## RE Fundamentals: The Art of Dissection

**Reverse Engineering (RE)** is taking apart a system to understand how it works. In malware analysis, it means turning a compiled binary (`.exe`) back into readable logic (Assembly/C).

### Compiled vs. Interpreted
*   **Interpreted (Python/JS)**: You receive the source code. Analysis is just "reading".
*   **Compiled (C/C++/Go)**: The source code is translated into **Machine Code** (0s and 1s) by a compiler. You cannot see variable names or comments.

### The Tools of the Trade
1.  **Disassembler**: Translates Machine Code (Hex) into **Assembly Language** (ASM).
    *   *Tool*: IDA Pro, Ghidra (Free, by NSA).
    *   *Output*: `MOV EAX, 1` (Move 1 into Register EAX).
2.  **Decompiler**: Attempts to translate ASM back into pseudo-C code.
    *   *Tool*: Ghidra, Hex-Rays.
    *   *Output*: `if (variable1 == 1) { download_virus(); }`
    *   *Note*: It is never 100% accurate, but it is much easier to read than ASM.
3.  **Debugger**: Runs the code step-by-step (Dynamic).
    *   *Tool*: x64dbg (Windows), GDB (Linux).
    *   *Action*: "Pause execution right before it encrypts the file so I can see the key in memory."

### The Goal of RE
You are not trying to re-write the source code. You are trying to answer specific questions:
1.  Does it contain a Domain Generation Algorithm (DGA)?
2.  What is the hardcoded C2 IP?
3.  How does it bypass the Anti-Virus?