Reverse Engineering for Red Teamers

Course Synopsis

A hands-on, two-day course that turns assembly and binaries from a wall of hex into an operational advantage for offensive teams. Ten modules take you from reading x64 assembly through .NET and CIL, the tooling, the PE format, thick-client protocols, Windows internals, building your own tradecraft, EDR internals, and vulnerability research, finishing with a full-chain capstone on a live target.

You work in IDA, dnSpy, x64dbg, WinDbg, Frida, NetHook, CallHook, and Charles Proxy throughout. Every module opens with objectives and closes with hands-on exercises, each followed by a detailed solution walkthrough.

Register for the training →

Day 1 - Foundations

Module 01

Introduction to Assembly

x64 Registers and the CPU Model

  • 16 general-purpose registers: RAX through R15, addressable at 64/32/16/8-bit widths
  • RIP as the instruction pointer and RSP as the stack pointer
  • CPU flags: ZF, SF, CF, OF and what they drive
  • Volatile versus non-volatile registers and what the calling convention requires
  • Anatomy of an x64 instruction, and Intel versus AT&T syntax

The Stack and Calling Conventions

  • x86 cdecl, stdcall, and thiscall versus x64: RCX, RDX, R8, R9 and shadow space
  • Function prologue and epilogue, and why functions are built this way
  • Reading locals and arguments at frame-pointer offsets
  • Frameless, RSP-relative optimized code
  • RAX as the return value

Core Instructions and Control Flow

  • Data movement: mov, lea, movzx, movsx
  • Arithmetic and logic: add, sub, imul, xor, shl/shr
  • cmp and test, the CPU flags in depth, and the signed versus unsigned Jcc family
  • Memory operands and addressing modes
  • Switch tables versus CMP chains, struct member access, and C++ virtual method dispatch

Reading Code in IDA

  • Text view versus graph view, cross-references, and call graphs
  • Renaming variables and functions as you build understanding
  • The decompiler and when to distrust it
  • Compiler optimizations and recognizing transformed code
  • Anti-disassembly techniques, and recognizing crypto and encoding loops
  • Hands-on: predict a return value, identify the convention and arguments, map the stack frame, and reverse a custom encoding function
Module 02

.NET and CIL

The CLR Execution Model

  • Managed versus native code, and the anatomy of a .NET assembly
  • Metadata and tokens
  • How the CLR loads an assembly and JITs CIL into native code
  • CIL as a stack machine, and the common opcodes
  • Objects and calls in IL, and mapping C# to IL and then to native
  • The managed and native interop boundary

Reversing .NET in dnSpy

  • Navigating assemblies, types, and methods
  • Reading CIL: ldarg, ldloc, call, callvirt, newobj, and friends
  • Seeing the JIT-compiled native code alongside the managed IL
  • Patching a .NET binary and rebuilding the assembly

Obfuscation and Recovery

  • String obfuscation patterns and how to recognize them
  • Automated .NET deobfuscation and its limits
  • Analysing reflection and late binding
  • Finding crypto keys embedded in managed code
  • Hands-on: predict an IL result, map C# to IL, recover a .NET secret, and decrypt string obfuscation
Module 03

The Tooling

Three Ways to Look at a Binary

  • Static analysis, live debugging, and traffic interception, and when each answers the question fastest
  • Choosing the right tool for the target

Static and Managed Analysis

  • IDA for native static analysis: layout, triage, imports and exports
  • The IDA decompiler and debugger
  • dnSpy for managed .NET targets

Live Debugging and Instrumentation

  • x64dbg: conditional breakpoints, logging breakpoints, and execution tracing
  • WinDbg: kernel debugging setup and symbols
  • Frida: dynamic instrumentation for protocol reverse engineering

Traffic Interception and Scripting

  • NetHook: hooking application calls before encryption to capture plaintext traffic
  • Charles Proxy: TLS interception
  • IDAPython: scripting your analysis and automating crypto routine detection
  • Hands-on: patch a .NET license check, intercept an API credential, and script the discovery of every string-decrypt call site
Module 04

PE and MZ File Format

Headers and Structure

  • The MZ/DOS header and the pointer to the NT headers
  • IMAGE_FILE_HEADER: machine type, section count, characteristics
  • The optional header: identity fields, image base, entry point, and layout and size fields
  • Data directories as the index map into the rest of the file
  • Section headers, the common sections and their roles, and RVA to file offset translation

Export Table

  • IMAGE_EXPORT_DIRECTORY and the three parallel arrays
  • Export by name, by ordinal, and forwarder exports
  • Manual export resolution in code

Import Table

  • The IMAGE_IMPORT_DESCRIPTOR chain, one entry per imported DLL
  • ILT versus IAT: what the loader overwrites at load time
  • Import by name versus import by ordinal
  • Walking a live process IAT with the course tooling

Other Data Directories

  • The exception directory and x64 table-based unwind information
  • The TLS directory and TLS callbacks as early execution hooks
  • The base relocation directory and how ASLR works at the format level
  • Hands-on: dump the exports of a system DLL, and walk a live process IAT
Module 05

Reversing Thick Clients and Protocols

MS-TDS and SQL Server

  • Why thick-client protocol reverse engineering pays off
  • The PRELOGIN and LOGIN7 handshake structure
  • The LOGIN7 password obfuscation algorithm, step by step, with a worked decode
  • TLS inside TDS and why an interception approach still works in most deployments
  • Other protocols worth intercepting

Windows Authentication

  • The Windows authentication landscape
  • NTLM: NEGOTIATE, CHALLENGE, AUTHENTICATE, the three-message handshake
  • NTLMv1 versus NTLMv2 response computation
  • Capturing NetNTLM hashes and cracking them offline
  • NTLM relay: why the protocol allows it
  • SMB2/3 protocol structure, IPC$ and named pipes, and SMB3 signing and encryption
  • Kerberos on the wire, briefly

RPC in Depth

  • MS-RPC and DCERPC: framework, transports, and high-value interfaces
  • IDL: the interface definition language and what MIDL generates from it
  • Reading MIDL and NDR stubs in IDA, and the NDR marshaling wire format
  • Named pipe transport, binding handles, and authentication
  • Server-side opnum dispatch
  • Building an RPC client in C and identifying the operation it invokes

Extracting Embedded Secrets

  • Connection strings and hard-coded credentials in .NET assemblies
  • Secrets in native binaries: string search, entropy, and configuration parsing
  • Combining traffic interception with binary analysis to recover plaintext keys

The TrueCyber Tooling

  • NetHook: the injection mechanism, the hook points, and the live capture workflow
  • CallHook: tracing API calls, filters, and reading the output
  • ExportFinder: enumerating a DLL export table and searching a folder for a given export
  • Hands-on: decode a TDS password, recover a .NET-stored password, find connection-string credentials, extract NetNTLMv2 from SMB, identify an RPC operation, and run all three tools against a live target
Module 06

Windows Internals

The DLL Ecosystem and Syscall Boundary

  • IAT and EAT, forwarder exports, and ApiSet redirection from kernel32 to kernelbase
  • The user and kernel transition: ntdll Nt and Zw stubs and the system service number
  • The canonical ntdll syscall stub, and context saving on kernel entry
  • The service descriptor table and mapping system service numbers to kernel functions
  • Ring model and CPL, control registers CR0, CR3, and CR4, MSRs, the IDT and GDT, privileged instructions, and SWAPGS

PEB, TEB, and Key Structures

  • The PEB in depth, and why it is the red teamer's entry point
  • PEB.Ldr and LDR_DATA_TABLE_ENTRY: resolving DLL bases without imports
  • Walking the EAT without GetProcAddress, the shellcode pattern in full
  • What IsDebuggerPresent actually does, plus NtGlobalFlag and heap flag anti-debug
  • Process parameters: command line and environment
  • TEB: per-thread state, x86 SEH versus x64 table-based exception handling, and TLS slots
  • The VAD tree, the object manager, token privileges, section objects, and per-CPU kernel structures

COM and RPC Interfaces

  • COM: CLSID, IID, IUnknown, and recognizing vtable dispatch in disassembly
  • Listing COM DLLs, finding CLSIDs, and reading exposed methods from a type library
  • Enumerating COM servers with the course tooling
  • RPC transports and interfaces, and reading RPC stubs in IDA

ETW and Embedded Detection

  • Where telemetry is embedded in the operating system itself
  • The classic EtwEventWrite patch point and how it works
  • Hands-on: trace a syscall in ntdll, blind ETW and resolve a COM slot, and enumerate kernel32 forwarders

Day 2 - Offense, Defense & Research

Module 07

Malware Tradecraft: Build Your Own

String Obfuscation

  • Why plain strings give a payload away
  • Implementing XOR string obfuscation in C
  • A full RC4 string obfuscation implementation and its build pipeline

API Hashing and Resolution

  • Zero-import loaders and why API hashing exists
  • Implementing a custom API hash function
  • Building an API resolver: a PEB walk plus an EAT search, end to end

Position-Independent Code and Injection

  • PIC design rules and what breaks position independence
  • A kernel32 finder in assembly through the PEB loader list
  • Writing a PIC shellcode stub in C
  • Process injection with CreateRemoteThread and with queued user APCs
  • Process hollowing: the full chain, the context patch, and the resume

Crypters and Anti-Analysis

  • An XOR crypter: encrypt at build, decrypt at runtime
  • An RC4 crypter: key derivation and the decryption stub
  • Implementing your own anti-analysis gates in C
  • An RDTSC timing gate

Delivery Architecture

  • Beacon architecture and C2 communication patterns
  • Stage-0 loader architecture and staging
  • Hands-on: build a string obfuscator, implement a custom API resolver, write and inject shellcode, and upgrade an XOR crypter to RC4
Module 08

EDR Internals and Bypass Techniques

What EDR Actually Sees

  • The telemetry layers: user-mode hooks, kernel callbacks, minifilters, and ETW
  • How products combine those layers and what each one contributes

User-Mode Hooks

  • Inline hook mechanics, and hook types beyond the classic five-byte jump
  • Finding and enumerating hooks, and the architecture of a hook finder in C
  • Unhooking and direct syscalls, and why direct syscalls alone are not enough

Kernel Sensors

  • Process, thread, and image load callbacks
  • Object and registry callbacks and handle access control
  • Minifilters: file and volume I/O interception
  • Early launch anti-malware and driver load ordering
  • Reading a driver in IDA and identifying its callback registrations
  • Loading kernel symbols in IDA and resolving a system service number to its kernel function

ETW Internals and ETW-TI

  • ETW architecture from producer to consumer
  • From EtwEventWrite into the kernel, and the ETW kernel structures
  • ETW-TI: kernel-enforced threat intelligence logging, and its assembly evidence in ntdll and ntoskrnl
  • The key security providers and what each exposes
  • Building an ETW collector and a call stack monitor in C
  • Hands-on: detect hooks, decide whether an export is hooked, collect ETW events, monitor a call stack, work out what a driver watches, and identify a minifilter
Module 09

Reversing for Research

Attack Surface and Unsafe Functions

  • The research mindset and mapping the attack surface of a target
  • Known-unsafe functions and the shapes they leave in disassembly
  • Tracking attacker-controlled input from source to sink through a call graph
  • Triaging a crash and separating exploitable from non-exploitable

Memory Safety Bug Patterns

  • Stack buffer overflow: recognizing an insufficient bounds check from assembly alone
  • Format string bugs and the write primitive they hand you
  • Integer and signedness bugs: mismatch, truncation, and wraparound
  • Use-after-free and double-free patterns in assembly
  • Identifying each of these with no source code available

IOCTL Interface Analysis

  • The CTL_CODE macro: device type, function code, transfer method, and access bits
  • Transfer methods and how data actually moves into the driver
  • IO_STACK_LOCATION: what the driver reads out of the IRP
  • Reversing IOCTL handlers in IDA, and the recurring vulnerability patterns
  • Driver models: WDM versus KMDF, the dispatch table, and the device control callback
  • Tracing IOCTL call chains in WinDbg and analysing kernel-mode call stacks

Patch Analysis and Binary Diffing

  • Binary diffing fundamentals
  • Diffing a security patch with TrueDiffing and reading the result
  • The n-day workflow, and text diffing alongside binary diffing
  • Hands-on: six exercises from an easy overflow through an IOCTL handler audit to a patch diff
Module 10

Capstone: Full-Chain Challenge

Scenario: The TrueBank Client

  • One target, every skill: a thick-client banking application end to end
  • Five checkpoints: recon and triage, decode the login, recover the secret, map the EDR hook, and find the vulnerability
  • Applies assembly reading, tooling, protocol decode, Windows internals, tradecraft, EDR awareness, and bug hunting against a single target
  • A full debrief on how the individual findings chain together

Assembly-Level Bug Hunting

  • The method, applied without source or symbols
  • Compiler patterns that hide bugs
  • Identifying stack versus heap allocations in disassembly
  • Heap overflow through an attacker-controlled length field
  • A final assembly audit challenge
Register for the training → Buy the bundle →