Note Discipline

RE note discipline — UTC timestamps, hash headers, tool versions, hypothesis/result pairs on $RE_LAB; chmod 600 private notes.

Note Discipline• Audio Walkthrough

00:00/03:04

Visual · t23_note_discipline

Note discipline = reproducible RE notes. $RE_LAB. Original Cyberlium.

Future you forgot the breakpoint address — notes are how you do not solve the same crackme twice like a amnesiac.

RE note discipline mirrors malware analysis rigor adapted for reverse engineering: every session opens with binary SHA256, file type, $RE_LAB VM name, UTC start, tools and versions (Ghidra, GDB, objdump). Log hypothesis → test → result rows; paste addresses as VA and file offset when patching; separate observed vs inferred; never mix commercial piracy attempts into lab notebook. Store under $HOME/cyberlium-lab/re-notes chmod 600 — no cloud sync of crackme folders to personal Drive. Cyberlium teaches habits that survive CTF deadlines and capstone review — not chaotic Discord screenshots without context.

1. Session header template

UTC date, binary hash, source URL/crackme author, tools, $RE_LAB host, scope line (no piracy).

One header per session — do not append unrelated binaries to same file.

Command guide

Try these commands — Session header template

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

RE note discipline — https://ghidra.re/courses/GhidraClass/ (document hypotheses and evidence) GNU binutils — https://sourceware.org/binutils/docs/binutils/ (record exact commands) LiveOverflow — https://www.youtube.com/c/LiveOverflow (show-your-work mindset)

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
mkdir -p "$LAB_RE/notes"
cat > "$LAB_RE/notes/note-template.txt" <<'EOF'
target: YOUR gcc toy path
static: file/strings/objdump/readelf commands + output
dynamic: gdb breakpoints + observations
conclusion: key/algorithm — crackmes/YOUR toys only
EOF

Command — copy this

grep -E 'static|dynamic|conclusion' "$LAB_RE/notes/note-template.txt"

Primary tools to practice this lesson: python3, grep. Reference sites: RE note discipline (https://ghidra.re/courses/GhidraClass/); GNU binutils (https://sourceware.org/binutils/docs/binutils/); LiveOverflow (https://www.youtube.com/c/LiveOverflow). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Hypothesis rows

Format: H1: compare at 0x401234 → test breakpoint → result: je taken, flag wrong.

Failed hypotheses are valuable — log them; do not erase to look smart.

3. Storage hygiene

chmod 600; separate piracy-refused attempts should not exist — if tempted, write refusal instead.

Index file lists sessions by hash for capstone evidence pack.

4. What you ship: note discipline template

Session header + hypothesis row format + storage path + scope line.

5. What you record before the next lesson

Note discipline template path.

6. Wrong vs right: commercial piracy vs crackmes/CTF toys

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: RE notes scattered in Discord DMs with live serials and no hash.
Right: Note discipline template adopted for $RE_LAB. Next: Findings Writeup.

Hands-on Exercise