I'm a beginner currently learning C++, but I don't have a clear roadmap from someone experienced in the field. If anyone here has solid experience in game hacking, I'd really appreciate it if you could share the best learning path or resources to follow.

I've been doing RE since around high school. Started out with video game hacking as most people seem to. Fell in love with it. Since then I've done a few projects and put them in a repository: Reverse engineering a games scripting engine, using RTTI to discern class structure and scheme in another, and reverse engineering an Xbox One Controller's USB communication protocol to write my own device driver for it in Linux, as well as some other small projects.

I'm very familiar with Ghidra, Frida, writing C/C++, dipped my toes in Angr, and I've been reading up on Windows system internals.

I have my GI Bill benefits from my active duty time. I'm thinking of getting the GREM certification paid for using my GI Bill benefits and seeing if I'm able to land a job with that certification and some projects under my belt.

My question is how feasible this sounds to you good folks?

Hi. I run gameswiki.org which is a preservation project for old Touchscreen-based Arcade Machines.

We are currently looking for a DOS Reverse Engineer to hopefully remove some dongle checks from DOS-based versions of Megatouch and Photoplay Software.

The dongles are battery backed Dallas iButtons which are now nearing 25 years, while their expected life span is "over 10 years" according to Dallas \ Maxim.

We already have patches for Linux based versions of the Megatouch Software, and some DOS versions of Photoplay are already patched too (but some aren't).

We are in this for fun, but some compensation for your time can be arranged if needed.

Hi
I'm diving into Android reverse engineering with the goal of improving my skills in bug bounty hunting and mobile app security testing. I'm looking for a structured roadmap (beginner to advanced) and solid resources (tools, blogs, courses, labs, books, etc.) to learn effectively.

Some specific questions:

• What are the key topics and skills I should master in order?

• Which tools (like JADX, Ghidra, Frida, Objection, etc.) should I focus on and in what sequence?

• Are there any good practice apps or labs (like DVIA, UnCrackable, etc.) you'd recommend?

• Any languages I must learn before dive in (like C, Java, Smile, etc.)

• Any YouTube channels, writeups, or communities worth following?

Thanks in advance for any suggestions!

I'm looking for an open-source project revolving around reverse engineering, that I can contribute to. Some examples that I find interesting are console emulators, or something with the same spirit. I prefer a fairly active project, that is open for contributions.

Any suggestions please ?

what is the best reverse engineering course ? like on udemy or sans letme know thanksss

I need help with a simple solution or diagram on how can you make this idea of double windows work inside a car door. My simple findings are that some can make this work with a dedicated remote, more professional installers use the factory window button also these are 2 different windows

Could someone tell me why is r/REGames now private?

I'm in the process of ripping assets from a game, and every file I'm trying to rip is either a ".mdlb", ".ppdb", or ".anmb" format. I can't find the magic numbers of these file formats anywhere, because I'm guessing they were made up specifically for this game.

If anyone knows how to find the file formats magic number of a otherwise non existent file format, please let me know. And, if needed, I can post the hex somewhere. Thanks.

My goal is to work in reverse engineering. I made a roadmap of the skills I want to have.

These are not necessarily that stuff I need. e.g RISC-V and automata theory are just things that excite me.

I'd like to ask people working in the field what they'd add there, in terms of stuff you need to know.

Here's the link to the roadmap: https://www.mindomo.com/mindmap/goal-become-a-reverse-engineer-d8578e86232742a88aad1385c4fb4163

Mostly interested in solving crackmes for now. I looked into tools a bit and am interested in the differences between them. Here are all the options I'm considering:

• Ghidra

• x64dbg

• Binary Ninja

• IDA Pro 9.0 (ignoring the price)

• Cutter

• HyperDbg

Hello Everyone, I recently watched a YouTube video about how Mattel and Broderbund had included Spyware in early PC games they released in the late 90s called DSSAgent.exe. This would collect PC usage among other things. Many of these games I played as a child and still have the original discs at my parents' house. So I got to thinking, I wonder if it's possible to reverse engineer so that this executable would send information to a local server and I could see what data it actually was collecting. I don't have any experience with this, but I am familiar with virtual machines and have a Master's degree in Cybersecurity so I thought it would be a cool project to figure out and see what data I can retrieve. In the video, it stated the original servers were shut down, but I wondered if the EXE could be altered to point to a different IP or if I could simply edit my host file to NAT a different IP and then see if I can see data. Does this sound plausible?

Here is the original video:

https://youtu.be/0IryTDYGR78?si=dunbtrdMsmfBHaNo

I'm completely new to reverse engineering and I know very little about programming. Despite that, I'm fascinated by how software works under the hood. I want to understand how binaries are structured, how code becomes behavior, and maybe learn how to create patches and stuff.

Many say Assembly and C++ are essential, but I’m not sure if they’re the best place to start with almost no coding experience. Is that the right path, or is there a better way to build a solid foundation first?

This is just a hobby, but I want to approach it seriously and avoid wasting time on the wrong steps.

Any advice or beginner-friendly roadmaps would be really appreciated. Thanks!

I am trying reverse engineer a .kext file but it kept showing virtual function calls. need help to minimise this (or at least know where and what the function is)

Just to preface this before I get dunked on: I've been reversing since high school. Done multiple projects and am currently writing an IA-32 disassembler. This is purely a convenience tool to speed up productivity. Not to learn from.

Anyone have experience setting up a local GGUF to use as your own personal pseudo code summarizer? Anyone got any good models to recommend for this purpose? I'm using Qwen3-8B at the moment.

Last night I spent a few hours setting up a Ghidra extension in Jython that interfaces with a DeepSeekR1 model I downloaded (Qwen3-8B). It uses llama_cpp to route C pseudo code to the model, the model infers what it thinks the function does, sends it back, my extension creates a window with the response.

Pretty simple. But the responses are kind of hit-or-miss. Obviously Qwen3-8B being a smaller model for local use (~5GB) means it isn't gonna be as bright as its big brother. But I'm trying to figure out what model I can run on my PC that won't cause OOM but will still give decent insight.

As it is currently I have a 4 year old laptop with an RTX 3050, 12GB VRAM, 16GB RAM. My options are kind of limited. I've tried a couple of techniques. DeepSeekR1 likes to think out loud so to speak. The first 512 tokens are just its thought process 90% of the time without a concise answer. To fix this I just let it generate 512 tokens, reran it with the original prompt and its previous thought process, over and over until it either exceeds my maximum token amount of 4096 or returns a final answer.

This is fine, but even when allowing it to think for long amounts of time, it still produces subpar analysis.

The lighter is an arc lighter by bbq dragon. I want to use it as an ac input for a transformer. Any tips or ideas or warnings (besides getting shocked, obviously).

Hi reverse engineers!

Context
Pre-black friday deals, got my hands on a home battery at a great price.
I absolutely want to work with automations through home assistant and shelly.
There is an iOS and Android app, but no site or public API.
Found absolutely no data on this brand/model.

What I did
- downloaded the Android apk
- tampered the apk with apk-mitm to prepare for SSL inspection
- proxied the connexion with SSL decoding to find endpoint, routes, api keys, etc...
- wiresharked MQTT packets using PCAP remote and Lua dissectors (it was using MQTT over Websocket)
- decompiled the APK using apktool
- disassembled dex files to look at java classes
- figured out it was an encapsuled web app, looked at the web code which is obfuscated

Current situation
I have reversed engineered what I needed to, and I can freely fetch the web API.
I am also able to connect, subscribe and publish to the MQTT broker.
I am now stuck with one specific data format I'm getting, which is what I am the most interested in!
I can subscribe on the MQTT broker to get updates from the battery status (SoC, power in, power out, etc...)

On reception, raw data was:
PE E�E B�0@���Z����L�

After digging some hours, I was able to find out it was not any type of encryption, but an array of 8-bit unsigned integers. Using an Uint8Array, data now appears like this:

[17,4,0,0,0,80,0,0,0,0,0,1,0,0,0,0,0,0,0,69,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,69,1,244,0,69,9,66,19,133,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,69,0,0,8,14,0,0,0,0,0,0,0,0,0,0,48,0,64,0,0,0,0,0,0,0,0,180,0,0,1,132,0,0,3,232,0,0,0,0,90,240,0,0,0,0,0,255,255,255,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,76,143]

I was able to recognize two values, index 19 (value 69) and index 47 (value 70) which are the "Total input (w)" and "Total output (w)" because they follow the consumption I can read on the app.

The rest is not understandable to me yet. Even the SoC (state of charge), which I tracked down from 100% to 80% to look at changing values, but no success yet.

Looking at the web code gave me one last hint, because one specific function was refering to CRC16_MODBUS, which seems to be a standard protocol that provides client/server communication.

Anyone familiar with this, or taking the challenge with me?

The post may lack informations, but I have a private repository I can share if someone wants technical details.
Also, let me know if this topic doesn't belong here.

Super cell just announced that they ended development of my favorite mobile game, Clash Mini, and that they will turn off the Servers in 6 weeks.

I really want to keep playing though, so I decided, Id at least try to, create a custom Server. I made rough Plan on how to achieve this:

1. Use some packet sniffing App to capture packets sent by the game and hope theyre not encrypted.

2. Analyse packets to get rough overview of whats handled Server side and what Client side.

3. Setup a custom DNS Server to reroute traffic to my Server instead

4. Use an extensive amount of trial & error to somehow piece together a working backend.

5. Open source it and enjoy the game.

Now some of you may think, this is a gross underestimate of the actual work needed to do this, and youre probably right but I believe that even if I ultimately faul, this will be a great learning experience.

Im hoping somebody could point me to some stating point regarding these steps and overall Feedback on the achievability of this or other thoughts you have about this.

I've seen these three apps mentioned a lot. What should I be using?

I've made some recent attempts at hacking the Amazon Halo app to sniff out the bytes being exchanged with the Halo Band and View. I'd eventually like to make my own receiver on an embedded MCU as a sort of gateway for some IoT projects I've been working on. Sort of like "dumbing down" the app without all the other bells and whistles.

Using the VSCode extension APKTool, I was able to make the app debuggable, and then made some changes via smali-injection to enable some verbose logs for device activity. It appears that the View is using a combo of BLE and RFCOMM to communicate with the app based on a debug log I was able to generate with a bit of app modding.

I think I've reversed-engineered the app enough to identify the bytes being transmitted. Next, I'd like to try and "replay" these bytes to the View, I've tried using Nordic's nRF Connect app (for BLE advertisement sniffing) and the Serial Bluetooth Terminal apps on Android (for RFCOMM terminal emulation). The device refuses to connect through either method, but I can't quite grasp why that would be.

• nRF Connect: Bond with Halo View, View screen shows passcode. Confirm on device and app, and bond succeeds! Try "connect" to band, but connection hangs and times out.

• Serial App: Attempt connection both before and after bond, but connection failed (return value -1).

What I'm struggling with is the "why" behind the communication block and whether there is anything I can do from the app side to get past it. I suppose if something in the hardware is severing the connection, then that feels like a dead stop, but I'm not quite sure! Any advice on how I might be able to move forward or perhaps a better place to ask would be greatly appreciated!

I have a desktop application targeting .NET Framework 4.8 (x86), and Im trying to maximize its protection against reverse engineering while keeping performance impact as low as possible.

Current approach
• I use VMProtect
• I usually protect only critical parts
• In some cases I use mutation mode instead of full virtualization to reduce performance overhead

Most .NET obfuscators I’ve tested seem ineffective. some of them can be reversed or deobfuscated very easily. in some cases almost one click (like .NET Obfuscator)

I want to achieve:
• spaghetti code
• Reliable anti-tamp / anti-patch / etc protection
• Compatibility with VMProtect

Questions

1. What are currently considered robust obfuscation techniques/tools for .NET Framework apps?

2. Is it better to combine multiple obfuscators or focus on a single strong solution?

3. Are there recommended pipelines or best practices for combining IL obfuscation + native protection (VMProtect)?

Notes
• Im aware that no protection is unbreakable, but I want to significantly raise the effort required for reverse engineering

Any insights or real-world experience would be appreciated.