Breadcrumb
  1. Training
  2. Education & Training Catalog
  3. OpenSecurityTraining.info
  4. The Life of Binaries

The Life of Binaries

Topics include but are not limited to:

  • Scanning and tokenizing source code.
  • Parsing a grammar.
  • Different targets for x86 assembly object files generation. (E.g. relocatable vs. position independent code).
  • Linking object files together to create a well-formed binary.
  • Detailed descriptions of the high level similarities and low level differences between the Windows PE and Linux ELF binary formats.
  • How an OS loads a binary into memory and links it on the fly before executing it.

Along the way we discuss the relevance of security at different stages of a binary’s life, from the tricks that can be played by a malicious compiler, to how viruses really work, to the way which malware “packers” duplicate OS process execution functionality, to the benefit of a security-enhanced OS loader which implements address space layout randomization (ASLR).

Lab work includes:

  • Using the new “Binary Scavenger Hunt” tool which creates randomized PE binaries and asks randomized questions about the material you just learned!
  • Manipulating compiler options to change the type of assembly which is output.
  • Manipulating linker options to change the structure of binary formats.
  • Reading and understanding PE files with PEView.
  • Reading and understanding ELF files with Readelf.
  • Using WinDbg and/or GDB to watch the loader dynamically link an executable.
  • Using Thread Local Storage (TLS) to obfuscate control flow and serve as a basic anti-debug mechanism.
  • Creating a simple example virus for PE.
  • Analyze the changes made to the binary format when a file is packed with UPX.
  • Using the rootkit technique of Import Address Table (IAT) hooking to subvert the integrity of a program’s calls to external libraries, allowing files to be hidden.

Provider Information

More courses from this provider:
Contact Information

OpenSecurityTraining.info
10901 Rhode Island Ave.
PO Box 281
Beltsville, MD 20704

Course Overview

Overall Proficiency Level
2 - Intermediate
Course Catalog Number
OST_LoB1
Course Prerequisites

Recommended, but not required, to have taken Introduction to x86 and Intermediate x86

Training Purpose
Skill Development
Specific Audience
All
Delivery Method
Online, Self-Paced
  • Online, Self-Paced

Learning Objectives

  • Do a deep dive into the big picture of how binaries are executed on most OSes.
  • Provide detailed information about Windows/Linux binary formats which will be useful to future reverse engineers.
  • Show the security-relevance of knowledge about all stages of a binary's life.

Framework Connections

The materials within this course focus on the NICE Framework Task, Knowledge, and Skill statements identified within the indicated NICE Framework component(s):

Specialty Areas

  • Technology R&D

Specialty Areas have been removed from the NICE Framework. With the recent release of the new NICE Framework data, updates to courses are underway. Until this course can be updated, this historical information is provided to give better context as to how it can help you with your cybersecurity goals.

Feedback

If you would like to provide feedback on this course, please e-mail the NICCS team at NICCS@mail.cisa.dhs.gov(link sends email). Please keep in mind that NICCS does not own this course or accept payment for course entry. If you have questions related to the details of this course, such as cost, prerequisites, how to register, etc., please contact the course training provider directly. You can find course training provider contact information by following the link that says “Visit course page for more information...” on this page.

Last Published Date:

You have been selected to participate in a brief survey about your experience today with National Initiative for Cybersecurity Careers and Studies.

Would you like to participate in our survey?

If you accept you will be leaving the National Initiative for Cybersecurity Careers and Studies website and going to a third party site.
That site may have different privacy, security and accessibility policies than the National Initiative for Cybersecurity Careers and Studies site.
National Initiative for Cybersecurity Careers and Studies does not endorse any commercial products, services, programs or content on the third party website.
Thank you for visiting our site. We hope your visit was informative and enjoyable.