What is reverse engineering?

Every program you run started as source code and became a binary. Reverse engineering is reading that story backwards: from the bytes on disk, recovering what the program does. It is the same skill whether the question is "how does this game decide a ball bounced", "why does this library crash on my input", or "is this firmware doing what its vendor claims".

the three layers

• Static analysis — examine the binary without running it: sections, strings, disassembly, decompiled pseudo-code.
• Dynamic analysis — run it under observation: debuggers, traces, breaking at interesting points.
• Agent-assisted analysis — an AI agent (like REA) drives the two above for you, following cross-references and capturing evidence.

Agents changed the cost of RE, not its nature. The agent can walk a cross-reference graph in seconds — but you still need to know what a cross-reference means to judge whether its answer is right. That judgment is what this track builds.

is this… allowed?

In most jurisdictions, RE for interoperability, security research, and education is lawful — in some it is expressly protected. What creates legal exposure is the target and intent: defeating protections or license checks, or poking at systems you have no authorization to touch. Our discipline on this site: only analyze software you own or are licensed to inspect — open source, official demos, or authorized targets. Every lesson here follows it, and you should too. For the practical version of this rule, see lesson 2.

reverse engineering is already running on your machine

Here is the part nobody tells beginners: you do not need to hunt for a shady target. Your operating system ships with a large, legitimately analyzable binary right now. OpenSSL's libcrypto — the library doing the crypto behind your HTTPS connections — is open source (Apache-2.0), which means the license itself grants analysis rights. Let's confirm what it is (outputs from our lab, run 2026-10-12):

$ openssl version
OpenSSL 3.0.12 24 Oct 2023 (Library: OpenSSL 3.0.12 24 Oct 2023)
$ ls -la /usr/lib64/libcrypto.so.3
→ libcrypto.so.3.0.12（4.5MB）

First static probe — open-source software states its own identity in plaintext:

$ strings -a /usr/lib64/libcrypto.so.3 | grep -m3 'OpenSSL [0-9]'
OpenSSL 3.0.12 24 Oct 2023

Now the dependency map — the program's supply-chain manifest, straight out of the binary:

$ readelf -d /usr/bin/openssl | grep NEEDED
  Shared library: [libssl.so.3]
  Shared library: [libcrypto.so.3]
  Shared library: [libc.so.6]

That last block is dynamic linking in one picture: the openssl CLI is a small entry point; the 4.5MB libcrypto is the real body. Open source does not mean "no binaries" — it means the license gives you the right to look inside them. When an AI agent inspects this same library later, the REA toolchain treats it like any other ELF; its deep analysis still requires an engine, and it fails closed rather than guessing (we show this in the setup guide).

In the next lesson we go from reading a system library to picking your own first target — one with zero legal ambiguity, because you build it yourself.