Xeno’s All You Can Learn Buffet [4-Day]

$4,299.00

Duration

4 days

Delivery Method

Guided Own Pace

Level

all levels

Seats Available

20

Duration

4 days

Delivery Method

Guided Own Pace

Level

all levels

REGISTRATION CLOSED 

DATE: 21-24 August 2023

TIME: 09:00 to 17:00 ICT/GMT+7

Date Day Time Duration
21 Aug Monday 0900-17:00 ICT/GMT+7 8 Hours
22 Aug Tuesday 0900-17:00 ICT/GMT+7 8 Hours
23 Aug Wednesday 0900-17:00 ICT/GMT+7 8 Hours
24 Aug Thursday 0900-17:00 ICT/GMT+7 8 Hours

Go HERE to take this class as a 3-Day Buffet course.
Go HERE to join just the x86-64 assembly class.
Go HERE to join just the x86-64 OS internals class.
Go HERE to join just the x86-64 Intel Firmware Attack & Defense class.


This class is run a little different from most classes. We provide you purpose-built recorded lectures instead of trapping you in realtime with live-lectures. But fear not, the instructor is always right there eagerly waiting to mingle with the students and answer any questions you have. (The instructor really likes being asked questions. It shows you’re paying attention ;)).
One of many benefits is that you can watch lectures at 2x speed and zoom ahead of the other students and get to the hands on labs quicker. Or if there’s bits of material you already know, you can just skip them and move on to the bits you don’t know! Another big benefit is that you get to take the full lectures and labs with you! That means if you forget stuff and then need it in 6 months, you can quickly re-bootstrap yourself! Or you can watch the class twice, to really grow those neural connections and cement it in your brain! And unlike live lectures, our lectures are always getting more factually accurate, by having any accidental errors edited out.

Because we give you all the lecture and lab materials and videos after class, what you’re really paying for is support from the instructor! So you’ll be entitled to keep asking up to 20 questions after class, with 1-2 hour turnaround answers (after accounting for time-zone differences.) This lets you keep productively working through the material if you run out of time at the conference. If you’d like to learn more about the benefits of this style of class delivery, please read this blog post

 

Key Learning Objectives
  • Learn the most common assembly instructions, which cover > 96%+ of all code found in most programs[1].
  • Learn about the 16 Intel x86-64 general purpose registers + RFLAGS.
  • Understand the at time confusing or counter-intuitive compiler-isms of both Microsoft Visual Studio, and GCC which lead to particular patterns in executables’ assembly.
  • Learn to debug and analyze executables which you don’t have the source code for, in both WinDbg and GDB.
  • Learning how to write C code and disassemble it to see what instructions were generated. But also learning how to write assembly to see how it behaves, or even raw bytes to see how the assembler and processor interprets it.
  • Being comfortable with Reading The Fun Manual (RTFM!) to go seek out the most accurate details of how things work.
  • Reverse engineer the black box Carnegie Mellon “Binary Bomb Lab”, which has changed the lives of so many students (the instructor included!) This is a *major* hands-on reverse engineering exercise (which can take anywhere from 2 hours to 2 weeks!) which has been shared the world over by thousands of students. This gives you something substantive to chew on even after class to really reinforce your understanding and capability to read assembly.

+

  • Understand how ring 0 (kernel) / ring 3 (userspace) privilege separation *really* works.
  • Understanding how to use CPUID to query the features available on your system, and how to read the Model Specific Registers (MSRs) to check which ones your OS has actually enabled.
  • Understand segmentation (and how it relates to privilege separation).
  • Understand interrupts (and how they pertain to system calls and debugging).
  • Understand system calls (and how they constitute a major attack surface of an OS).
  • Understand virtual memory and page table setup (and how it interacts with security mechanisms like XD, SMAP, and SMEP).
  • Understand how software and hardware breakpoints work.
  • Understand how port IO allows communication to legacy peripherals and VMWare’s control channel.
  • Being comfortable with Reading The Fun Manual (RTFM!) to go seek out the most accurate details of how things work.

+

  • Understand the original 16-bit “Real Mode” which the x86 CPU reset vector executes in.
  • Understand 16-bit segmentation & assembly.
  • Understand the evolution of Intel chipsets, and how to find the manual which corresponds to any given hardware.
  • Understand how firmware uses IO to configure Intel and 3rd party hardware at boot time.
  • Understand how firmware interacts with PCIe devices at boot time, both within the CPU/chipset, and 3rd party peripherals.
  • Understand the core purposes of PCIe Option ROMs, but also how they can be used by attackers.
  • Being capable of manually reading/writing the firmware-storage SPI flash through the register interface.
  • Understand the protection mechanisms for the SPI flash and how they can be bypassed.
  • Understand the protection mechanisms for System Management Mode how they can be bypassed.
  • Understand how Chipsec can be used to assess the security posture of a firmware for both attack and defense.
  • Understand how the ACPI S3 “sleep” power state can be used to attack systems.
  • Being comfortable with Reading The Fun Manual(!) to go seek out the most accurate details of how things work.

+

  • Learn to recognize the common programming errors that lead to (linear) stack/heap buffer overflows, (non-linear) out-of-bound writes, integer overflows/underflows, signedness issues (e.g. bypassing sanity checks due to signed comparisons, or integer truncation/extension errors), uninitialized data accesses, race conditions (e.g. double fetch and Time of Check, Time of Use (TOCTOU)), Use-After-Free (UAF), type confusion, and information disclosure.
  • Learn what options developers have in terms of prevention, detection, and mitigation for each vulnerability type.
  • A detailed walkthrough for the exploitation of at least one vulnerability per section. This is so that students can see that vulnerabilities that might otherwise seem unexploitable, are in reality exploitable.

 


Go HERE to take this class as a 3-Day Buffet course.
Go HERE to join just the x86-64 assembly class.
Go HERE to join just the x86-64 OS internals class.
Go HERE to join just the x86-64 Intel Firmware Attack & Defense class.

Why You Should Take This Course

  • Go HERE to take this class as a 3-Day Buffet course.
  • Go HERE to join just the x86-64 assembly class.
  • Go HERE to join just the x86-64 OS internals class.
  • Go HERE to join just the x86-64 Intel Firmware Attack & Defense class.

Who Should Attend

  • People who want to start their journey up the skill tree towards such professions as reverse engineering, malware analyst, vulnerability hunter, security researcher, OS engineer, or systems architect.
  • People who gain satisfaction from understanding how systems really work at a very deep level.
  • People who don’t have a lot of free time outside of work, and who thus want to use this time to hunker down and jam through all this material with full instructor support.

Key Learning Objectives

  • Prerequisite Knowledge

    This class has minimal prerequisites. It just requires that you are comfortable with reading small (< 20 line) C programs, and have debugged C source code in the past. If you know that, we’ll teach you everything else you need to know to scale the learning tree through beginner assembly, intermediate OS internals, and advanced firmware!

    Hardware / Software Requirements

    It will depend on which material you’ll be starting with, and how far you think you’ll be able to get. Please see each of the individual classes’ hardware requirements: x86-64 Assembly, x86-64 OS Internals, and x86-64 Intel Firmware Attack & Defense

    Your Instructor

    Xeno began leading Windows kernel-mode rootkit detection and defense research projects at MITRE in 2009, before moving into research on BIOS security in 2011. His team’s first public talks started appearing in 2013, which led to a flurry of presentations on BIOS-level vulnerabilities up through 2014. In 2015 he co-founded LegbaCore.

    And after presenting a firmware worm that could spread between Macs via Apple’s EFI-based BIOS and Thunderbolt Ethernet adapters, he ended up working for Apple. There he worked on securing all the lesser-known firmwares on Macs and peripherals – everything from 3rd party GPUs to SecureBoot for monitors! He also worked on the x86-side of the T2 SecureBoot architecture, and his final project was leading the M1 SecureBoot architecture – being directly responsible for designing a system that could provide iOS-level security, while still allowing customer choice to trust arbitrary non-Apple code such as Linux bootloaders. He left Apple in Dec 2020 after the M1 Macs shipped, so he could work full time on OpenSecurityTraining2