Reverse Engineering with Ghidra

4 Day u_long 32 CPE Hour Training: August 2020

AUG 1-7 [click for important details!]

Abstract

This is a majority hands-on course on using Ghidra for reverse-engineering. Exercises will include PE and ELF files and will be in a variety of architectures, to include x86, x86-64, PowerPC, MIPS, and ARM. This course balances fundamentals with modern applications. After completing this course, students will have the ability to perform analysis of real-world binaries in Ghidra with both manual and automated techniques. Students will know how to leverage Ghidra’s strengths and how to complement its weaknesses.

Course Topics

  • Common Reversing Tasks in Ghidra
    • Code navigation, manipulation
    • Symbols, labels, bookmarks, searching
    • Type manipulation and management
    • Disassembler-decompiler interaction
    • Patching
    • Reversing programs and firmware
  • Unique Ghidra Features
    • Decompiler deep dive
    • Program flow
    • Setting Registers
    • P-code
    • Ghidra Tools
  • Automation
    • Python scripting
    • Java refresher
    • Existing Ghidra scripts
    • Eclipse/GhidraDev Plugins
    • Ghidra FlatAPI
    • Advanced extensions: Loaders, Extensions, Plugins
    • Headless Scripting

Pre-Requisites

Students are expected to have experience with static and dynamic analysis, Linux, Windows, command line tools, shell scripting, C, and Python.

Hardware Requirements

Computer capable of running a virtual machine. Recommended minimum 8GB RAM with quad-core processor.

Software Requirements

  • VMware Workstation or Fusion to import and run a virtual machine
Jeremy Blackthorne, Evan Jensen

Jeremy Blackthorne &
Evan Jensen

COVID19 Price: Register Now

Jeremy Blackthorne is a co-founder and lead instructor of the Boston Cybernetics Institute (BCI). Before BCI, he was a researcher in the Cyber System Assessments group at MIT Lincoln Laboratory. He was the co-creator and instructor for the Rensselaer Polytechnic Institute courses: Modern Binary Exploitation and Malware Analysis. Jeremy has published research on anti-virus evasion and environmental keying in RAID, ACSAC, WOOT, ROOTS, and LatinCrypt. He served in the U.S. Marine Corps with three tours in Iraq. He is currently a PhD candidate in computer science at RPI focusing on anti-analysis techniques in computer programs. Jeremy is a proud alumnus of RPISEC.

Evan Jensen is the co-founder and CTO of BCI, where he splits his time between performing assessments and creating solutions for clients and teaching. He is an experienced instructor in reverse-engineering and exploitation. Evan has taught reverse-engineering at BU, RPI, NYU, MIT, the United States Military Academy at West Point and MIT Lincoln Laboratory. Before founding BCI, Evan worked for MIT Lincoln Laboratory's Cyber System Assessments Group and Facebook's redteam. He has a BS in computer science from NYU Tandon School of Engineering.