Sunday, July 13, 2008

Advanced Reverse Engineering Trainings Class

We still have a number of seats in our advanced RE class available. The class
will be held on the following three days:
  1. Wednesday the 1st of October
  2. Thursday the 2nd of October
  3. Friday the 3rd of October
The class will be held in Frankfurt(Main) in Germany.
The class is limited to 17 students and will cover a lot of interesting ground. Amongst the things we will be teaching are:
  • What a C++ compiler does and how to recognize these things in a binary:
    • How to recover classes and inheritance,
    • What templates will do in the binary
    • Using the helping hand of MS RTTI to recover classnames and generate inheritance diagrams from the binary
  • Getting the most out of the RE-DB SQL schema -- storing disassemblies in a uniform way in a database
  • Differential debugging and isolation of security-critical features (e.g. "where in the world is the encryption code again ?")
  • Crafting malicious input to reach target program locations
  • Working on network infrastructure:
    • Loading ROM images into IDA: IOS, Netscreen etc.
    • Generic methods of identifying the base address
    • Debugging IOS (and other network infrastructure) using BinNavi and the GDB protocol
  • Using BinDiff to full advantage:
    • Patch Diffing
    • Porting comments & names
    • Porting symbols of statically linked libraries (such as OpenSSL) back into your disassembly
  • A reverse engineer's guide to static analysis:
    • The reverse engineering intermediate language REIL
    • Monotone frameworks, lattices, and fun things to do with them
  • Lots and lots of fun things to do with Python
The class will be taught by me (Halvar Flake), Ero Carrera, and Felix 'Fx' Lindner.

The class will be held in a small Hotel called "Villa Orange" -- which has about 20 rooms, so usually the entire Hotel consists of reverse engineers.

For more info, visit

PS: It might be of interest to some readers that the Oktoberfest is from the 20th of September to the 5th of October this year -- this means you can either attend Octoberfest before or after the trainings class (although we recommend the latter).
*End of Blogspam*

No comments: