Program Analysis for Vulnerability Research

This four-day course trains students to do sophisticated program analysis using Binary Ninja and the Binary Ninja Python API for the purpose of vulnerability research with the goal of improving auditing processes, improving their ability to identify interesting code paths, and encoding bug primitives.

In the class, students will learn Binary Ninja inside and out by leveraging the Binary Ninja plugin architecture to identify vulnerabilities in a machine architecture-independent way. After taking this course students will have experience working with Binary Ninja to create powerful program analysis tools which can be used across architectures.

Dates of Course: November 29th through December 2nd, 2022

Location: On-Site in Arlington, VA. Details on sign up.

Registration Link

https://shop.binary.ninja/products/program-analysis-for-vulnerability-research-5-day-course

Topics Covered

• Using the UI, Reverse Engineering, Design Philosophy, Core Architecture (BN core arch/design)
• BV plugin development, Architecture plugin
• Normalization, IL Survey, BNIL ILs
• Undecidability, Program Correctness, Correctness with pointers, Formal Methods, Useful Binja Features, Jump Tables, SSA
• PHI nodes, Dominance Frontiers, and Data Sensitive Analysis
• Type Analysis, Constraint Solving, and Records, Lattice Theory, Sign Analysis, and Abstract Interpretation
• Constant Propagation, Fixed-Point Algorithms, Abusing Optimizations, and Flow-Sensitive Type Analysis
• Pointer Analysis, Abstract Interpretation, Interprocedural Analysis, Batch processing with Binja
• Pointers and Heap analysis

Learning Objectives

• Have a thorough grasp on the binary ninja python API
• Familiarity with many program analysis concepts and common challenges
• The ability to write sophisticated program analysis plugins unassisted
• An understanding of vulnerability primitives and methods of discovery

Required Materials

• A virtual machine running Ubuntu 20.04 or a OS which can run Binary Ninja  (Supported Platforms)
• Python 3.8+
• Familiarity with basic vulnerability classes such as stack-based buffer overflows, type confusion, sign extension vulnerabilities, etc.
• Basic to intermediate Python experience highly recommended.
• Temporary Personal Binary Ninja licenses will be provided but if you are purchasing one we recommend the Commercial license as it provides the headless API

Schedule

Each day will run from 9AM to 6PM on either Discord or Zoom for remote classes and on-site for in person classes. There are two lectures each day, each lecture will be applied to two main lab exercises, an easy and hard exercise, with homework that will be reviewed the following day. All times are in EST.

Day 1

Day 2

Day 3

Day 4

Day 5

(Condensed into Day 4 for our four day trainings)