LKS Reverse Engineering Toolkit

x86/x64 Register Reference

64-bit	32-bit	16-bit	8-bit	Purpose
`rax`	`eax`	`ax`	`al`	Return value, syscall number
`rbx`	`ebx`	`bx`	`bl`	Base pointer (preserved)
`rcx`	`ecx`	`cx`	`cl`	Counter, 4th arg (Windows)
`rdx`	`edx`	`dx`	`dl`	3rd arg, I/O port
`rsi`	`esi`	`si`	`sil`	2nd arg, source index
`rdi`	`edi`	`di`	`dil`	1st arg, destination index
`rbp`	`ebp`	`bp`	`bpl`	Base/frame pointer
`rsp`	`esp`	`sp`	`spl`	Stack pointer
`rip`	`eip`	`ip`	-	Instruction pointer
`r8-r15`	`r8d-r15d`	`r8w-r15w`	`r8b-r15b`	Additional registers

Calling Conventions

Convention	Args Order	Return
Linux x64 (System V)	`rdi, rsi, rdx, rcx, r8, r9`	`rax`
Windows x64	`rcx, rdx, r8, r9`	`rax`
Linux x86 (cdecl)	`stack (right to left)`	`eax`
Linux syscall x64	`rdi, rsi, rdx, r10, r8, r9`	`rax`

Common Instructions

Instruction	Description
`mov dst, src`	Copy src to dst
`lea dst, [addr]`	Load effective address
`push/pop`	Stack operations
`call/ret`	Function call/return
`jmp/je/jne/jl/jg`	Jumps (unconditional/conditional)
`cmp a, b`	Compare (sets flags)
`test a, b`	Bitwise AND (sets flags)
`xor a, a`	Zero register
`nop`	No operation
`syscall/int 0x80`	System call

Assembly Converter

ELF Header Structure

Offset	Field	Size	Description
0x00	`e_ident`	16	Magic: 7F 45 4C 46 (ELF)
0x10	`e_type`	2	1=REL, 2=EXEC, 3=DYN
0x12	`e_machine`	2	3=x86, 0x3E=x64
0x18	`e_entry`	8	Entry point address
0x20	`e_phoff`	8	Program header offset
0x28	`e_shoff`	8	Section header offset

Common Sections

Section	Description
`.text`	Executable code
`.data`	Initialized data
`.bss`	Uninitialized data
`.rodata`	Read-only data (strings)
`.plt/.got`	Dynamic linking
`.symtab`	Symbol table
`.strtab`	String table

Security Protections

Protection	Check	Description
NX/DEP	Linux`readelf -l \| grep GNU_STACK`	Non-executable stack
CANARY	Linux`checksec binary`	Stack canary protection
PIE	Linux`file binary`	Position Independent Executable
RELRO	Linux`checksec binary`	Relocation Read-Only
ASLR	Linux`cat /proc/sys/kernel/randomize_va_space`	Address Space Layout Randomization

XOR Decoder

Encrypted (hex)

Key (hex or text)

Base Converter

Input

From Base

String Deobfuscation Patterns

Pattern	Example
XOR single byte	`for(i=0;i<len;i++) s[i]^=key;`
XOR key array	`s[i]^=key[i%keylen];`
ROT/Caesar	`s[i]=(s[i]-'a'+n)%26+'a';`
Base64 + XOR	Decode base64 first, then XOR
Stack strings	`mov [rbp-8], 0x6c6c6548`
Anti-debug	`ptrace(PTRACE_TRACEME)`

APK Analysis

Task	Command
Unpack APK	Any`apktool d app.apk`
Repack APK	Any`apktool b folder -o new.apk`
Sign APK	Any`jarsigner -keystore key.jks new.apk alias`
Decompile	Any`jadx -d out app.apk`
Convert DEX	Any`d2j-dex2jar app.apk`
View manifest	Any`aapt dump badging app.apk`

Smali Reference

Type	Smali
void	`V`
int	`I`
boolean	`Z`
String	`Ljava/lang/String;`
array	`[I` (int[]), `[Ljava/lang/String;`
method call	`invoke-virtual {p0}, Lclass;->method()V`

Frida Hooks

// Hook function
Java.perform(function() {
    var cls = Java.use("com.example.MainActivity");
    cls.checkFlag.implementation = function(s) {
        console.log("Input: " + s);
        var result = this.checkFlag(s);
        console.log("Result: " + result);
        return result;
    };
});

Essential RE Tools

Ghidra (NSA) IDA Free Binary Ninja Cutter (radare2) Dogbolt (Online) ODA Online

Android Tools

APKTool JADX Frida dex2jar

GDB Commands

Command	Description
Linux`gdb ./binary`	Start GDB
Linux`r / run`	Run program
Linux`b *0x401234`	Set breakpoint
Linux`b main`	Break at function
Linux`c / continue`	Continue execution
Linux`ni / si`	Next/step instruction
Linux`x/20x $rsp`	Examine memory
Linux`x/s 0x402000`	Print string
Linux`info registers`	Show registers
Linux`disas main`	Disassemble function
Linux`set $rax=0`	Modify register
Linux`vmmap`	Memory map (pwndbg)

Analysis Commands

Task	Command
File type	Linux`file binary`
Strings	Linux`strings binary \| grep -i flag`
Security	Linux`checksec binary`
Symbols	Linux`nm binary`
Dynamic libs	Linux`ldd binary`
Headers	Linux`readelf -h binary`
Sections	Linux`readelf -S binary`
Hex dump	Linux`xxd binary \| head`
Disassemble	Linux`objdump -d binary`
Trace syscalls	Linux`strace ./binary`
Library calls	Linux`ltrace ./binary`