Applied Reverse Engineering

This course combines deep understanding of reverse engineering with rapid triage techniques to provide students with a broad capability to analyze malicious artifacts uncovered during incident response. By tailoring the instruction to rapid assessment of binaries, we equip students with the skills required to keep up with modern malware and rapidly extract the most valuable and pertinent data to their investigations, including Indicators of Compromise (IOCs). Rapid RE includes considerable lab time utilizing replicated enterprise networks and attacks as observed in the wild. Students will leave with an understanding of:
  • How real world attacks are carried out
  • File triage processes and techniques
  • Intelligence extraction techniques from malware
  • How to deal with binary obfuscation techniques
  • How to get indicators from a file in a hurry

Students will spend a significant amount of time creating their own custom tools in a lab environment. The labs are designed around the students working through the following:
  • Recognizing file format infections from various sources
  • Advanced triage capabilities
  • Extract host and network indicators from file format exploits
  • Developing your own custom process trace capabilities for IOC extraction
  • Rapid shell code analysis using the not so common tools and techniques
  • Rapid binary de-obfuscation techniques with IDA Pro and Debuggers
  • Rapid unpacking techniques

The labs will be interwoven into the lecture so that students will receive a significant amount of time exercising these new skills as they learn. By the end of the class students will have spent 50% of the time in a lab environment. A significant portion of the class will be dedicated to building new tools, on the fly, to solve the challenges posed by a difficult adversary.

Trainer:
Among professionals in the security industry, Benjamin Mossé is regarded as an ethical innovator. His company offerings comprise varied IT services with specific focus on attack simulations and intelligence. Mossé Cyber Security Institute provides cyber security courses, trainings and workshops geared for IT techs and other corporate employees spanning various industries, government bodies, and institutions.
Benjamin Mossé has conducted to numerous complex and multi-faceted incident response operations and targeted threat hunts.

Outline

Rapid inspection of various file formats
  • Metadata extraction from PE, PDF, and Office docs
  • Finding buried artifacts in files
  • Mobile malware metadata analysis
Assured Dynamic Analysis
  • Extracting Host IOCs from file formats with dynamic analysis
  • Working with DLLs
  • Splatter network IOC extraction and log file analysis
  • Memory Analysis
Assembly
  • X86 zero to hero
  • ARM zero to hero
Process Tracing for Rapid File Assessments
  • Intro to Intel PIN
  • Code tracing with Pin
  • Shellcode analysis with Pin
IDA Efficiencies
  • Intro to IDA Scripting
  • x86 emulation
  • De-obfuscation techniques
Unpacking
  • Using IDA for unpacking assistance
  • Unpacking in-memory
Android Auto Analysis
  • Android Internals
  • APK Reversing By Hand
  • Automated APK Reversing
  • ARM Bindings and Android

Enrol


Fees
  • Early bird: $2,700.00 AUD including GST.
  • Standard: $3,300.00 AUD including GST.

Enrolment
No open registration programmes scheduled. Contact us to run this learning programme onsite.
Terms and Conditions
  • Payment methods are either booking online via Event Brite or contacting us for an invoice.
  • Payment is required at the time of booking.
  • Cancellation notifications after 14 days prior to course commencement date are not eligible for refund.
  • Cancellations received between 15 and 28 days prior to course commencement will be charged 50% of the course fee.
  • Students are allowed 1 reschedule per class. Transfers received between 15 – 28 days prior to course commencement will be charged a $300 (incl GST) administrative fee. The new session date must be given at the time of the reschedule notification and rescheduled classes must be taken within 6 months of original scheduled date.
  • Transfers received 14 days or less prior to course commencement will be charged 50% of the course fee. The new session date must be given at the time of the reschedule notification and rescheduled classes must be taken within 6 months of original scheduled date.
  • Payment must be made in full prior to any rescheduling.
  • Student substitutions can be made in writing 48 hours prior to a class start.
  • If a student does not attend a scheduled session, there will be no refund or reschedule given. Payment is forfeited. Mossé Security reserves the right to cancel a course and will endeavour to provide participants with as much notice as possible. Upon cancellation, any fees already paid by the participant will be refunded.

Student Requirements

No prior reverse engineering experience is necessary.

The following will help:
  • A concept of scripting languages such as Python/Perl/Ruby
  • A familiarity with Windows administration
  • A concept of malware analysis and reverse engineering malware processes
  • Programming in C and previous knowledge of assembly will help students, but is not a must

Hardware Requirements
  • Laptop with administrative privileges
  • Minimum 30 GB HDD and 4 GB RAM
  • External USB access
  • Virtualization software

Software Requirements
  • Windows Windows 7 or above
  • a copy of IDA Pro version 6.0 or greater
  • Administrative privileges on your laptop
  • Virtualization Software
  • Custom VM labs will be provided
  • RDP Client