Labs
Hands-on challenges that run entirely in your browser. Each lab is paired with a course lesson.
Toolchain Verification
Verify your reverse engineering toolchain is correctly installed and configured before starting the course.
Hidden String Hunt
A small binary contains an obscured string that reveals its true purpose. Use static analysis to locate and extract it.
Suspicious API Identification
A binary's import table reveals its capability. Identify which imported APIs indicate keystroke-capture behavior.
Control Flow Tracing
Trace a short assembly routine step-by-step and determine the final register state and taken branch.
Advanced String Hunt
Extract the C2 URL, persistence key, and mutex name from a binary using string analysis.
Import Table Analysis
Read the import table to determine what capability a binary requests.
Cross-Reference Tracing
Trace cross references to determine which function references an interesting string and how it is reached.
Decompiler Output
Match decompiler pseudocode to the underlying assembly and verify the logic.
Where to Break
Choose strategic breakpoint locations to answer a question about a validation routine.
Execution Trace
Trace a loop to determine its final state without stepping every iteration.
Anti-Debug Bypass
Identify an anti-debugging check and determine how to bypass it.
PE Header Forensics
Inspect a PE header to find structural anomalies that indicate tampering or packing.
DLL Import & Load Order
Analyze a binary's DLL imports and identify a DLL search-order hijacking opportunity.
Suspicious API Chains
Read a binary's API imports as a capability narrative and determine its likely behavior.
Persistence Detection
Identify persistence mechanisms from strings and imports.
C2 Configuration Extraction
Extract the command-and-control configuration from a sample's strings.
Packer Identification
Identify a packed binary and determine which packer was used.
IOC Extraction
Extract the full indicator-of-compromise profile from a sample.
Call Stack Reconstruction
Reconstruct the stack frame of a simple function from its prologue and epilogue.
Stack Smash Analysis
Given a vulnerable function's disassembly, determine exactly how many bytes of overflow it takes to reach the saved return address.
ELF Header Forensics
Walk a raw ELF64 header byte-by-byte and pull out the fields a loader relies on to map and run the file.
ARM64 Register Trace
Trace a short AArch64 routine by hand and determine the final register state and how many times its loop executes.
Manual Unpacking Challenge
Go past packer identification: reason about what the compressed payload region implies, and what it takes to actually recover the unpacked code.
The Unknown Binary
Investigate a full-size, ~1 MB unknown binary end to end: static triage, import capability mapping, a real anti-debug branch, stack-frame and calling-convention reading, and a hand-decoded second-stage flag hidden the way lab-01 taught you to look. The disassembly is genuine — real x86-64 machine code, independently assembled and disassembled, not hand-written pseudocode — so its hex addresses, hex immediates, and symbol-annotated branches read exactly like real objdump/Ghidra output. Nothing here is visible on the first screen — you'll need the hex viewer's Find and Go-to-offset tools, not eyeballing. Every skill from the course applies.