Software Reverse Engineering Course

Lesson 1 • Setting Up the RE Lab

Guides students through building an isolated analysis environment with virtual machines and essential tooling. Ensures a safe, reproducible workspace for all exercises.

Lesson 2 • Legal and Ethical Boundaries

Covers authorisation requirements, responsible disclosure norms, and ethical conduct. Grounds students in professional standards before hands-on work begins.

Lesson 3 • What Is Reverse Engineering

Defines reverse engineering, its goals, and its role in security research and software analysis. Establishes vocabulary used throughout the course.

Lesson 4 • Computer Architecture Essentials

Reviews CPU registers, memory layout, and the fetch-decode-execute cycle. Provides the hardware mental model required to interpret disassembled code.

Lesson 1 • x86-64 Differences and Extensions

Highlights register expansion, RIP-relative addressing, and SIMD basics in 64-bit mode. Prepares students for modern 64-bit binaries encountered in practice.

Lesson 2 • x86 Instruction Set Fundamentals

Covers data-movement, arithmetic, and logical instructions with annotated examples. Forms the reading vocabulary needed for all disassembly work ahead.

Lesson 3 • The Stack and Calling Conventions

Details how functions pass arguments, preserve registers, and return values across major calling conventions. Critical for understanding decompiled output accurately.

Lesson 4 • Control Flow Instructions

Explains conditional and unconditional jumps, loops, and CALL/RET mechanics. Students learn to reconstruct program logic from raw instruction sequences.

Lesson 1 • Annotating and Renaming Symbols

Covers systematic renaming of functions, variables, and data structures to build a readable model. Directly improves analysis speed and reduces cognitive load.

Lesson 2 • Navigating Code Graphs

Teaches use of control-flow graphs, call graphs, and cross-references to orient analysis. Enables efficient navigation of large, unfamiliar codebases.

Lesson 3 • String and Import Analysis

Extracts meaningful strings, imported APIs, and library signatures to infer program behaviour. Provides rapid triage before deep code analysis begins.

Lesson 4 • Scripting Static Analysis Tasks

Introduces automation of repetitive static tasks using disassembler scripting APIs. Students write scripts that rename, annotate, and extract data at scale.

Lesson 1 • Anti-Debug Detection and Bypass

Identifies common anti-debugging tricks and demonstrates reliable bypass methods. Prepares students for hardened targets encountered in real-world analysis.

Lesson 2 • Tracing and Logging Execution

Uses instruction-level tracing and API logging to capture full execution histories. Complements breakpoint analysis for non-deterministic or multi-threaded targets.

Lesson 3 • Debugger Architecture and Concepts

Explains how debuggers attach to processes, handle exceptions, and control execution. Provides the conceptual model needed to use any debugger effectively.

Lesson 4 • Inspecting Program State

Teaches reading registers, memory, and the call stack at runtime to verify static findings. Students correlate live state with disassembly to confirm code behaviour.

Lesson 1 • Handling Compiler Optimizations

Identifies inlining, loop unrolling, and strength reduction artefacts in decompiled output. Students learn to mentally undo optimisations to recover original logic.

Lesson 2 • Recovering Data Structures

Reconstructs structs, unions, and class layouts from access patterns in decompiled code. Accurate structure recovery is essential for understanding object-oriented targets.

Lesson 3 • Decompiling Object-Oriented Code

Addresses C++ name mangling, virtual dispatch, and RTTI to recover class hierarchies. Extends decompilation skills to the majority of modern compiled software.

Lesson 4 • How Decompilers Work

Explains lifting to intermediate representation, type recovery, and pseudocode generation. Sets accurate expectations for decompiler output quality and limitations.

Lesson 1 • Virtualization-Based Obfuscation

Introduces custom VM protectors, bytecode dispatch loops, and handler identification. Students develop a methodology for partially reversing VM-protected code.

Lesson 2 • String and Data Obfuscation

Covers XOR encoding, stack-based string construction, and custom decryption routines. Students extract plaintext strings from obfuscated samples automatically and manually.

Lesson 3 • Automated Deobfuscation Approaches

Applies symbolic execution and taint analysis to automate deobfuscation at scale. Bridges manual techniques with tool-assisted workflows for complex targets.

Lesson 4 • Code Obfuscation Taxonomy

Catalogues junk insertion, opaque predicates, control-flow flattening, and substitution. Gives students a classification framework for identifying obfuscation on sight.

Lesson 1 • Fuzzing Integration with RE Findings

Uses RE-derived knowledge to build targeted fuzzing harnesses and seed corpora. Combines static insight with dynamic fuzzing to maximise vulnerability discovery.

Lesson 2 • Cryptographic Weakness Identification

Recognises weak algorithms, improper key handling, and custom crypto through static analysis. Students assess cryptographic security without access to source code.

Lesson 3 • Logic and Authentication Flaws

Locates authentication bypasses, improper state transitions, and race conditions through code review. Demonstrates how logic errors are as dangerous as memory bugs.

Lesson 4 • Documenting and Reporting Vulnerabilities

Structures vulnerability reports with reproduction steps, root-cause analysis, and impact ratings. Produces professional deliverables suitable for responsible disclosure.

Lesson 1 • Designing a Structured RE Methodology

Establishes a repeatable triage-to-deep-dive workflow for unknown binaries. Reduces wasted effort and ensures consistent coverage across large targets.

Lesson 2 • Symbolic and Concolic Execution

Applies constraint solving to explore execution paths and generate targeted inputs automatically. Extends manual analysis to path-coverage problems too large for manual review.

Lesson 3 • Binary Diffing and Patch Analysis

Compares binary versions to isolate patched functions and infer fixed vulnerabilities. Essential for patch-gap analysis and regression security testing.

Lesson 4 • Dynamic Instrumentation Frameworks

Uses dynamic binary instrumentation to insert analysis logic at runtime without source. Enables coverage measurement, taint tracking, and custom tracing at scale.