Volume 2 feedbacks

[kynex7510]

Volume 2 of the handbook, "Reverse Engineering", is still being worked on; nonetheless, I'd like to leave some suggestions for improving it, especially for those with less experience.

What I consider to be the biggest issue with the current volume is that many topics are mixed together and not described propertly.

• The first chapter limits itself to listing the tooling required, it doesn't explain what they're used for, nor the difference (for example, Ghidra and IDA are disassemblers, x32dbg and LLDB are debuggers, etc.). Another problem is that Ghidra, the tool used in the chapter, is not well introduced, and instead the reader is asked to follow predefined steps ("click this", "select that").

• The second chapter attempts to explain how to find a function in the windows binary through RTTI metadata and vtables. At the end function signatures (and thus calling conventions) are mentioned. This is a lot to unpack for a "first time", a better approach would be that of

  • Using the android binary to locate a particular function (possibly non virtual);
  • Briefly mention assembly (if not done before with the introduction to Ghidra) and introduce the reader to pseudocode;
  • Instruct the reader about cross references (both code & data);
  • Instruct the reader about code matching with the windows version.

• Additional, more advanced topics, such as RTTI, VTables, calling conventions, DB hygene (function naming, custom types) should be introduced in their own chapters.

• To avoid being excessively verbose, anything that would be outside the scope of the volume (GD modding is assumed) should be redirected to external sources.