Architectures/ x86/x64, ARM/ARM64, RISC-V, MIPS, MCU
03-File-Formats/ PE, ELF, Mach-O, DEX, Java, WASM
04-Static-Analysis/ IDA, Ghidra, Binary Ninja, radare2/rizin, decompiler workflow
05-Dynamic-Analysis/ debuggers, Frida, tracing, sandboxing, emulation, symbolic exec
06-Anti-Analysis/ anti-debug, anti-VM, anti-disasm, anti-tamper, anti-hooking
07-Unpacking/ manual unpacking, OEP, IAT reconstruction, packer catalog
08-Malware-Analysis/ triage, behavioral, IOCs, YARA, MITRE ATT&CK, family field guide
09-Exploitation/ stack/heap/UAF/format-string/race, ROP, fuzzing, mitigations
10-Shellcoding/ x86/x64/ARM, PEB walking, encoders, stagers
11-Windows-Internals/ PEB/TEB, syscalls, WoW64, ETW, drivers, BYOVD, COM/RPC
12-Linux-Internals/ syscalls/vDSO, ld.so, ptrace, capabilities, eBPF, persistence
13-Mobile-RE/ Android, iOS, native libs, anti-tamper, lab setup
14-Firmware-IoT/ acquisition, binwalk, emulation, hardware interfaces, glitching
15-Wireless-BLE-RF/ BLE, Bluetooth Classic, NFC, sub-GHz, Wi-Fi, Zigbee, SDR
16-Crypto-RE/ algo identification, key extraction, common misuses, whitebox, side-channels
17-Obfuscation-VMs/ OLLVM techniques, VMProtect, Themida, devirtualization
18-Red-Team-Ops/ injection, syscalls, EDR/ETW/AMSI bypass, C2, OPSEC, lateral, persistence
19-Tooling/ static, dynamic, hex editors, libs, fuzzing, mobile, wireless, misc
20-Resources-Labs/ books, courses, CTFs, blogs, conferences, communities, labs, cheatsheets
```
## Read order
For a **structured walk** through the vault, follow numerical order. Each `Index.md` lists the notes in that folder.
For **field-specific** drilling:
- Malware analyst → 03 → 04 → 05 → 06 → 07 → 08
- Exploit dev → 01 → 02 → 03 → 09 → 10
- Red team → 11/12 → 06 → 18 (with 04/05 as dynamic supplements)
- Mobile → 13 → 03 (DEX, Mach-O) → 05 (Frida)
- Firmware / IoT → 14 → 02 (MCU) → 15 (if wireless)
- BLE / RF → 15 → 14
- Crypto-curious → 16 → 17
## Tags
`#static`, `#dynamic`, `#anti-rev`, `#bypass`, `#redteam`, `#malware`, `#exploit`, `#shellcode`, `#mobile`, `#firmware`, `#wireless`, `#crypto`, `#obfuscation`, `#tooling`, `#resources`, `#file-format`, `#windows`, `#linux`, `#macos`, `#hardware`, `#foundations`.
## Conventions
- Lists are flat and short by design.
- Code blocks are concrete, runnable where reasonable.
- "See also" at the bottom links related notes.
- Tables call out tools / techniques / signatures rather than narrative.
Maintain by adding frontmatter tags and relative Markdown links as you write new notes. Update `00-Home/MOC.md` when you add a new top-level domain.
## Responsible use
Use these materials only on software, devices, and networks you own or are explicitly authorized to assess. Laws, contracts, export controls, and engagement rules vary by jurisdiction and target. Keep written scope and an audit trail.
## Contributing and validation
Read [CONTRIBUTING.md](CONTRIBUTING.md), then run:
```bash
python3 scripts/validate_vault.py
```
GitHub Actions checks structure and internal links on every change and checks external links monthly. Report ordinary content errors with the issue template; follow [SECURITY.md](SECURITY.md) for sensitive defects and [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) when participating.
## Copyright
No reuse license is currently granted. See [LICENSE.md](LICENSE.md). The maintainer can deliberately replace it with an open documentation license before public reuse is invited.