LAB-00Trivial
Toolchain Verification
Verify your reverse engineering toolchain is correctly installed and configured before starting the course.
5 min3 prerequisites7 tools
Hints
Hint 1
Check the 'Setting Up Your Arsenal' lesson for the tool list.
Hint 2
The debugger comes in x32 and x64 variants.
Hint 3
The magic number is found at the very start of every Windows executable.
Submit Findings
Solution
Toolchain Verification — Solution
- Ghidra — NSA's free reverse engineering framework (disassembler + decompiler). Requires JDK 17+.
- x64dbg — Open-source Windows debugger for 64-bit binaries (x32dbg for 32-bit).
- MZ — The DOS header magic bytes (
4D 5Ain hex) that mark a valid PE file. Named after Mark Zbikowski.
All three answers confirm you've absorbed the arsenal lesson. Your environment is ready.
Prerequisites
- s3-arsenal
- Basic command-line usage
- Windows/Linux/macOS environment
Methodology
Verification Checklist
1. Static Analysis Tooling
- Ghidra: NSA's free RE framework. Requires JDK 17+. Verify: launch
ghidraRun. - Binary Ninja / IDA Pro (optional): Commercial alternatives.
2. Dynamic Analysis Tooling
- x64dbg (Windows): 64-bit debugging, x32dbg for 32-bit.
- GDB / GEF / pwndbg (Linux): The GNU debugger with plugins.
- WinDbg (optional): Microsoft's kernel/user debugger.
3. PE/ELF Inspection
- PE-bear / CFF Explorer (Windows): PE header viewers.
- readelf / objdump (Linux): ELF inspection.
4. Utility Tooling
- strings: ASCII/Unicode extraction (built into most systems).
- file: File type identification.
- Hex editor (HxD, ImHex, 010 Editor).
5. Confirm Readiness
- All tools launch without error
- Paths/environment variables configured
- Sample binaries can be opened and inspected
Common Pitfalls
- Ghidra fails to launch without JDK 17+ installed
- Confusing x64dbg (64-bit) with x32dbg (32-bit)
- Assuming `strings` extracts Unicode by default (needs -el flag)
- Forgetting to add tools to PATH for command-line use
Tools
- Ghidra (disassembler/decompiler)
- x64dbg / x32dbg (Windows debugger)
- GDB / GEF / pwndbg (Linux debugger)
- PE-bear / CFF Explorer (PE viewer)
- readelf / objdump (ELF tools)
- strings / file (utilities)
- Hex editor (HxD / ImHex / 010 Editor)
References
- Lesson S3: Arsenal
- Ghidra Installation Guide
- x64dbg Documentation
- GDB Quick Reference
Extensions & Challenges
- Install and configure GEF or pwndbg for GDB
- Set up a Windows VM with x64dbg for dynamic analysis
- Install FLOSS and DIE (Detect It Easy) for later modules
- Create a tool aliases/script to launch your RE environment