AwesomeREA.org

Learning resource

Z0FCourse Reverse Engineering

A free English course by Z0F on reverse engineering 64-bit Windows programs, which its README pitches as taking learners from beginner to intermediate. Markdown lessons move from number systems, x64 registers, memory layout and calling conventions to x64dbg and Ghidra, then reverse small samples and an author-written DLL, recovering a Player class and calling the DLL's exports from a program of one's own. The unfinished later chapters introduce Windows internals and reverse ntdll's generic-table functions.

Requirements and limitations

  • Reviewed at commit ee4b070 (2026-07-25). Most lessons were written in 2019–2020, and the table of contents marks Chapter 7 (Windows) and Chapter 8 (Generic Table) as work in progress; the .NET and other-architecture material promised by the setup and Before You Begin pages is not in the tree. Later commits are small fixes, formatting, refreshed PDF copies and new links. The README points to two TryHackMe rooms as an interactive version of chapters 1–6.
  • Chapter 1 lists a good understanding of C/C++, object-oriented programming and pointers as prerequisites and highly recommends prior x86/x64 assembly. The course needs a 64-bit Windows system, a virtual machine being optional until the malware material; setup names the Microsoft Visual C++ Redistributable, x64dbg (with the optional xAnalyzer plugin) and dnSpy or ILSpy as required, with Ghidra and Visual Studio highly recommended.
  • The target programs are the author's own and ship with their source in FilesNeeded: the Chapter 6 DLL with two host programs and debug symbols, plus a sample malware program and dropper for a chapter not yet written, which FilesNeeded marks as use-at-your-own-risk. Chapter 8 instead analyzes Windows's own ntdll.dll, which is not included. PDF copies of the chapters are also committed, and the README warns they may lag the Markdown lessons.
  • The repository's License.md is the AGPL-3.0 text; the FAQ adds that downloading is allowed for personal use only and defers redistribution and teaching use to the license. This collection read the README, setup, table of contents, FilesNeeded notes, FAQ and license at the reviewed commit; it did not work through the lessons or run the sample programs, and nothing in the course mentions AI or REA.

About this entry

Type
Learning resource
Category
Learning resources
Relationship
Learning resource
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · 0xZ0F/Z0FCourse_ReverseEngineering · Revision ee4b070
  2. TableOfContents.md GitHub · 0xZ0F/Z0FCourse_ReverseEngineering · Revision ee4b070
  3. Chapter%201%20-%20Introduction/1.0%20Introduction.md GitHub · 0xZ0F/Z0FCourse_ReverseEngineering · Revision ee4b070
  4. Chapter%201%20-%20Introduction/1.2%20Setup.md GitHub · 0xZ0F/Z0FCourse_ReverseEngineering · Revision ee4b070
  5. FilesNeeded/FilesNeeded.md GitHub · 0xZ0F/Z0FCourse_ReverseEngineering · Revision ee4b070
  6. Chapter%208%20-%20Generic%20Table/8.00%20GenericTable.md GitHub · 0xZ0F/Z0FCourse_ReverseEngineering · Revision ee4b070
  7. FAQ.md GitHub · 0xZ0F/Z0FCourse_ReverseEngineering · Revision ee4b070
  8. License.md GitHub · 0xZ0F/Z0FCourse_ReverseEngineering · Revision ee4b070