Analysis of a Custom PHP Extension Protection System (mms_decrypt / php_mms.dll)

[hsusony]

Hello everyone,

I am interested in learning Reverse Engineering and would like to study the subject in a structured and professional way.

I have basic experience with programming and have recently started exploring tools such as IDA and Ghidra. I am looking for:

• Reverse Engineering courses
• Training materials
• Recommended books
• Learning roadmaps
• Mentors or experienced researchers willing to provide guidance

My goal is educational and research-oriented, focusing on understanding software internals, executable formats, DLL analysis, and reverse engineering concepts.

If anyone can recommend high-quality resources or training programs, I would greatly appreciate it.

Thank you.

Contact:
[morabaa2010@gmail.com](mailto:morabaa2010@gmail.com)

[nima-sayadi]

Hey. I was in a similar position a a few years back, so hopefully this helps.

Since you already have some programming background and have started poking around IDA and Ghidra, you're actually in a decent spot to start going deeper... so I recommend:

---

Books

Start with "Reverse Engineering for Beginners" by Dennis Yurichev — it's free as a PDF and honestly the best starting point out there. Covers x86/x64 assembly in a very approachable way.

Once you're comfortable with the basics:

• "Practical Reverse Engineering" by Bruce Dang et al. — covers x86, x64, ARM, Windows kernel (rootkits/drivers), and obfuscation techniques. Has hands-on exercises throughout and fills in a lot of gaps that beginner resources skip.
• "The IDA Pro Book" by Chris Eagle — since you're already using IDA, this is a no-brainer. Covers everything from the basics of the interface to scripting and plugin development.
• "The Ghidra Book" — the only comprehensive guide for Ghidra. Useful to have alongside the tool.

For more advanced topics down the road:

• "The Art of Memory Forensics" — focuses on detecting malware and threats through memory analysis on Windows, Linux, and Mac.

---

Courses

Free ones worth doing first:

• Reverse Engineering 101 by Malware Unicorn — free, hands-on, focused on x86 Windows malware. You set up your own analysis environment and work through real samples using static and dynamic analysis. Great quality for something that costs nothing.
• Intro to RE with Ghidra (Hackaday) — solid free course if you want to get more systematic with Ghidra specifically.
• Nightmare (guyinatuxedo.github.io) — RE and binary exploitation course built around CTF challenges. Over 90 challenges, each with a full writeup. Very practical.

Paid / more structured:

• Pluralsight – "Getting Started with Reverse Engineering" by Josh Stroschein — covers CPU architecture, assembly basics, the PE file format, and hands-on static/dynamic analysis with IDA Pro and WinDbg. Good if you want something that holds your hand through the fundamentals.
• SANS FOR610 — expensive but considered the gold standard for malware RE. Worth it if your goal is professional malware analysis work.
• Hex-Rays Official IDA Training — courses run directly by the IDA Pro creators. Live sessions (Paris/New York timezones) and on-demand options available. Pricey but very thorough.

---

Roadmap (roughly what I'd follow at your level)

1. Assembly fundamentals — RE for Beginners by Yurichev. Don't skip this even if you think you know some assembly.
2. Tool fluency — Get comfortable with Ghidra and IDA through the Malware Unicorn workshops and the Ghidra/IDA books.
3. Executable formats — Understand PE/ELF structure, sections, imports/exports, how DLLs get loaded. Practical Reverse Engineering covers this well.
4. Static + Dynamic analysis workflow — Add x64dbg, PEStudio, and Process Monitor to your toolkit and start analyzing real samples.
5. CTF grind — RE is really a skill you build through repetition on hard problems. Start with crackmes.one and picoCTF, then move to HackTheBox and CTFtime competitions.
6. Specialize — Malware analysis, vuln research, or binary exploitation. Pick one direction and go deep.

There's also a GitHub repo — x86byte/RE-MA-Roadmap — that lays this out in a more detailed step-by-step format. Worth bookmarking.

---

Practice Platforms

• crackmes.one — pure RE challenges, great for drilling the basics
• picoCTF — beginner-friendly CTF with solid RE challenges
• HackTheBox — intermediate/advanced binary challenges
• CTFtime.org — tracks all upcoming CTF competitions worldwide

---

Community / Finding Mentors

Honestly the best communities I've found:

• r/ReverseEngineering — active, good for questions, people are generally helpful
• OpenSecurityTraining2 (ost2.fyi) — free structured courses with a Discord community where instructors actually engage
• vx-underground.org — massive archive of malware samples and research papers, useful once you're ready to work with real samples
• RECon conference talks on YouTube — the premier RE conference; all talks are free and the quality is high

For actual mentorship — Twitter/X and LinkedIn are your best bet. Look for researchers who regularly post malware analysis writeups or IDA screenshots and just reach out. A lot of them are surprisingly approachable if you show you've already done the homework and have specific questions rather than asking them to teach you from scratch.

---

Good luck! it clicks faster than you'd expect once the assembly intuition starts building up. It's a hard road tbh but if you're passionate enough, you'll learn it in no time (or at least the path clears up as you progress).