Binary Reverse Engineering 101 Class - May 7th

[AltF4]

Have you ever wanted to know what that proprietary program was REALLY doing? Have you ever wanted to disable one of those pesky CD checks, but never knew how? Wanted to solve some of the Binary 1337ness CTF challenges? Well now's your time to learn. I'll be holding a "101" class on the very beginnings of how to do binary reverse engineering.

This will be an EXTREMELY hands-on class. It will be structured around a series of about 5 challenges that I am making for just this occasion. They will range in difficulty from trivial to solve to medium. They will take the form of simple "what is the password to continue" type challenges to more interesting ones. Though we will be eventually walking through each of the challenges together, you will be solving them yourself too! By the way, there will be Easter Eggs in some of the binaries I'll be giving you which I won't disclose. Extra points for finding them!

Tuesday May 7th, 7:00 PM @ HeatSync Labs. It will probably last for 1.5 hours. That's what I'm shooting for, anyway.

Skill Prerequisites: Extremely little. You don't even really need to know assembly. If you have ever had the above curiosities, then you probably know enough to do the class.

What to bring with you: A laptop with any reputable GNU/Linux OS on it. I just use a vanilla Ubuntu 12.04 distro. Either 32 or 64 bits will be fine. All the challenges will be x86 ELFs. If you come to the class with a windows machine, you're gonna have a bad time. Though a VM may be acceptable. All the tools we will be using are Free Software and can be simply apt-get'd, but if you want to know (or download them ahead of time) they will be:
 - Static analysis: objdump, strings, ghex (or whatever hex editor you like)
 - Dynamic analysis: strace, ltrace, gdb

DO NOT: Show up without a laptop and say "I'm just here to watch".

No need to "sign up". I doubt that we'll fill up the place. Just come on down to HeatSync on May 7th at 7:00 PM!

After doing this class, you should be ready to tackle some Bin100 tasks in the Capture the Flag events! Though some independent practice will likely be needed to fully get to that point, too.

See you there!
-Alt

[JR]

Cool... and I might even have that Tuesday open. 

[Alisa]

It's on my calender. I'll see you there.

[Will Bradley]

Altf4 is my new favorite person :)

On Apr 23, 2013 5:04 PM, "Alisa" <eatlii...@gmail.com> wrote:

It's on my calender. I'll see you there.

--
You received this message because you are subscribed to the Google Groups "HeatSync Labs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to heatsynclabs...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

[Short Tie]

Sounds like great fun! It is on my calendar!

TieShort

[ubersc...@gmail.com]

You know I'll be there!  Calendared.

On Apr 23, 2013, at 9:11 PM, Short Tie <ties...@gmail.com> wrote:

Sounds like great fun! It is on my calendar!

TieShort

--

[Jac Goudsmit]

Doh! This would normally be something I wouldn't want to miss, but the date is right between the Official Parallax Conference and the Bay Area Maker Faire so I'll be out of town... :-(

===Jac

On Tuesday, April 23, 2013 4:55:12 PM UTC-7, AltF4 wrote:

[Zachary Giles]

Shoot.. I really want to see this. Possible to stream or save slides or soemthing so I can follow along? Remote presence ? (another project. :) )

Or I could fly there.. but it's pretty soon from now.

--

You received this message because you are subscribed to the Google Groups "HeatSync Labs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to heatsynclabs...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

--
Zach Giles
zgi...@gmail.com

[Will Bradley]

I can share with you while I'm doing it Zach, just remind me beforehand :)

[AltF4]

So, I've gotten a bunch of responses saying the date was bad for them. Is May 7th actually a bad day? Or is it just a result of not being able to please everyone? (If we postpone the meetup, would we just get a new and equally sized group of people unable to make it?) From my perspective, it's all the same. The 7th was just arbitrary.

-Alt

[Nate Plamondon]

7th works for me.

--
Nate Plamondon

On Wed, Apr 24, 2013 at 11:28 AM, AltF4 <al...@phx2600.org> wrote:

So, I've gotten a bunch of responses saying the date was bad for them. Is May 7th actually a bad day? Or is it just a result of not being able to please everyone? (If we postpone the meetup, would we just get a new and equally sized group of people unable to make it?) From my perspective, it's all the same. The 7th was just arbitrary.

-Alt

--

[Alisa Ex]

The 7th is the only day that works for me.

---

From: AltF4
Sent: 4/24/2013 11:28 AM
To: heatsy...@googlegroups.com
Subject: Re: [HSL] Re: Binary Reverse Engineering 101 Class - May 7th

[Zachary Giles]

Yay will! Can we put another laptop up and skype me in? I can find a good conference room here and put y'all up on the screen and call it good.

[Aaron Krone]

The 7th works for me and I'm planning on being there.

On Tuesday, April 23, 2013 4:55:12 PM UTC-7, AltF4 wrote:

[AltF4]

Okay then, we're keeping the date. No problem.

-Alt

[Will Bradley]

Zach: I'll see what I can do :p

[Zachary Giles]

sweeet.

[Steve Young]

This sounds like Fun.  I will try to be there

Steve

[Short Tie]

Hey everybody, this is like, tomorrow night! Get your laptops ready!

TieShort

[Jasper Nance]

ZOMG thanks for the reminder!!!

On Mon, May 6, 2013 at 5:21 PM, Short Tie <ties...@gmail.com> wrote:

Hey everybody, this is like, tomorrow night! Get your laptops ready!

TieShort

--
You received this message because you are subscribed to the Google Groups "HeatSync Labs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to heatsynclabs...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

--
----------------------------------------------
Jasper Nance - KE7PHI
Creative and Scientific Imagery
http://www.nebarnix.com/

[Zachary Giles]

EXCITED!

Zach Giles
zgi...@gmail.com

[Alisa Ex]

TONIGHT!

---

From: Zachary Giles
Sent: 5/7/2013 9:25 AM

To: heatsy...@googlegroups.com
Subject: Re: [HSL] Re: Binary Reverse Engineering 101 Class - May 7th

[Zachary Giles]

PUMPED! 

--
Zach Giles
zgi...@gmail.com

[Mike Bushroe]

Sounds like fun, and I wish I had time to jump in. I have done some of this in the past, as well as reverse engineer data files. Always a fun challenge, and quite an accomplishment when you succeed! But I have this little plastic project to prototype first, so I will have to sit this one out.

Mike

On Tuesday, April 23, 2013 4:55:12 PM UTC-7, AltF4 wrote:

[Frank Jensen]

The carbon based unit known as Frank will be there.

[AltF4]

Tonight's challenges are online, ready for download:

http://bit.ly/bin-rev-100

It's an encrypted 7z file, I'll tell you all the password tonight at 7. But you might be able to get a little fuss out of the way by downloading that now.

-Alt

[Corey Renner]

I really want to say "See you there ugly bag of mostly-water", but unfortunately, I won't be there.

c

On May 7, 2013 3:55 PM, "Frank Jensen" <arc...@gmail.com> wrote:

The carbon based unit known as Frank will be there.

--

[Will Bradley]

Ustream up for those who can't make it www.ustream.tv/channel/heatsync-labs

[Will Bradley]

(7z pass is hacktheheatsync)

[Alisa Ex]

Thank you Altf4 for an awesome evening. Can't wait for the next one ^_^

---

From: Will Bradley
Sent: 5/7/2013 7:25 PM
To: HeatSync Labs Google Group

Subject: Re: [HSL] Re: Binary Reverse Engineering 101 Class - May 7th

[Will Bradley]

Hey all, the recording from tonight is almost done uploading and will be available at http://youtu.be/qlp3XJmtCaM -- sorry for the laggy audio and inability to read the screen, this was mostly done as a favor and not as a professional production. I think following along with the audio can still be useful to those who missed the event.

[Zachary Giles]

sweet. thanks for posting the video etc.

Zach Giles
zgi...@gmail.com

[Brain]

awesome intro class, thanks very much Mr. Alt.  

[AltF4]

Thanks to everyone for coming! We sure did fill up HeatSync. There wasn't much of a place to sit once everyone was there, which is great. Glad to see so many people interested. I had a great time, and I hope you did too. My time estimate wound up being off by a factor of 2, which shouldn't surprise me. I got the impression that most were still engaged with the material even after all that time, though.

"When's the next class" is the most common question I got. As for a time, I have no idea. Probably in another month? But it could go in two directions: A) Binary Reverse Engineering 201. Which would be much of the same sort of thing, but harder and more advanced techniques. Like programs that go out of their way to try to stop you from debugging them. Or B) Binary Exploitation 101. Which would be about using the things from the last class (plus new stuff) to actually take over someone's machine.

As requested, here is the source code for the challenges. The disassembly notes will be there shortly, too.
https://github.com/altf4/binrev-101

-Alt

[Jasper Nance]

Thank you SO MUCH once again!! This was amazing. I was not joking when I said I had been waiting for that class since I was 13 :)

 

Personally, I would like option A. I think that option B is far too hostile for my personal tastes. Am I saying I'd rather bleed a company dry that makes products nice enough for me to want to use over get revenge on an adversary who may or may not be worth anything at all? Apparently.... Interesting.

 

 

--
You received this message because you are subscribed to the Google Groups "HeatSync Labs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to heatsynclabs...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

--

[Brain]

BOTH!!!  not all at once tho ;)    two separate classes would be great.  no rush as we know you are a busy dude.  and if it helps we can all chip in and buy you a pizza or beer or a dropbox.com t-shirt.  I would certainly be willing to help however i can.  

[Will Bradley]

Reverse engineering is just the process of figuring out how something works... what you choose to do with that knowledge is another issue :)

As an IT pro I sometimes need to see exactly what a program is doing or analyze a file to fix or optimize or secure something. If software companies supported their products flawlessly and forever I might not need to, but that'd be the day :)

[Jeffrey Ciesla]

Very awesome class yesterday!! Thank you so much for having it!

[Aaron Krone]

AltF4, thanks for putting this on! I echo Japser on the statement I've been waiting for a class like this since I was a teenager. It feels like the first curtain has been lifted and time to try and peek around the second. Time to go practice!