Introductory Lectures

Please watch the relevant video prior to each class. Also, download the exercises onto your virtual machine - we will be using them during the class.

#Topic Video SlidesIn-class
Exercises		 Prereq-
uisite		 Video
Length
intro-1Introduction
  • Famous Reverse Engineering Projects
  • Binary Reverse Engineering
  • Reverse Engineering vs. Software protection
  • Attacks on Mobile Devices
  • Attacks on Critical Infrastructure
  • Attacks on Consumer Products
  • Attacks on Media Distribution
  • Attacks on Computer Games
  • Protecting Malware
  • https://LigerLabs.org
  pdf25m
model-1Modeling Attacks and Defenses pdfmodels-1-exercises.pdf
20m

Low-level Programming

Lectures on X86 assembly code and machine code.

#Topic Video SlidesIn-class
Exercises		 Prereq-
uisite		 Video
Length
X86-1X86 Instruction Set
  • Global Variables
  • X86 Assembly Syntax
  • Data Movement Instructions
  • Arithmetic and Bitwise Instructions
  • Switch Statements8-bit vs. 16-bit vs. 32-bit vs. 64-bit
  • Addressing Modes
  • x86 Example Execution x86 Intel vs. AT&T Syntax
  • Disassembly
  pdf x86-1-exercises.zip 32m
x86-2X86 Control Flow Instructions
  • Unconditional Control Flow Instructions
  • Conditional Control Flow Instructions
  • Conditional Move Instructions
  • Conditional Set Byte Instructions
  • Disassembly with Binary Ninja
 pdf x86-2-exercises.zip x86-126m
x86-3X86 Memory Operations
  • Global Variables
  • More Data Movement Instructions
  • Arrays
  • Switch Statements
  • Floating Point
 pdf x86-3-exercises.zip x86-218m
x86-4X86 Calling Conventions pdf

x86-5X86 Instruction Encoding pdf

Static Analysis

Lectures on statically analyzing data and control flow.

#Topic Video SlidesIn-class
Exercises		 Prereq-
uisite		 Video
Length
ast-1Abstract Syntax Trees pdfast-1-exercises.zip
20m
cfg-1Control Flow Analysis pdf cfg-1-exercises.zip 22m
file-1Executable File Formats
  • Statically Linked Binaries
  • Dynamically Linking LIBC
  • Creating a Dynamically Linked Library
  • Command Line Tools
  • The ELF File Format
 pdf file-1-exercises.zip 12m
disass-1Disassembly
  • Linear Sweep Disassembly
  • Recursive Descent Disassembly
  • Issue #1: Finding Entry Points
  • Issue #2: Statically Unknown Control Flow
  • Issue #3: Mixing Code and Data
  • Issue #4: Shared Basic Blocks
  • Issue #5: Overlapping Instructions
  • Anti-Disassembly
  • Branch Functions
  • Tigress
pdf disass-1-exercises.zip x86-2,
cfg-1		25m

Dynamic Analysis

Lectures on debugging, tracing, etc.

#Topic Video SlidesIn-class
Exercises		Prereq-
uisite		Video
Length
gdb-1Debugging with gdb
  • Running, Stepping, Breaking
  • Automating Debugging
  • Hardware vs. Software Breakpoints
  • Patching with gdb
  • Watchpoints
  • Searching
  • Gdb + Ghidra
  • Extensions
  pdfgdb-1-exercises.zipx86-2, ghidra-329m
trace-1Tracing
  • strace
  • ltrace
  • gdb trace points
  • pintools
  pdftrace-1-exercises.zipopaque-122m
symex-1Symbolic Execution
  • License Checking Revisited
  • Klee
  • Symbolic Execution
  • Solvers
  pdfsymex-1-exercises.zipast-1, softprot-1, x86-125m
symex-2Symbolic Execution with angr
  • Example
  • angr API
  pdfsymex-2-exercises.zipsymex-18m

Reverse Engineering

Lectures on using reverse engineering tools and strategies for attacking binary programs.

#Topic Video SlidesIn-class
Exercises		 Prereq-
uisite		 Video
Length
ghidra-1Introduction to Ghidra 1
  • Starting a New Project
  • Top Level Interface
  • Viewing Binary Code
  • Viewing Disassembled Code
  • Viewing the CFG
  • Viewing Decompiled Code
  • Viewing Strings
  pdfghidra-1-exercises.zipx86-2, cfg-119m
ghidra-2 Introduction to Ghidra 2
  • Viewing The Program Graph
  • Viewing The Call Graph
  • Cross References
  • Fixing Names,Types, and Functions
  • Documenting Your Work
  • Viewing Symbols
  • Navigating the Code
  • Searching for Strings
  • Searching for Instructions
  pdfghidra-2-exercises.zipghidra-118m
ghidra-3Ghidra Code Patching
  • Editing Instructions
  • Removing Instructions
  • Replacing Instructions
  • Referencing External Functions
  • Adding Instructions
  • Code Stealing
  • Adding a Segment
  pdfghidra-3-exercises.zipghidra-119m
ghidra-4Ghidra Scripting
  • Creating, Editing, and Running Scripts
  • The Ghidra API
  • API Documentation
  pdfghidra-4-exercises.zipghidra-321m
re-1Reverse Engineering Strategies
  • Game Cheating
  • Cryptographic Key Recovery
  • License Key Recovery
  pdfghidra-1,
trace-1,
virt-1		18m

Software Protection

Lectures on code obfuscation and tamper-proofing.

#Topic Video SlidesIn-class
Exercises		 Prereq-
uisite		 Video
Length
virt-1Virtualization Obfuscation
  • What is a byte code interpreter?
  • Obfuscating Virtual Machines
 pdfvirt-1-exercises.zipcfg-116m
virt-2Protecting Virtualized Code
  • Randomizing the Instruction Set
  • Random Dispatchers
  • Protecting Handlers
  • Protecting the Byte Code
  • Dynamic Attacks and Defenses
 pdfvirt-2-exercises.zipvirt-128m
checksum-1Checksum Integrity Check
  • Checksumming
  • Attacks!
  • Running Example
  • Attack with gdb
 pdfchecksum-1-exercises.zip24m
arith-1Encoding Integer Expressions
  • Diversifying Integer Expressions
  • Tree Patterns
  • Tree Pattern Matching
  • Attacks
  • Add Your Own Patterns
  • Making Obfuscated Constants
 pdf arith-1-exercises.zipast-122m
flatten-1Control Flow Flattening
  • Control flow Flattening
  • Dispatch Methods
  • Attacks and Defenses
 pdfflatten-1-exercises.zipcfg-118m
checksum-2Checksum Attacks and Defenses
  • Attack with Binary Ninja
  • Attack with Ghidra
  • Defenses: Check-Repair Networks
  • Defenses: Overlapping Checkers
  • Defenses: Stealthy Hash Functions
  • Responding to Attacks
 pdfchecksum-120m
softprot-1Software Protection
  • Software License Checking
  • DRM and Whitebox Cryptography
  • Code Transformations
  • Code Obfuscation
  • Tamperproofing
  • Tigress
  • Environment Detection
  • Software Fingerprinting
  • Executable Packing
  • Anti-Disassembly
  • Diversification
 pdfsoftware-protection-1-exercises.zipintro-1, ghidra-128m
opaque-1Opaque Expressions
  • What is an Opaque Value?
  • Adding Bogus Control Flow
  • Array-based Opaque Predicates
  • Graph-based Opaque Predicates
  • Tigress
  • Dynamic Opaque Predicates
 pdfopaque-1-exercises.zipflatten-120m