# rveng Domain Research Archive Reverse-engineering-platform research: the ELF file format, x86-64 disassembly via capstone, the solve-then-reveal teaching model, and the no-execution security posture. Every field size, offset, opcode, and disassembly line is cross-checked against a real binary compiled locally (`gate`, built with `gcc -no-pie -fno-stack-protector -O0`), not taken from memory or a generic diagram. Each doc carries the VERIFIED fact where an adversarial check overruled the first pass. Honest grounding to keep across all of these: the engine reads bytes, it never executes them. Challenge binaries are curated and pre-compiled; all analysis is read-only static parsing and disassembly; patch challenges are graded by static byte diff against a known-good target. This is what makes a web app that eats binaries safe, and it is a hard constraint, not a preference. | File | Read when | |---|---| | `01-elf-format.md` | implementing `engine/elf.py`: the Elf64 header field table with raw-byte cross-check, section/segment/symbol tables, NOBITS handling, what we hand-roll vs delegate to pyelftools, why the challenges are `-no-pie` | | `02-x86-64-capstone.md` | implementing `engine/disasm.py`: the minimal x86-64 instruction set these challenges use, the cmp/jcc gate pattern, capstone 5.0.9 API, the objdump-vs-capstone byte-for-byte agreement KAT, the Intel-syntax constant correction | | `03-pedagogy.md` | implementing `engine/challenge.py` and the runner: the solve-then-reveal loop, the three answer-spec categories (found-value, identified-symbol, patched-bytes), module-to-category mapping, grading rules | | `04-no-execution-posture.md` | any API or engine work touching binaries: the enumeration proving every operation is read-only, why patch grading is a static diff, the API input constraints, the standing no-execution rule | Key verified facts pulled forward: - ELF header cross-checks exactly to raw bytes: entry `0x401060`, e_shoff `0x36a0` (13984), e_shnum 30, e_ident `7f 45 4c 46 02 01 01`. - The sample gate: `check` at `0x401146` (size 30), magic `cmp ...,0x539` = 1337 at `0x40114d`, gate `jne` at `0x401154`, secret `the_flag_is_here` at .rodata `0x402004`. - capstone 5.0.9 reproduces objdump Intel disassembly byte-for-byte; `CS_OPT_SYNTAX_INTEL` is 1 (not 4, which is MASM), and Intel is already the x86 default. Build contract and full architecture: `../plans/rveng-design.md`. Implementation plan: `../plans/rveng-implementation-plan.md`.