> For the complete documentation index, see [llms.txt](https://blog.conspirator.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.conspirator.io/ctf-wiki/re.md).

# RE

making sense of stuff

* run strings, strace, trace execution path in graph view (maybe get trace through gdb), get class list/function list
* patch the binary for log messages
* recognize crypto by looking up constants
* have some unpackers ready (eg for UPX)
* get a list of function names / class names as an overview
* find main
* look for refs to relevant strings(shift+f12) in the code (xref shortcut: x)
* use placeholder names (eg. fruits) for unknown functions to make them recognizable

Decomplicate in ida:

* use group nodes functionality
* rename stuff.. (shortcut: n)
* retype stuff.. (shortcut: y)

Other valid strategies:

* reengineer the code, recompile it
* clever hooks instead of tedious reversing

dynamic approaches:

* breakpoints at all functions, run and see what breakpoints remain