Practical Reverse Engineering ⋆ CyberDefenses Inc.
A two-day | two-part, scenario-based class. The scenario starts with you being hired as a first responder, you will be given the case details and necessary files recovered from the device. In the first day, students are guided as they investigate, organize, validate, and report on the information.
In the second day, students take on the role of a senior analyst and perform full binary analysis on executable samples to uncover attacker details as well as capabilities. Bring your own laptop.
Construct a secure environment as a workspace.
Determine targets for your reverse engineering (RE).
Use sources of intelligence to enrich the RE effort and streamline objectives.
Use processes to triage the focus of your RE.
How and what to record as you RE.
Individuals new to or desiring a better understanding of how to incorporate file intelligence into their Incident Response or SOC processes.
Professionals who deal with technical issues, but feel they do not have enough background in Reverse Engineering or Threat Intelligence.
Technical professionals that need to be armed with greater knowledge of incident response, reverse engineering, threat intelligence and their role in resolving incidents.
CHRIS ROGERSChris Rogers is a 20+ year industry security specialist who works with Cyberdefenses inc as the virtual security operations center team lead. Chris is a passionate believer that while security is complicated it is far from the wizard like magic many vendors make it out to be.Chris has worked as a forensic examiner and intrusion specialist at the Department of Defense Computer forensic laboratory, built and managed the malware team at Bank of America, and has worked more malware and solved large scale intrusion mysteries in his career.Having worked in real time against new and emerging threats or actors Chris always loves the tactical aspect of the work and the immediacy of intrusion situations, not to mention the personal satisfaction of solving mysteries, protecting assets, and all around making the world a better place.
In this two-day portion of the course, students will build a secure environment as a platform, select tools to use and employ them to pull selected information from the reversing target to focus the RE effort. Students will also leverage sources of intelligence to enrich the RE effort and streamline objectives. Lastly, students will use dynamic file interrogation techniques to derive information from the file before beginning RE.
In the second, Part "B" portion of the class, students will delve into machine code, hex and other languages to better understand the target of the RE effort. Students will use debuggers and disassemblers to view and pull data from target file and learn how and what to record during the RE effort.