Reverse › Module 9 › Lesson 1
Note Discipline
RE note discipline — UTC timestamps, hash headers, tool versions, hypothesis/result pairs on $RE_LAB; chmod 600 private notes.
Visual · t23_note_discipline
Note discipline = reproducible RE notes. $RE_LAB. Original Cyberlium.
Opening
Future you forgot the breakpoint address — notes are how you do not solve the same crackme twice like a amnesiac.
RE note discipline mirrors malware analysis rigor adapted for reverse engineering: every session opens with binary SHA256, file type, $RE_LAB VM name, UTC start, tools and versions (Ghidra, GDB, objdump). Log hypothesis → test → result rows; paste addresses as VA and file offset when patching; separate observed vs inferred; never mix commercial piracy attempts into lab notebook. Store under $HOME/cyberlium-lab/re-notes chmod 600 — no cloud sync of crackme folders to personal Drive. Cyberlium teaches habits that survive CTF deadlines and capstone review — not chaotic Discord screenshots without context.
1. Session header template
UTC date, binary hash, source URL/crackme author, tools, $RE_LAB host, scope line (no piracy).
One header per session — do not append unrelated binaries to same file.
Command guide
Try these commands — Session header template
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
RE note discipline — https://ghidra.re/courses/GhidraClass/ (document hypotheses and evidence) GNU binutils — https://sourceware.org/binutils/docs/binutils/ (record exact commands) LiveOverflow — https://www.youtube.com/c/LiveOverflow (show-your-work mindset)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
mkdir -p "$LAB_RE/notes"
cat > "$LAB_RE/notes/note-template.txt" <<'EOF'
target: YOUR gcc toy path
static: file/strings/objdump/readelf commands + output
dynamic: gdb breakpoints + observations
conclusion: key/algorithm — crackmes/YOUR toys only
EOFCommand — copy this
grep -E 'static|dynamic|conclusion' "$LAB_RE/notes/note-template.txt"
Primary tools to practice this lesson: python3, grep. Reference sites: RE note discipline (https://ghidra.re/courses/GhidraClass/); GNU binutils (https://sourceware.org/binutils/docs/binutils/); LiveOverflow (https://www.youtube.com/c/LiveOverflow). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Hypothesis rows
Format: H1: compare at 0x401234 → test breakpoint → result: je taken, flag wrong.
Failed hypotheses are valuable — log them; do not erase to look smart.
3. Storage hygiene
chmod 600; separate piracy-refused attempts should not exist — if tempted, write refusal instead.
Index file lists sessions by hash for capstone evidence pack.
4. What you ship: note discipline template
Session header + hypothesis row format + storage path + scope line.
5. What you record before the next lesson
Note discipline template path.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
RE notes scattered in Discord DMs with live serials and no hash.
Right
Note discipline template adopted for $RE_LAB. Next: Findings Writeup.
Mission: note discipline template
1) Write session header fields. 2) Write hypothesis row format. 3) Set storage path chmod 600. 4) Add no-piracy scope line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “One file vs folder per crackme?”
Knowledge Check
APPLY: RE notes should open with:
Multiple choice
Knowledge Check
APPLY: True or False: Mix undocumented piracy attempts into lab notebook.
True or False
Knowledge Check
APPLY: Failed hypotheses should be:
Multiple choice