Reading a disassembly

A disassembly listing looks intimidating because it is dense, not because it is deep. Almost every "where is X?" question in RE is answered by the same five moves. Learn them once and every listing — and every agent report — becomes readable.

the five moves

1. Entry point — find main (or the real start) to orient yourself.
2. Strings — interesting text ("error", filenames, prompts) marks interesting functions.
3. Cross-references — who references that string or function? Xrefs are the map.
4. Calls — what a function calls tells you what it does (printf, open, malloc).
5. Loops — backward jumps. A backward jump is a loop; loops are where logic lives.

This lesson runs two real experiments on the binary from lesson 2 — with the training wheels removed.

experiment A: strip the names, keep the logic

Shipping binaries usually have no symbol table. Simulate it, then look for the secret function again:

$ cp hello hello-stripped && strip hello-stripped
$ readelf -s hello-stripped
Symbol table '.dynsym' contains 4 entries:   # .symtab 已删，secret/main 无名

No names left. But strip deletes labels, not code — and lesson 2 taught you that secret contains a very distinctive constant. Anchor on it:

$ objdump -d -M intel hello-stripped | grep -B2 -A9 'imul.*0x539'
  400410: 69 c0 39 05 00 00  imul eax,eax,0x539
  400416: 83 c0 07           add  eax,0x7
  ...
  40041f: bf 2a 00 00 00     mov  edi,0x2a          ; 42，唯一调用点传参
  400424: e8 dd ff ff ff     call 400406 <printf@plt+0xf6>  ; 无名函数重定位表示

Notice what just happened: you found an anonymous function by its fingerprint (imul …,0x539), recovered its logic, and even found its only call site (mov edi,0x2a — the 42 being passed in). The one rough edge: without symbols, call targets print as relative expressions like <printf@plt+0xf6>. That is the first wall every beginner hits with stripped binaries, and the fix is always the same: anchor constants, xrefs, and patience.

experiment B: strings are the fastest evidence

Sometimes you do not need the disassembly at all. A tiny program with a hidden message:

const char* msg="MAGIC_KEY_12345"; int main(){return 0;}
$ gcc -O0 -o key key.c
$ strings key | grep MAGIC
MAGIC_KEY_12345

strings sweeps every plaintext constant in the binary in under a minute. But do not over-trust it: the ×1337+7 logic from lesson 2 contains nothing greppable — no strings pass would ever find it. Strings and disassembly are complementary witnesses; good analysis cross-examines both.

from listing to agent

You now have the complete beginner toolkit: identify (file), map (readelf), read (objdump), anchor (constants), and sweep (strings). This is exactly the baseline that makes AI agents trustworthy — when REA reports "the logic is in function at 0x400406", you can open the listing and check, anchor by anchor. Agents are force multipliers for analysts who can audit them, not replacements.

That is the end of the track. Next stop: the REA setup guide — install the agent, wire it over MCP, light up its free engine, and produce your first evidence-backed analysis of this same binary.