Everyday Ghidra: Practical Windows Reverse Engineering

John McIntosh
Virtual Training | July 20 - 26 | 32 hours

BOOK NOW

Everyday Ghidra. Practical Windows Reverse Engineering

John McIntosh

Book Now - Early Bird Rate USD 4000

Reverse engineering is a technique to understand the workings of software or hardware, often applied to enhance security or compatibility. It is fun, rewarding, and always challenging, especially when dealing with modern Windows closed-source binaries. Enter Ghidra, a robust software reverse engineering framework created by the NSA for in-depth analysis of complex binaries. Ghidra can help you perform in-depth analysis of Windows binaries using its rich set of features and tools. Whether you want to reverse engineer malware, understand software internals, or find vulnerabilities, Ghidra can handle it.

This course provides a comprehensive guide to using Ghidra, covering fundamental operations to advanced techniques, with hands-on exercises on real-world Windows applications. It’s designed for those with foundational Windows and security knowledge, aiming to equip them with practical “everyday” reverse engineering skills using Ghidra.

ABSTRACT

Reverse engineering is the process of uncovering the principles, architecture, and internal structure of a piece of software or hardware. It can be used for various purposes, such as improving compatibility, enhancing security, understanding program behaviour, and even vulnerability research. However, reverse engineering is also be challenging, especially when dealing with complex and modern Windows binaries.

That’s why you need Ghidra, a powerful open-source software reverse engineering framework developed by the National Security Agency (NSA). Ghidra can help you perform in-depth analysis of Windows binaries using its rich set of features and tools. Whether you want to reverse engineer malware, understand software internals, or find vulnerabilities, Ghidra can handle it, and this course will guide your steps.

In this course, you will learn how to use Ghidra effectively to reverse engineer Windows binaries. You will start with the basics of Ghidra, such as creating projects, importing and analyzing binaries, and using Ghidra’s native tools. You will then learn how to customize Ghidra to suit your needs, such as building custom data types and configuring optimal analysis. From there, you will complete progressively challenging labs that will teach you to apply static and dynamic analysis techniques to dive deep into Windows application behavior using Ghidra’s Windows-specific features and scripts.

The course will also provide you with a series of “everyday” reversing examples, covering several aspects of Windows reverse engineering. Your journey will involve reversing Windows malware, debugging a Windows RPC server, and even learning how to root cause a recent Windows CVE. You will also learn how to use other Windows specific RE tools, such as WinDbg, RPCView, and System Informer to complement Ghidra’s functionality.

By the end of this course, you will have gained practical skills and experience in reverse engineering Windows binaries using Ghidra. You will be able to apply these skills to your own projects, research, or career in cybersecurity.

This course is rated intermediate but suitable for beginners with heart. It is assumed that students have a basic knowledge of Windows, security, and assembly language. No prior experience with Ghidra is required.

Practical Exercises:

• Reverse Engineering Windows Malware - Learn to statically analyze a Windows malware sample and identify its malicious behavior, such as persistence, network communication, and obfuscation.
• Dynamically Debugging a Windows RPC Server - Gain insight to into Windows RPC and learn how to dynamically inspect a Windows RPC server with Ghidra’s Debugger.
• Patch Diffing and Root Cause Analysis of a Windows CVE - Learn how to use Ghidra’s Patch Diffing to compare two versions of a Windows binary and identify the changes made to fix a vulnerability. You will learn how to root cause the vulnerability and understand its exploitation.

INTENDED AUDIENCE

KEY LEARNING OBJECTIVES

• Ghidra Proficiency: Gain comprehensive skills in using Ghidra for static and dynamic analysis of Windows binaries.
• Tool Mastery: Master Ghidra’s primary tools—Code Browser, Debugger, and Version Tracking—to tackle diverse reverse engineering tasks.
• Enhanced Analysis Techniques: Learn to create custom data types and leverage Ghidra’s PDB support to deepen analysis capabilities.
• Malware Behavior Identification: Develop the ability to reverse engineer and analyze Windows malware, identifying key behaviors like persistence and network communication.
• Vulnerability Assessment: Use Ghidra’s patch diffing feature to compare binary versions and pinpoint changes addressing modern vulnerabilities.
• Dynamic Debugging: Acquire the skills to dynamically debug Windows applications, enhancing problem-solving techniques in live environments.

COURSE DETAILS