Practical Binary Analysis: Build Your Own Linux Tools for Binary Instrumentation, Analysis, and Disassembly
Dennis Andriesse · No Starch Press · First edition · 2018
Identifier: ISBN 978-1-59327-912-7
Access and status
Cost
Paid
Costs money to buy outright — a book, a licence, a registration.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
Binary analysis from the format upward on Linux: ELF and PE structure, writing a loader with libbfd, how disassembly actually works and where it goes wrong, ELF code injection, then binary instrumentation with Pin, dynamic taint analysis with libdft, and symbolic execution with Triton.
Who it is for, and when
For the analyst who has hit the limits of reading disassembly by hand and needs to automate. The disassembly chapter is the clearest published explanation of why linear and recursive disassembly disagree, which matters any time you have to defend a claim about what code a binary would execute.
What it does not cover
Linux, x86-64 and ELF first by design; Windows PE gets one short chapter. The hands-on half depends on a supplied VM and specific 2018 versions of Pin, libdft and Triton, so exercises may need porting. No ARM64, no Ghidra, no fuzzing.
Go to the source
Open at nostarch.com (opens in a new tab)https://nostarch.com/binaryanalysis
Details
- Type
- Book
- Written for
- AdvancedAdvanced
- Author
- Dennis Andriesse
- Publisher
- No Starch Press
- Version verified
- First edition
- Year
- 2018
- Identifier
- ISBN 978-1-59327-912-7
- Topics
- reverse-engineering, linux, malware, scripting
- Checked at source
Related entries
Ghidra
FreeAn open-source software reverse engineering framework released by the NSA, with a disassembler, a decompiler producing C-like output, scripting in Java and Python, and support for many processor architectures. The former ghidra-sre.org address now redirects to the GitHub project.
OpenSecurityTraining2
Partly freeAn Open edX platform hosting long-form, university-length classes in low-level computing: x86-64 assembly, OS internals, firmware and UEFI, debuggers (WinDbg, GDB, IDA, Ghidra, Binary Ninja, HyperDbg), reverse engineering, vulnerability classes, exploitation, fuzzing, trusted computing and Bluetooth security. Actively maintained — 2025 additions include AFL++ fuzzing, Bluetooth reconnaissance and TPM programming in Python, with an introductory emulator course listed for 2026.
Two closely related open-source reverse engineering frameworks. radare2 is the original Unix-style command-line toolkit for binary analysis, patching, and debugging; Rizin is a fork of radare2 that set out to stabilise the API and command set and ships the Cutter GUI. Both are actively developed and release regularly.
The Volatility Foundation keeps the Volatility Framework — currently Volatility 3 — free and open source on GitHub, with the accompanying project documentation. Separately it endorses instructor-led memory forensics courses; the Foundation's site does not publish prices for those, and the Malware and Memory Forensics class is a commercial offering run through memoryanalysis.net.
The Ghidra Book
PaidThe reference manual for Ghidra: core reverse-engineering technique, Ghidra's data displays, the decompiler, collaborative server-based analysis, customisation and new data types, headless operation, and scripting — with Python 3 support through PyGhidra new to this edition.