A map of reverse engineering and malware analysis that's actually been read. Every link was opened and checked before it went in, and it gets pulled the moment it rots - no dead pages, no one-word notes, no "great resource!" filler. unpacked covers all of it: static and dynamic analysis, unpacking, exploit development, fuzzing, firmware, mobile, OS internals, DFIR, and threat intelligence, plus the researcher blogs and one-off writeups the big lists skip.
Every entry says what it is and who it's for. Tags mark the level (intro working deep), the
type (tool blog writeup course video paper book), and anything to know before you click
(paid signup archived, or a language code like zh ru when it isn't in English).
New here? Don't read top to bottom. Pick a track - each is an ordered path from nothing to competent, built from entries in the sections below. Tracks land as their sections do.
- Windows malware analysis - setup and safe handling -> triage -> static -> dynamic -> unpacking -> config extraction.
- Linux / ELF reversing - ELF internals -> tooling -> static and dynamic analysis -> real samples.
- Exploit development - memory bugs -> stack and heap -> modern mitigations and bypasses.
- Firmware & embedded - extraction -> architectures -> emulation -> hardware.
- Mobile - Android and iOS app internals, instrumentation, and unpacking.
- Anti-analysis - obfuscation, packers, anti-debug, anti-VM, and how to beat them.
The full taxonomy. Researcher blogs and standout writeups aren't a separate page - each is embedded in the section it belongs to, so the niche shows up in context.
- Foundations - assembly, CPU architectures (x86-64, ARM), calling conventions, executable formats (PE, ELF, Mach-O)
- Reverse engineering - static and dynamic analysis; IDA, Ghidra, Binary Ninja, radare2, x64dbg; decompilers, debuggers, frameworks
- Malware analysis - triage, static, dynamic, sandboxing, unpacking, config extraction, YARA, C2, family tracking
- Malware development - injection, evasion, and reading real source (study/lab)
- Exploit development - memory corruption, stack and heap, browsers, kernel, mitigation bypasses
- Fuzzing - coverage-guided (AFL++, libFuzzer), harnessing, corpus, research
- Firmware & embedded - extraction, emulation, architectures, hardware attacks
- Mobile - Android, iOS
- OS internals - Windows, Linux, macOS, kernel
- Anti-analysis - obfuscation, packing, anti-debug, anti-VM
- Living off the land - the LOLBAS/GTFOBins family: abusing what's already installed
- DFIR - memory forensics, disk, timelines, incident response
- Threat intelligence - reporting, feeds, tracking
- Learning, CTFs & wargames - challenges and practice platforms
Where reversers actually post first. Some aren't in English. Worth it anyway.
- Kanxue (看雪) - the largest Chinese RE community; deep threads on packers, VMProtect, and Windows internals.
zh - 52pojie (吾爱破解) - a huge Chinese cracking and RE forum, thick with tools and tutorials.
zh - Tuts 4 You - the long-running unpacking and RE forum, and a classic crackme/tutorial archive.
- WASM - the Russian assembler and reversing forum; crackmes, drivers, and kernel threads going back two decades.
ru - Reverse Engineering Stack Exchange - the Q&A site for RE. When a decompiler output makes no sense or a construct won't resolve, someone has usually already asked.
- 0x00sec - a forum for malware development, RE, and exploitation, with in-depth member writeups.
- back.engineering - the group behind VMProtect devirtualization research (VTIL).
- r/ReverseEngineering - the main RE subreddit; new research and writeups surface here first.
- r/Malware - malware analysis discussion and questions.
The old lists taught a lot of us, and some still hold up. Most have just rotted - dead links, one-word notes, nothing a beginner can follow, no commit in years. This one keeps what they got right and fixes the rest, and it doesn't go stale.
Found something dead, wrong, or missing? Open an issue or a PR.
CC0 1.0. Public domain. Take it.