4.2 KiB

Raw Blame History

Reverse-Engineering Pedagogy Research

Source: the design of the predecessor rveng plus how the five modules actually teach. The goal is a machine-checkable version of the same solve-then-reveal loop, so the platform can grade a learner instead of just handing them tools.

The solve-then-reveal loop

The predecessor's model, kept intact:

A module teaches one skill through a short concept note.
A challenge gives a compiled binary and a mission ("find the magic number").
The learner uses the tools (now in-browser) to solve it.
After solving, the original C source is revealed so the learner connects the machine-level evidence back to the code that produced it.

Revealing source only after a correct answer is what makes the loop teach. The learner must reach the answer from the binary, then gets to see they were right and why. This requires the answer to be checkable before the reveal, which the predecessor could not do (it just trusted the learner). The platform grades.

Answer-spec categories (what the verifier must grade)

Every challenge needs a machine-checkable answer. Three categories cover all five modules, each grounded in the sample gate binary:

found-value : the learner locates a value in the binary and submits it. Example: the magic number in check() is 0x539 = 1337, read from cmp DWORD PTR [rbp-0x4],0x539. The verifier accepts the value in decimal or hex, normalized before comparison. Also covers finding a string (the_flag_is_here at .rodata 0x402004) or an offset.
identified-symbol : the learner names a function, section, or symbol. Example: "which function decides the outcome?" answer check (at 0x401146, size 30 in .symtab). The verifier compares against the known symbol name, case-insensitive.
patched-bytes : the learner changes bytes to alter behavior and submits the patched byte range. Example: flip the gate by changing the jne (opcode 75) at 0x401154 so the unlock path is always taken. The verifier diffs the submission against a known-good patched target statically. It never runs the result.

Module to category mapping

#	Module	Skill	Answer category
01	hex-reading	read hex dumps, locate values	found-value
02	elf-anatomy	header, sections, entry point	found-value / identified-symbol
03	patching	change bytes, change behavior	patched-bytes
04	strings-symbols	find names and strings	found-value / identified-symbol
05	disassembly	read assembly, find the gate	found-value

What makes a good challenge per module

hex-reading: a value or ASCII string is visible in the hex dump at a findable offset. The learner practices reading offsets and the ASCII gutter.
elf-anatomy: the answer is a header field or a section fact (entry point, which section holds a string, how many sections). Teaches the file's skeleton.
patching: a single conditional jump or comparison gates behavior; a one-to-few-byte edit changes the outcome. Teaches that behavior is bytes.
strings-symbols: a password or a function name is recoverable from .rodata or .symtab without disassembly. Teaches the cheap wins before the hard work.
disassembly: symbols may be stripped so the learner must read the cmp/jcc gate directly. Teaches assembly as ground truth when names are gone.

Grading rules

found-value: normalize both sides to an integer when numeric (accept 0x539, 539h, 1337), or exact-match after trim/lowercase when a string.
identified-symbol: exact match after trim/lowercase against the known name.
patched-bytes: the submitted bytes, applied at the specified offset to the original, must equal the known-good patched target under a static byte diff. No execution, ever.

Facts an adversarial check confirmed

Confirmed against the real binary: the magic number is 0x539 (1337), the deciding function is check at 0x401146, and the gate is the jne at 0x401154. These are the concrete answers the sample's challenges grade.
The reveal-after-solve ordering is the load-bearing pedagogy: source is withheld until a correct submission, which is only possible because every answer is machine-checkable.

4.2 KiB Raw Blame History