Introduction to reverse engineering and exploitation of binary programs

Lecturer: prof. Giovanni Lagorio (DIBRIS, Università di Genova)

When and where

PhD course lectures:

• 11/12/2017 14:30-18:30, room: 710 @ DIBRIS - Via Dodecaneso 35, I-16146, Genoa, Italy.
• 12/12/2017 14:30-18:30, room: 710 @ DIBRIS - Via Dodecaneso 35, I-16146, Genoa, Italy.
• 13/12/2017 14:00-18:00, room: 710 @ DIBRIS - Via Dodecaneso 35, I-16146, Genoa, Italy.
• 18/12/2017 14:00-18:00, room: 710 @ DIBRIS - Via Dodecaneso 35, I-16146, Genoa, Italy.

Abstract

The course introduces techniques and tools to reverse engineer and exploit x86/64 binary programs.

This course has a strong hands-on approach; proficiency in low-level C programming, and familiarity with operating system concepts are a must. Lectures will contain practical activities, therefore participants need to bring their own Linux laptops and set them up appropriately.

The exam consists in the exploitation of some 32/64-bit programs (a different set for each student), and a subsequent discussion of the used techniques and tools.

Laptop (VM?) setup

Assuming a Debian-based distro (examples tested on Ubuntu 16.04); tools:

• Radare2, my .radare2rc
• Pwntools
• Ropper
• Libformatstr
• American Fuzzer Lop

Installation instructions (except for AFL; just download the latest version and follow the quickstart guide)

Course contents and materials

The playlist of the lectures (in Italian) is available on Youtube.

• x86/x64 Assembly
  • Topics:
    • Introduction
    • x86 and x64 ISA
    • ELF and System V ABI
    • Compilation and linking process
    • Library Interposition
    • Process tracing
  • Slides
  • Files
  • Lectures on Youtube: Part 1, Part 2, Part 3 and Part 4
• Binary Reversing
  • Topics:
    • Introduction
    • Radare: The good, the bad and the ugly
    • ASLR
    • Suggested workflow
    • IOLI Crackmes
  • Slides
  • Files
  • Lecture on Youtube: Part 5
• Binary Exploitation
  • Topics:
    • Pwntools
    • Memory corruption attacks
    • Stack Canaries
    • Non-executable stack
      • Format-string attacks
      • ROP
    • Address-Space Layout Randomization
  • Slides
  • Files
  • Lectures on Youtube: Part 6, Part 7, Part 8, Part 9, Part 10 (few minutes of the recording are missing due to network error during streaming), Part 11 and Part 12
• Fuzzing
  • Topics:
    • Introduction
    • Installation and configuration
    • Using AFL
  • Slides
  • Files
  • Lectures on Youtube: Part 13