Abstract

This class is planned to provide students with all necessary Assembly language concepts and details used in reverse engineering, malware analysis and exploit development.

We will show details about important instructions and details of Assembly language that will help class attendees to write and mainly understand reversed code while working on malware analysis and vulnerability research. Students will learn general Assembly concepts, registers and basic operations. There is a specific section dedicated to explain details about opcode format and decoding. Additionally, students will delve into topics such as x86/x64 stack, calling conventions and even bitwise operations. Finally, we will show relevant structures such as loop, conditionals and repetition. At the end of course, we demonstrate macros and subroutine constructions in Assembly and there is a final chapter where we will interpret and analyze different pieces of code.

This class will focus Assembly on Windows x86/x64 as well as Assembly programming using Visual Studio.

Who Should Attend

This class is planned and organized to professionals that aim to start in reverse engineering and vulnerability research career as well as people already working as incident responders, threat hunters, malware analysts and pentesters.

Key Learning Objectives

This class has the following goals:

  • Learn fundamental concepts on x86 and x64 Assembly.
  • Understand when different registers are used.
  • Learn how tradicional programming structures such as loops, conditionals and repetition are used.
  • Leverage opcode decoding to get a better comprehension about how instructions are translated to hexcode and its respective meaning.
  • Learn about critical points such as statcj and calling conventions.
  • Analyze pieces of real codes by applying the entire material learned over the course.

Prerequisite Knowledge

The recommended prior knowledge for attending this class follows below:

  • Students should be comfortable to use Visual Studio as well as executing daily operations on Windows system.
  • Previous knowledge about any programming language might be useful.

Lab Requirements

Students must prepare the following lab configuration:

  • Having VMware Workstation, Oracle VirtualBox or Microsoft Hyper-V installed on the system.
  • One virtual machine running Windows 11 x64.
  • Visual Studio Code installed on the Windows virtual machine.
  • Visual Studio and SDK installed on the Windows machine.
  • IDA Pro, IDA Free or equivalente product might be useful.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

The list of sections presented in this class is:

  • Introduction
  • Lab Setup
  • Concepts, Registers and Basic Operations
  • Bitwise Operations
  • Stack x86|x64 and Calling Conventions
  • Assembly Details
  • Loops, Conditional and Repetition.
  • Macros and Subroutines
  • Malware: Code Interpreting

Note: Topics can be added, merged or removed without prior notice!