Finding a 27-year-old easter egg in the Power Mac G3 ROM

Impressive. Interesting how it took that long until someone found the triggering mechanism of this easter egg. Reverse engineering is tough.

Now that I wonder where I could learn RE? Where do I even start? Got any recommendation of online tutorial or book or something?

Video games are a good place to start, especially for old consoles like the NES. The impacts of your experimenting are immediately visible, and they're simple devices (though the hardware "APIs" can be pretty unintuitive to a modern programmer), and there's a lot of tooling already built for hacking and reversing them. Try loading up your favorite NES game in Mesen and poke around its debugging tools with nesdev.org open in a browser. If the game you're working with has already been reversed by someone else, you may find some useful info on https://datacrystal.tcrf.net , too.

Reversing more modern software is tricky. I wrote a couple articles a while back about hacking a Gamecube game that you might enjoy:

https://www.smokingonabike.com/2021/01/17/hacking-super-monk...

https://www.smokingonabike.com/2021/02/28/hacking-super-monk...

Accompanying HN discussion: https://news.ycombinator.com/item?id=26315368

Agree on video games! I recently found a "developer photo insert" Easter egg in an old 3DO game: https://32bits.substack.com/p/under-the-microscope-total-ecl...

Without discrediting the author, as it's always cool to share these findings, was anyone actively looking for this over 27 years?

A lot of the times, it just happens that someone was the first person that even bothered trying digging into the code. Specially after decompilation became much more accessible for less popular architectures with Ghidra. Give it a try, there's plenty of low hanging fruit! I've submitted another case some time ago.

Also luckily, considering other OS easter eggs, it doesn't seem like there was any obfuscation involved, like "chained xor stored in bitmap resource of badly supported executable format": https://x.com/mswin_bat/status/1504788425525719043