Reverse Engineering 101

Learn navigation inside the assembly code, the difference between values and pointers, concepts of stack and heap, custom data types and shifted pointers! Get introduced to Golang and Rust reverse engineering – and finally, reverse ‘real’ malware to solidify your knowledge and skills!

Get introduced to reverse engineering by Kaspersky’s top experts from the Global Research & Analysis Team (GReAT), a group of the chosen few providing company leadership in anti-malware research.

All levels

$890 inc. tax per learner

All levels

$890 inc. tax per learner

Background

For computer science specialists, it is not always obvious where to apply their skills when building a stunning future career. Cybersecurity is one of the most in-demand types of expertise on the market. Businesses need it to protect themselves from malware attacks – according to a Kaspersky report, about one-in-three ransomware Trojan victims are corporate users.

‘Reverse Engineering 101’ by Kaspersky opens the door on the field for reverse engineering, a core skill for those wanting to build a career as a malware analyst or threat hunter.

The on-demand online format allows companies to upgrade staff without interrupting their work. Starting from the basic concepts, learners gradually move through Intel assembly instructions, distinctive calling conventions and memory types, executable analysis and more to finally reverse ‘real’ malware and solidify their knowledge and skills.

This course is a prequel to the next-level ‘Targeted Malware Reverse Engineering’ training also available on-demand.

Start your malware reverse engineering journey with Kaspersky!

Course leaders

Denis Legezo

Security Researcher

Denis Legezo is a GCFA certified cybersecurity professional who specializes in targeted attacks research, static reverse engineering.

Denis regularly provides training on these subjects and has presented his targeted malware research at SAS, RSA Conference, VirusBulletin, HITB.

Ivan Kwiatkowski

Security Researcher

Ivan Kwiatkowski is an OSCP and OSCE-certified penetration tester and malware analyst who has been working as a Senior Security Researcher in the Global Research & Analysis Team at Kaspersky since 2018.

He maintains an open-source dissection tool for Windows executables and his research has been presented during a number of global cybersecurity conferences. He operates an exit node of the Tor network and also delivers Kaspersky’s reverse-engineering training in Europe.

Overview & objectives

Gain the initial knowledge needed for malware analysis
Understand the main Intel assembly instructions
Understand different calling conventions (stdcall, fastcall) and memory types (automatic, dynamic, static)
Analyze executables generated by different compilers to become unafraid of more “esoteric” ones
Prepare yourself for the next level RE course

Syllabus

Download course program

Theory

Introduction to ASM
The Most Common ASM Instructions
Correspondence Between C Code And ASM
Solution: Reading ASM Code. Function calls
Calling Conventions
Solution: Understanding a full function. Wrap-up

C-Language 'Hello World'

Introduction
The Simplest C Program
First Steps With IDA
Working Without Debugging Symbols
Solution: First Steps With IDA. Windows API
Solution: Arguments And Constants. Wrap-up

Simple lambdas

Starting With Value Fields
Solution: Value Fields. Adding Pointers
Solution: Adding Pointer. Shallow And Deep Copying
Solution: Shallow And Deep Copying. Wrap-up

Stuck in the heap

Counting Hash Value
Solution: Counting Hash Value. Meet The Heap
Solution: Meet The Heap. Memory Management
Solution: Memory Management. Wrap-up

Lists and tricky pointers

Servers chain
Solution: Servers chain. List it till the end
Solution: List it till the end. Pointer to the insides
Solution: Pointers to the insides. Wrap-up

C++ and OOP

Introduction
Solution: A simple class
Virtual function table
Solution: C++ inheritance
The Decompiler
STL Library: The string class
STL Library: The vector class. Wrap-up

Pain in the containers

Commands as dictionary
Solution: Commands as dictionaries. Real handlers
Solution: Real handlers. make it set
Solution: make it set. Wrap-up

Introduction to golang reverse-engineering

Introduction
Solution: Golang basics. debuggers
Working with x64dbg
Reconstructing go code from the assembly
Controlling execution with debugger
Solution: The decryptor. Go reverse-engineering methodology

‘Rusty' code

Simplest esoteric decryptor
Solution: Simplest esoteric decryptor. Vector by reference
Solution: Vector by reference. Let’s be more rusty
Solution: Let’s be more rusty. Wrap-up

A 'real' malware

Introduction
Stage 1
Stage 2
Stage 3
Outro. Course summary

Who it’s for

Enterprises

If you are looking to beef up your SOC or cybersecurity team with a reverse engineer or malware analyst, this course will allow your IT staff to make a first step into reverse engineering malware.

Cybersecurity consultancies

The course benefits specialist consultancies who need to train their team in relevant practical skills to be able to offer malware analysis services to their clients.

Would-be InfoSec professionals

The course is designed to upskill individual learners looking to embark on a career in cybersec. While learning, you will develop reverse engineering potential and prepare yourself for more advanced steps.

How you'll learn

Guided video lectures

Practice in our dedicated GitHub repository, designed specially for the course.

Code snippets on GitHub

Practice in our dedicated GitHub repository, designed specially for the course.

Iterative learning

The course is structured around progressive learning with a consistent module framework based on specialist overviews of each task, practical work in GitHub and detailed solutions.

Benefits

Access

Six months to complete your course from activation of your access code

Language

Courses delivered in English with subtitles

Pace

Self-guided learning that fits around your life

Browser-based access to virtual lab

Browser-based access to virtual lab

Downloads

PDF downloads of training materials and tips

Learning environment

Browser-based via desktop, mobile & tablet (excludes virtual lab which requires an RDP client)

Course authors

Members of Kaspersky Global Research and Analysis Team (GReAT)

Guided videos

50+ videos to guide you through the course

Access to virtual lab

Dedicated GitHub repository for hands-on learning

Certificate of completion

PDF document on a Kaspersky letterhead certifying the completion of the course, signed by the course leader(s)