Reverse engineering, often shortened to reversing or RE, is the CTF category of analyzing a compiled program without its source code to understand its behavior and recover a hidden flag or secret. You work from a binary, bytecode or firmware image and rebuild the logic by reading it.
Example
You download checker, an executable that asks for a password. Running strings checker shows nothing useful. In a decompiler you find a loop that XORs each input byte with 0x5A and compares the result with a stored array. You XOR the stored array with the same key, read the password and submit it as the flag.
A starting workflow
- Run
fileto learn the format and architecture. - Run
stringsfor readable clues. - Open the binary in Ghidra, IDA Free or radare2 and read
main. - Confirm your idea by running it in gdb.
Reversing is the base for pwn and for malware analysis in real work.
On CTF7
Reversing challenges ship as downloadable attachments. Organizers can use dynamic scoring so an easy find loses value as solves accumulate, and tiered hints for stuck teams. Practice on Ouroboros CTF or in War Zone.
Learn more
Read the reverse engineering guide for worked examples and tools, or browse all CTF guides.
Related terms
Browse the full CTF and cybersecurity glossary for more terms.
