Learn to understand a program from its bytes: read hex and byte order, undo simple encryption, read assembly and build an emulator for a tiny machine. Then solve challenges where your code extracts the key. All in Python, right in your browser, on small programs we built for you.
>>> prog = bytes.fromhex("01480502210500")>>> prog.hex(" ")'01 48 05 02 21 05 00'>>> print(*disasm(prog), sep="\n")LOAD 0x48 OUT ADD 0x21 OUT HALT>>> run(prog)b'Hi'>>>
Start at the byte and finish with challenges where you extract the key yourself. Each track builds on the one before it, so take them in order.
Start from the byte: hexadecimal, byte order and bitwise operations, then reading file structures, extracting strings and breaking XOR.
Read assembly, calling conventions and control flow, then build a disassembler and an emulator for a tiny machine, patch its bytes and check their integrity.
Six challenges of rising difficulty where you reverse a check function or bytecode and extract the key with your own code, not by copying it.
These are the area's assignments. Each challenge is a small program we built for you: reverse its check function or bytecode to extract the key. Hints are scarcer, and the grader runs your code on hidden cases, so copying an answer won't work.
Solved 0 of 6 challenges
Try every key and pick the one closest to real text
Undo the transformation one step at a time to recover the key
Emulate the machine with an input instruction, then reverse it to get the key
Brute-force search over a small space
Walk through records of varying length
A chain of steps that ends at the flag
The exam unlocks once you finish every lesson and challenge in this area. It has three stages, easy, medium and hard, each with two problems and no hints or model solutions. Passing a stage unlocks the next one.
Certificate of Mastery
Reverse Engineering
Your name here
has passed all three stages of the Reverse Engineering exam — easy, medium and hard — without hints or model solutions, passing every automated check.
Short tables you'll reach for in every lesson and challenge: number bases, characters, struct format codes, registers and instructions, byte order, and our tiny machine's instruction set.
| Decimal | Hex | Binary |
|---|---|---|
0 | 0x00 | 0000 0000 |
1 | 0x01 | 0000 0001 |
10 | 0x0a | 0000 1010 |
15 | 0x0f | 0000 1111 |
16 | 0x10 | 0001 0000 |
42 | 0x2a | 0010 1010 |
65 | 0x41 | 0100 0001 |
127 | 0x7f | 0111 1111 |
255 | 0xff | 1111 1111 |
A byte is a number from 0 to 255, written as two hex digits or eight bits. In Python, hex and bin display it, and int parses it back from text.
hex(42) '0x2a'
bin(42) '0b101010'
int("2a", 16) 42
f"{42:08b}" '00101010'The number 0x12345678 as four bytes in memory:
Big-endian
Little-endian
Little-endian puts the lowest byte first, and it's what most processors use. The highlighted byte is the highest one, and the numbers under each byte give its offset from the start.
n = 0x12345678
n.to_bytes(4, "big").hex(" ")
'12 34 56 78'
n.to_bytes(4, "little").hex(" ")
'78 56 34 12'| Register | What it holds |
|---|---|
rax | The function's return value |
rdi rsi rdx rcx r8 r9 | Arguments one through six |
rsp | Top of the stack |
rbp | Base of the function's frame |
rip | Address of the next instruction |
This is the System V convention used on Linux and macOS. Windows passes the first four arguments in rcx, rdx, r8 and r9. Each register also has a name for its lower half: eax is the lower half of rax.
| Instruction | What it does |
|---|---|
mov a, b | Copies the second into the first |
lea a, [m] | Puts the address of m, not its value, in the first |
add a, b | Adds the second to the first |
sub a, b | Subtracts the second from the first |
xor a, b | XORs the first with the second |
inc a / dec a | Adds one or subtracts one |
cmp a, b | Compares and sets the flags |
test a, b | ANDs and sets the flags |
jmp L | Always jumps to L |
je / jz L | Jumps if equal, or if the result is zero |
jne / jnz L | Jumps if not equal |
jg / jle L | Jumps if the first is greater, or less than or equal |
push a | Pushes a value onto the stack |
pop a | Pops a value off the stack |
call f / ret | Calls a function, and returns from it |
These are in Intel syntax, as tools like Ghidra show them, with the destination before the source. Linux tools like objdump default to AT&T syntax, which reverses the order and prefixes registers with %, so add -M intel to match this table. cmp and test don't store a result; they set the flags that the following jumps read. xor eax, eax is a short way to zero a register.
| 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | a | b | c | d | e | f | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2x | sp | ! | " | # | $ | % | & | ' | ( | ) | * | + | , | - | . | / |
| 3x | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | : | ; | < | = | > | ? |
| 4x | @ | A | B | C | D | E | F | G | H | I | J | K | L | M | N | O |
| 5x | P | Q | R | S | T | U | V | W | X | Y | Z | [ | \ | ] | ^ | _ |
| 6x | ` | a | b | c | d | e | f | g | h | i | j | k | l | m | n | o |
| 7x | p | q | r | s | t | u | v | w | x | y | z | { | | | } | ~ |
Read a character's code from its row and column: A sits in row 4x, column 1, so it's 0x41. Everything printable falls between 0x20 and 0x7e, and anything outside that range is usually noise. In Python, ord turns a character into a number and chr turns a number back into a character.
| Char | Bytes | Meaning |
|---|---|---|
< | Little-endian | |
> | Big-endian | |
! | Network order, which is big-endian | |
x | 1 | Pad byte, skipped |
B b | 1 | Unsigned and signed byte |
H h | 2 | Unsigned and signed short |
I i | 4 | Unsigned and signed int |
Q q | 8 | Unsigned and signed long long |
4s | 4 | Four raw bytes |
struct.unpack("<IHB", data)
struct.calcsize("<IHB") # 7The format string in the example reads four bytes, then two, then one, little-endian. Always start a format string with a byte-order character: without one, Python adds padding to align the fields.
| Byte | Instruction | Operand | What it does |
|---|---|---|---|
0x00 | HALT | No | Stops execution |
0x01 | LOAD | Yes | Puts the operand in the accumulator |
0x02 | ADD | Yes | Adds the operand to the accumulator |
0x03 | XOR | Yes | XORs the accumulator with the operand |
0x04 | SUB | Yes | Subtracts the operand from the accumulator |
0x05 | OUT | No | Appends the accumulator to the output |
A machine we invented for learning, used by the program analysis lessons, the challenges and the exam. The accumulator starts at zero, all arithmetic is mod 256, and an instruction with an operand is two bytes long.
The terms you'll meet in the lessons, each with a short definition.
Quick answers to what people ask most before diving in.
No. Everything runs in Python in your browser. Nothing to install, no system tools, and every program you analyze is a few bytes embedded in the lesson.
Learning here is, because you only analyze programs we made for this purpose. Outside the site, the law varies by country, so stick to your own software, software whose license allows it, or practice challenges. Don't break into other people's software or get around its protection.
No. We start from the byte and work up to reading assembly step by step, and every instruction we use is in the quick reference above.
Python is a great tool for reading and processing bytes, and its standard library, with struct, zlib and hashlib, is enough to parse formats, undo simple encryption and build an emulator.
Challenges have fewer hints, and the grader checks the key your code computes against several hidden cases, so copying a ready-made answer won't work.
Yes. Pass all three stages of the Reverse Engineering exam and you get a mastery certificate in your name, just like the language exams.
The first lesson is short: you read the first bytes of a file and learn when reverse engineering is legitimate.