[the_only_law]

I’ve gone through the demystification phase a number of times. Unfortunately it’s always very surface level. There’s been a ton of things I’ve been trying to read about and learn about the past couple years. I could probably give a pretty decent, albeit rough description of most of them and how they work, but I could not implement them myself from scratch or anything.

And I still look up at some people and wonder how the hell I could ever get to that level. People who seem both wide and deep in knowledge. Even people who cross outside different domains and seem well versed across all sorts of fields. I recall being among some reverse engineers quoting seemingly from memory undocumented behavior of random Windows API calls.

[bostonsre]

At least for me, reading is not enough. It gives some good context, but actually using that knowledge to accomplish tasks helps to solidify that knowledge. Viewing my knowledge as a network of interconnected nodes also helps me reason about it. Reading a key/value dictionary from start to finish doesn't leave enough interconnected nodes for that information to persist long. Knowledge seems to solidify when it is connected and linked to other bits of knowledge but islands of knowledge seem hard to retain. E.g. Those seemingly random windows api calls are easier to remember when you know of their Linux equivalent, in what cases you call those methods, what other methods call that method, what methods that method itself calls, what happened last time you called those methods, etc. I doubt they remembered them because they read the source code once and have a photographic memory.

[nneonneo]

Or, having been there, maybe they remembered them because they were interesting/weird tidbits that caused them to have to debug something for hours. Or perhaps they ran into those weird things last week. (I will never forget, for example, that certain glibc functions such as system() use movaps to copy data from the stack - because it’ll crash the program when you call them from an unaligned stack ROP...)