A friend reverse-engineered how an application signs its network requests, and now I want to learn how to investigate things like that myself. I'm looking for beginner-friendly resources on reading hexadecimal, understanding assembly, disassembling binaries, and recognizing how an application constructs or authenticates network requests. I'd also appreciate guidance on tools and a sensible learning path.
3 Answers
Start with a disassembler or decompiler rather than trying to read raw bytes immediately. Ghidra is a solid general-purpose option, while ILSpy or dnSpy are useful for .NET binaries and JADX works well for Android apps and Java/Kotlin code. Learning how to identify functions, strings, imports, and control flow will make the assembly much easier to understand.
A good progression is: learn binary and hexadecimal notation, study a small assembly language such as x86-64, learn basic C compilation and debugging, then work through small reversing exercises with Ghidra or a debugger. Looking at symbols, strings, and name or memory tables can provide useful clues about what a function does, even when the original source code is unavailable.
Keep in mind that reverse-engineering a request signature usually isn’t the same as breaking TLS or cracking modern cryptography. An application may simply contain a locally stored key or use a custom signing scheme, allowing someone to reproduce the app’s request format. If the goal is to learn, practice on software you own or have permission to analyze, and begin with basic CPU architecture, hexadecimal, memory, calling conventions, and assembly.
Exactly. If the app has access to a signing key locally, the interesting part is often understanding how it formats the request and feeds data into the signing routine—not defeating the underlying cryptographic algorithm.