> I think reality won't be as much spectacularly dystopic as in these novels.
Prepare for the worst, hope for the best.
My hope has been down a little lately, observing what kind of stupidly written software I had to audit/pentest that made it to production without any non-junior looking at the code, apparently. Rookie mistakes I would have made with less than a year of programming experience, not understanding authentication vs authorization, not understanding any kind of auth infrastructure or network segregation, etc pp. is seemingly the new normal now.
I mean, it's more work for pentesters, so I shouldn't complain. It's just that it feels a bit like an insult when you see this kind of work in a professional context and you're like "really, man, really?"
> where to start in reverse engineering?
I learned most of my knowledge via CTFs, where you have little puzzles to solve and they get gradually harder to solve. It teaches you "how to bypass" the rulesets that the puzzle is built within.
If you're unsure where to start, I'd probably recommend Natas [1] which is more focused on Web Security at first but it teaches you the way of thinking from the start without much requirements in regards to how C or ABI works etc. Then I'd move towards Krypton [2] and Leviathan [3] in that order. Then you can go to the start page and check out the other binary exploit CTFs, they got a lot of them [4].
Afterwards, binary.exploitation [5] is a really nice CTF with lots of gdb / debugging / runtime analysis challenges that are a little harder (they're the same level as e.g. Narnia/Behemoth).
I specifically like the overthewire CTFs because they manifest earlier challenges by making it a little harder each step of the way. This way you learn to "rethink" once you find another hurdle that was added on top of the challenge.
[1] https://overthewire.org/wargames/natas/
[2] https://overthewire.org/wargames/krypton/
[3] https://overthewire.org/wargames/leviathan/
[4] https://overthewire.org/wargames/
[5] https://exploit.education/