No edit summary |
No edit summary |
||
| Line 1: | Line 1: | ||
{{Event | |||
|Title=52455645525345 | |||
|Description=Lazy reversing - angr & symbolic execution workshop | |||
|Type=Workshop | |||
|Date=2021-03-24 | |||
|Start=18:00 | |||
|End=21:00 | |||
|Duration=3 | |||
|Speaker=barbieauglend | |||
|Host=barbieauglend | |||
|Location=https://virtual.chaosdorf.space/Hackcenter Virtual Hackcenter | |||
|isRelevant=Yes | |||
}} | |||
{{Project | {{Project | ||
|name=52455645525345 | |name=52455645525345 | ||
| Line 19: | Line 32: | ||
== Next event: Symbolic execution with angr workshop == | == Next event: Symbolic execution with angr workshop == | ||
Symbolic execution is a powerful tool for code verification, bug hunting and reverse engineering. In this class, we will dive into the concepts of constraint programming and SMT solvers and how binary analysis tools, such as angr, integrate these concepts into their frameworks. It is going to be a very practical class, where we are going to solve various CTF challenges with the goal of visiting different features of angr. | Symbolic execution is a powerful tool for code verification, bug hunting and reverse engineering. In this class, we will dive into the concepts of constraint programming and SMT solvers and how binary analysis tools, such as angr, integrate these concepts into their frameworks. It is going to be a very practical class, where we are going to solve various CTF challenges with the goal of visiting different features of angr. | ||
| Line 55: | Line 56: | ||
* Andrea Fioraldi's Bachelor Thesis "Symbolic Execution and Debugging Synchronization" (https://arxiv.org/pdf/2006.16601.pdf) | * Andrea Fioraldi's Bachelor Thesis "Symbolic Execution and Debugging Synchronization" (https://arxiv.org/pdf/2006.16601.pdf) | ||
* Training materials @ ShaktiCTF (https://keybase.pub/barbieauglend/2021_03_Shakti/) | |||
== Participants (please register!) == | == Participants (please register!) == | ||
Revision as of 20:07, 12 March 2021
| 52455645525345 | |
|---|---|
| Lazy reversing - angr & symbolic execution workshop | |
| Art | Workshop |
| Datum | 2021-03-24 |
| Start | 18:00 |
| Ende | 21:00 |
| Dauer | 3h |
| Speaker | barbieauglend |
| Host | barbieauglend
|
| Ort | https://virtual.chaosdorf.space/Hackcenter Virtual Hackcenter |
| Relevant? | Yes |
| 52455645525345 alpha | |
|---|---|
| |
| Reverse Engineering Group | |
| Ort | Chaosdorf |
| Beteiligt | barbieauglend
|
ReVeRsE Engineering - Welcome to the page of the reverse engineering group!
Reverse Engineering is fun! It's like a puzzle and if there is an algorithm out there that can solve this puzzle, it's your brain. =)
I, barbieauglend, would love to take a look at binaries with you and figure out together what the programs do. They are often a lot easier than you might think!
If you want to participate, you will need a laptop (with charger!) and if you have any questions, feel free to contact me under barbieauglend@chaosdorf.de.
Next event: Symbolic execution with angr workshop
Symbolic execution is a powerful tool for code verification, bug hunting and reverse engineering. In this class, we will dive into the concepts of constraint programming and SMT solvers and how binary analysis tools, such as angr, integrate these concepts into their frameworks. It is going to be a very practical class, where we are going to solve various CTF challenges with the goal of visiting different features of angr.
Most of CTF players use z3 and angr to save time when solving reverse engineering challenge and that is also the path we are going to take. If time is available, we will also check manticore and miasm, two other tools with symbolic execution engines with different features!
Requirements for the symbolic execution workshop
- Be comfortable understanding and writing Python3 code
- Familiarity with x86/x64 assembly
- VMware Workstation or Player (at least version 12) (no VirtualBox)
- At least 40GB of free disk space- At least 8GB of RAM
- A laptop with administrative privileges
Goals
- Understand how SMT solvers work
- Understand how symbolic execution works
- Get all the flags!
Materials
- Andrea Fioraldi's Bachelor Thesis "Symbolic Execution and Debugging Synchronization" (https://arxiv.org/pdf/2006.16601.pdf)
- Training materials @ ShaktiCTF (https://keybase.pub/barbieauglend/2021_03_Shakti/)
Participants (please register!)
Archive
| 52455645525345 | |
|---|---|
| Reverse Engineering Workshop | |
| Art | Workshop |
| Datum | 2018-07-16 |
| Start | 18:00 |
| Host | barbieauglend
|
| Relevant? | Yes |
Requirements for the RE workshop:
- Virtual machine software (VMWare, VirtualBox etc...) - Windows 7 guest system with IDA Pro (Free 5.0 is acceptable) - Microsoft Visual Studio 2008 redistributable package
Let's dive into the blackhole of compiled code and understand the internals of the software running in our computer. It doesn't matter if you want to fix a broken gadget or save your files (now you know why to backup, right!?) from a ransomware, it is elementary to understand how they work. This is Reverse Engineering (RE), and it is done every day from recreating outdated and incompatible software, understanding malicious code, or exploiting weaknesses in software.
We are going to try to cover topics like:
- Uses for RE
- The tricks and pitfalls of analyzing compiled code
- Identifying calling conventions
- How to navigate x86 assembly using IDA Pro
- Identifying Control Flows
- Identifying the Win32 API
- Using a debugger to aid RE
- Dynamic Analysis tools and techniques for RE
I am going to bring some nice binaries which we can go through together. We are going to explore how static reverse engineering works and how can we use it to understand what a piece of malware does (hopefully).
Participants (please register!)