Project 52: Reverse Engineering Basics

Module: Module 6: Applied Web Security & Defensive Automation  |  Level: Intermediate  | 
Primary tool: Ghidra (free, NSA-released) or free IDA Free  |  Estimated time: 75–120 minutes

Objective: Statically analyze a benign compiled binary to learn core RE workflow.

Free lab environment

MalwareBazaar (abuse.ch) + a fully offline analysis VM — https://bazaar.abuse.ch/

MalwareBazaar is a free, legitimate malware-sample repository run by abuse.ch for researchers and defenders. Only ever detonate or inspect samples inside a fully network-isolated virtual machine (host-only or no networking, snapshot taken beforehand) that you are prepared to destroy afterward. Never run a live sample on your host OS or a network-connected VM.

Lab workflow

1. Before anything else: confirm your analysis environment has no real network access and is a disposable snapshot you are prepared to destroy afterward. Do not proceed until this is true.
2. Obtain your sample from a small binary you compile yourself, or a beginner CTF binary from picoCTF’s free ‘Reverse Engineering’ track — a legitimate, purpose-built research source, never a random internet download.
3. Using Ghidra (free, NSA-released) or free IDA Free, perform your analysis with the specific goal of learning to statically analyze a benign compiled binary to learn core RE workflow.
4. Record every observable indicator of compromise (IOC) as you find it: file paths, registry keys, network callbacks, process names.
5. Summarize the sample’s behavior in plain English, as if briefing someone who cannot read the raw tool output themselves.
6. Destroy or revert the VM snapshot once you have exported your evidence — don’t leave a live sample sitting in a running environment.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• Ghidra’s decompiled function view for the binary’s main logic
• your written summary, in plain English, of what the function actually does

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.