Reverse engineering - free course from Otus, training 5 months, date November 30, 2023.
Miscellaneous / / December 03, 2023
You will master in practice the most important techniques of reverse engineering: static and dynamic analysis.
Get acquainted with low-level and system programming, and understand in detail aspects of the internal structure of Windows.
You will study and classify malware using examples of real malware caught on the network.
WHAT IS REVERSE ENGINEERING?
Code reverse engineering (code reverse engineering) is the process of analyzing the machine code of a program, which aims to understand the principle of operation, restore the algorithm, discover undocumented program capabilities, etc. The main methods of reverse engineering are static or dynamic code analysis. In static analysis, the researcher disassembles the program code using special software and then analyzes the assembly code. In dynamic analysis, the researcher runs the code in an isolated environment (sandbox) or debugger and analyzes the code over time.
Who is this course for?
- For system programmers developing low-level software. You'll understand how code works internally after compilation and can improve the quality of your solutions.
- For beginner virus analysts and information security specialists. You will learn all the must-have reverse engineering practices and gain a comprehensive understanding of malware.
How is the practice going?
Students receive stands in advance and set them up locally before the start of class. You will perform the practice on your virtual machine during a webinar under the guidance of a teacher.
What awaits you on the course:
- Practice unpacking files
- Practical analysis of the PE format (import table, export table, relocation table)
- Practical analysis of ransomware, banking Trojans, bots.
- Project work, within which you will write your own program for treating malware
Our Certiport partners provide a 10% discount on EC-Council certification exams (EHA, CFA) to all course students!
Low-level programming in assembler for x8086/x64.
-Topic 1.Processor registers, working with memory
-Topic 2. Presentation of data, code, command opcodes. Basic YA commands
-Topic 3. Arithmetic and logical commands
-Topic 4.Chain operations
-Topic 5. Subroutines
-Topic 6.BIOS interrupts
-Topic 7. Writing a custom MBR
Low-level programming in assembler for MIPS.
-Topic 8.Processor registers. Working with memory
-Topic 9. Arithmetic, logical commands. Conditional/Unconditional Jump Commands
-Topic 10. Command opcodes
CPU Protected Mode
- Topic 11. Operating modes of processors. The principle of operation of the processor in PM. Segmental organization of memory
-Topic 12. Page organization of memory
-Topic 13.Types of descriptors
Windows internals
-Topic 14.Kernel objects
-Topic 15.Memory Manager
-Topic 16.I/O Manager
System Programming
-Theme 17.PE format
-Topic 18.Import table
-Topic 19.Export table/Relocation table
-Topic 20.Windows Traps
-Topic 21.Intercepting WinApi functions
-Topic 22.Programming Native applications
-Topic 23. Methods of adding to startup
-Topic 24.Programming services
-Topic 25. Setting up a working environment for debugging kernel mode drivers
Reverse engineering of programs
-Topic 26. Dynamic code analysis
-Topic 27.Static code analysis
-Topic 28. Development of shell codes
-Topic 29.Practice: manual unpacking
-Topic 30.Practice: exploit analysis
-Topic 31.Practice: analysis of a malicious sample
-Topic 32. Buffer Overflow Vulnerability
-Topic 33. UAF vulnerability
-Topic 34.Bootkits
Project module
-Topic 35. Selection of topic and organization of project work
-Topic 36. Consultation on projects and homework
-Topic 37.Protection of design work