| Date | Topics | Lecture Notes | Reading | Handout | Papers | Assignments |
|---|---|---|---|---|---|---|
| Fundamentals | Class Organizations General Introduction |
Class Organization
General Introduction to Cyber Security Introduction to Software Reverse Engineering (Video for Aug. 27) |
Mal: Chapters 0, 1, and 5 |
Syllabus for CIS 4138 in PDF Format Syllabus for CAP 5137 in PDF Format |
Optional: Intel x86 Reference Manual | |
| Practice | Introduction to Ghidra and IDA |
Week1 - How to Install Ghidra/IDA Week1 - Intro to Ghidrao |
license_1 example license_2 example |
H: Homework #1 (Due 9/14/2022) Term Project (Proposal due: 11/10/2022, Report due: 12/10/2022) Hands-on Project (Proposal due: 11/10/2022, Report due: 12/10/2022) Research Paper Assignment (Report due: 11/17/2022) |
| Date | Topics | Lecture Notes | Reading | Handout | Papers/Examples | Assignments |
|---|---|---|---|---|---|---|
| Fundamentals | X86 Review Calling Conventions |
X86/X64 Instructions (Same as last time) Stack Organization and Calling Conventions |
Mal: Chapter 6 (pp. 119-121) |
X86 Guide Optional: Return-Oriented Programming Article Optional: Offset2lib File-level Reversing and Legal Issue Labs (Needed Files for the Lab) |
||
| Practice | Introduction to IDA | Introduction to IDA
Introduction to Ghidra - Part I |
license_1_m32 license_2_m32 |
| Date | Topics | Lecture Notes | Reading | Handout | Papers | Assignments |
|---|---|---|---|---|---|---|
| Fundamentals | Construct Recognition Control Flow Analysis C++ Binary Analysis |
Control Flow Analysis
|
Mal: Chapters 6 and 20 Mal: Chapter 7 |
|||
| Practice |
| Date | Topics | Lecture Notes | Reading | Handout | Papers | Assignments |
|---|---|---|---|---|---|---|
| Fundamentals | Data Flow Analysis Techniques (Continued) Decompilation Techniques |
Decompilation | Boomerang Decompiler
(not required for exams) |
X86 Decompilation Paper | ||
| Practice |
H: Homework
#2 (Due 10/6/2022) |
| Date | Topics | Lecture Notes | Reading | Handout | Papers | Assignments | |
|---|---|---|---|---|---|---|---|
| Fundamentals | Anti-Disassembly Techniques | Anti-Disassembly | Mal: Chapter 15 | ||||
| Practice | Ghidra Disassembly Features Cross-references and Graphing in IDA |
H: Homework #3 (Due 10/20/2022) |
| Date | Topics | Lecture Notes | Reading | Handout | Papers | Assignments |
|---|---|---|---|---|---|---|
| Fundamentals | Dynamic Analysis I: Obfuscation and Debugging |
Dynamic Analysis I | MAL: Chapters 3, 8, 9, and 10 | |||
| Practice | Ghidra advanced feaures | Advanced Ghidra Usage |
| Date | Topics | Lecture Notes | Reading | Handout | Papers | Assignments |
|---|---|---|---|---|---|---|
| Fundamentals | Anti-Analysis Techniques and Data Encoding | Anti-Analysis Techniques | MAL: Chapters 16, 17, 13, and 18 | |||
| Practice | The Ghidra Debugger Options Setting up Virtual Machines |
Setting up a Virtual Machine RE_practice |
enbsp; |
| Date | Topics | Lecture Notes | Reading | Handout | Papers | Assignments |
|---|---|---|---|---|---|---|
| Fundamentals | Dynamic Instrumentation and Symbolic Execution | Beyond Debuggers | ||||
| Practice |
Other commonly used debugging tools (OllyDBG/Immunity Debugger, GDB, PEDA) Ghidra Scripting |
Ghidra Scripting |
| Date | Topics | Lecture Notes | Reading | Handout | Papers | Assignments |
|---|---|---|---|---|---|---|
| Fundamentals | Midterm Exam Review | Midterm Exam Review |
Midterm Exam Study Guide
Binary for Q3 |
H:
Homework #4 (Due 11/15/2022) |
||
| Practice | Common dynamic analysis tools (QEMU, Unicorn, Cuckoo Sandbox) |
| Date | Topics | Lecture Notes | Reading | Handout | Papers | Assignments |
|---|---|---|---|---|---|---|
| Fundamentals | Midterm Exam Review Questions and Answers General Introduction to Malicious Behavior (10/27/2022) |
Malicious Behaviors - Introduction | ||||
| Practice |
Midterm Exam (October 27th, 2022) |
| Date | Topics | Lecture Notes | Reading | Handout | Papers | Assignments |
|---|---|---|---|---|---|---|
| Fundamentals | Malware Analysis Workshop by Lauren Pearce Day 1 |
|||||
| Practice |
Malware Analysis Workshop by Lauren Pearce Day 2 |
| Date | Topics | Lecture Notes | Reading | Handout | Papers | Assignments |
|---|---|---|---|---|---|---|
| Fundamentals |
General Introduction to Malicious Programs (Continued) Shellcode |
Malicious Behaviors - Introduction
Shell code |
MAL: Chapters 10 and 19 | |||
| Practice | Using Symbolic Execution Techniques | Ghidra Scripting and Symbolic Execution IDA Scripting Video Unpacking Video |
H:
Optional Homework Assignment (All questions are for extra credit points) (Due 12/1/2022) |
| Date | Topics | Lecture Notes | Reading | Handout | Papers | Assignments |
|---|---|---|---|---|---|---|
| Fundamentals |
Malware and Malicious Behavior, Covert Mechanism, and case studies - Part II |
Downloaders and Stealers Case
Studies
Covert Mechanism Case Studies |
MAL: Chapters 11 and 12 | |||
| Practice | Binary exploitation |
| Date | Topics | Lecture Notes | Reading | Handout | Papers | Assignments | |
|---|---|---|---|---|---|---|---|
| Tuesday | Malware Analysis (Continued) |
Same as last time | |||||
| Practice | Thanksgiving No class |
| Date | Topics | Lecture Notes | Reading | Handout | Papers | Assignments |
|---|---|---|---|---|---|---|
| Tuesday | Final Exam Review | Final Exam Review | Study Guide for the Final Exam | |||
| Thursday |
Final Exam Review (Continued) Backdoor Case Studies Rootkits |
Backdoors
Rootkits |
| Date | Topics | Lecture Notes | Reading | Handout | Papers | Assignments |
|---|---|---|---|---|---|---|
| Tuesday | Dec. 6, 2022 08:00 - 10:00PM | Final Exam (Cumulative) | ||||
| Friday | Dec. 10, 2022 05:00PM | Term Project/Hands-on Project Final Report/Programs Due |