thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Reverse Engineering

Analyzing software to understand its design and behavior, typically by disassembling or decompiling compiled code.

Definition

In malware analysis, reverse engineering uses disassemblers and decompilers such as Ghidra, IDA Pro and Binary Ninja plus debuggers such as x64dbg to understand encryption routines, C2 protocols and capabilities. It is the most time-consuming but most complete form of analysis. The results inform signatures and decryptors.

Example

Using Ghidra to find the hardcoded RC4 key a sample uses to encrypt its C2 traffic.

Exam tip

Reverse engineering is advanced static analysis; know Ghidra (NSA, free) and IDA as standard tools.

Related terms