دوره جامع مهندسی معکوس پیشرفته

— Introduction to Programming Paradigms 
i. Inline
ii. Procedural
iii. Object Oriented
iv. Generic Development
v. Concurrent Programming
vi. Event-Driven Programming
— Inline Programming Paradigm 
i. Machine Language
ii. Assembly Language
iii. Interpreter, Compiler and Assembler
iv. Static and Dynamic Linking Libraries
v. Opcode (Processor) Decoding
— Procedural Programming Paradigm 
i. Variables
ii. Arrays and Pointer
iii. Structures and Unions
iv. Functions and Headers
— Object Oriented Programming Paradigm 
i. Namespaces
ii. Classes and Objects
iii. Inheritance and Polymorphism
iv. Templates and Virtual Functions
v. Protected, Private and Public Access
— Generic Software Development 
i. Overloading
ii. Function Template
iii. Classes Templates
iv. Auto Deduction
v. Instantiation
— Concurrent Programming Paradigm
i. Concurrency Scheme
ii. Process-Based Concurrency
iii. Threads-Based Concurrency
 

—  Software Engineering Technologies
i. Compilers 
ii. Linkers
iii. Interpreters
iv. Virtual Machines
— Browser Technologies
i. Browser Engines
ii. JavaScript Engines
— Compilers and Linkers
i. Preprocessor
ii. Optimizer
iii. Compiler
iv. Linker
— Interpreters
i. Intermediate Language
ii. IL Interpreters
— Java Virtual Machines
i. Java Virtual Machine
ii. Java Bytecode
iii. JVM Opcode
— Microsoft Virtual Machines
i. Microsoft Common Language Runtime
ii. Intermediate Language
iii. JIT Compiler
— Hypervisors or VMM
i. Virtual Machine Monitor
ii. Types of VMM
iii. Hypervisor Networking Adapters
 

— Vulnerability
i. Zero-day
ii. One-day
— CVE and CVSS
— Exploit and Exploitation
i. Remote Exploits
ii. Local Exploits
iii. Privilege Escalation
— Shellcode/Payload
— Malicious Software
i. User-Mode Malware
ii. Kernel-Mode Malware
iii. ICS/Embedded Malware
 

— Antivirus
— Firewall
— IDS/IPS
— UTM Solutions
— DLP and EDR
— SIEM Systems
— Cloud Protections
 

• Integrated Development Environment
• Compile and Linking of the Project
• Debugging of the Project
• Introduction to Programming Language
  • Introduction to Algebra
  • Mathematical Thinking
• Overview of the C Language

1. Introduction to C
2. Why we need C?
3. C ISO Standards

• Problem Solving and Solution Engineering 

1. Problem Solving Phases
2. First I/O Program
3. Debugging the Project with GDB in Eclipse

• Compile and Preprocessing

1. What is Preprocessing?
2. GCC/MSVC Compiler Phases
3. Headers and Implementation

• Machine Memory and Addressing

1. Memory Addresses
2. Declaration and Definition
3. Variable Data Types and Their Size
4. Expressions and Statements

• Advanced C-based Data Types

1. Void Data Type
2. Boolean Data Type
3. Strings Data Type

• Procedural Programming with C

1. C-based Functions
2. Return Value of Functions
   1. Return Value Analysis with Radare2 
   2. Return Value Analysis with Hopper
3. Recursive Function
   1. Recursive Analysis with GDB
   2. Recursive Analysis with Radare2 
   3. Recursive Analysis with Hopper
4. Challenge Development

• Conditional Statements

1. Nuclear Program Implementation
   1. If-else statement
   2. Switch statement
   3. Runtime Error Handling
   4. Disassembly analysis with Hopper
2. Challenge Development

• Loop and Repeation Statements

1. Repeator Program Implementation
   1. For-loop
   2. While-loop
   3. Do-while-loop
   4. Breaking and Continue
   5. Disassembly analysis with Hopper
2. Challenge Development

• Structures, Enumeration and Unions

1. Declaration, Definition and Identifier
2. Pointers to Functions and Its Disassembly
3. Unions and Its Initialization Issue
4. Enumeration and Simulating an ICS Environment 

• Dynamic Memory Management

1. Heap Memory Layout
2. Memory Allocation
3. Memory Management
4. Stack vs. Heap
5. Disassembly Analysis of Malloc
6. Basics of Linked Lists Data Structure
7. Macros and Logging with Functions Like Macros
8. Pointers to Functions and Its Disassembly Formation

— Introduction to Microsoft C++
• Microsoft Visual Studio IDE
• Visual Studio Debugger
— Introduction to C++ and OOP
• What is C++?
• What is a Multiparadigm Language?
• C++ Programming Approaches
• C++ Programs Type
— Fundamental and User Data Type
• Fundamental Data Types
• Data Type Casting
• User Defined Data Types
— Classes and Objects
• Classes and Objects
• Inheritance and Access Modifiers
• Namespaces and Enumerations
— Conditions and Repeations
• If and Else
• Switch Cases
• For and While loop
• Range based for loop
• Visual Studio Arguments Settings 
— Memory Addressing
• What is a Pointer?
• Pointers to Pointers
• C++ References
• Memory Analysis for References
— Translation Phases
• Preprocessing – Microsoft Preprocessor
• Compiling – Microsoft C++ Compiler and Optimizer
• Optimizing – Microsoft C++ Optimizer 
• Assembling – Microsoft Assembler / MASM
• Linking – Microsoft Linker
• Visual Studio Project Settings
— Pre-processoring and Preprocessor
• What is Preprocessing?
• Why Preprocessing is important?
• Introduction to Translation Phase
• Preprocessing Directives
— Debugging and Disassembling
• Reverse of Compilation Process
• Disassemblers Tasks
• Disassemblers Types

•  Capstone Engine
• IDA Disassembler
• Radare2 Cutter

• Visual Studio Built-in Debugger
• Standalone Debuggers

•  OllyDBG
•  ImmDBG
• x64DBG

— Overloading Feature
• What is Overloading?
• What is an Operator?

•  Why is it Important?
•  Function Overloading
• Class Member Overloading
•  Operator Member Overloading

— Templates - Metaprogramming
• What are Templates?
• Why is it Important?
• Standard Template Library
— Constants and const keyword
• What is Const Qualifier?
• Why is it Important?
— Free Store or Heap Memory
• Free Store / Heap Memory
• Dynamic Memory Allocation
• Smart Pointers and Automatic Memory Management
— Standard CPP Containers 
• Std::Vectors
• Std:Deque
• Std::List and std::forward_list
• Std::Map and Std::Multimap
• Std::Set and Std::Multiset
• Std:Pair
• Std:Stack
• Std:Queue
— Static and Mutable Storage Class
• Storage Classes
— Polymorphism and Its Types
• Compile-time Polymorphism
• Run-time Polymorphism
• Coercion Polymorphism
• Ad-hoc Polymorphism
— Lambda Expression
• Lambda Calculus
• Lambda Expression
— Exception Handling
• Different Model of Handling
• C++ Exception Handling
• Runtime Exceptions
• Stack Unwinding
• Structured Exception Handler
• Assert and Static Assert
— Modern CPP Standard Coding
• Linux Environment
• CPP Code Refactoring
• Template Deduction
— Input and Output File Stream
• File Systems
• C++ Streams
• Output File Stream
• Input File Stream
— C++ Technical Concepts
• Binding
• Callbacks
• Problem Solving with Polymorphism
• Translation Unit Testing
• Unit Test Frameworks
— Introduction to Iterators
• STL Components

•  Algorithms
• Containers
• Iterators

— Introduction to Algorithms
• What is an Algorithm?
• Algorithm Characteristics
• Algorithm Standard Members
— C++17 Language Changes
• Type Inference
• Fold Expressions
• Expression Type
• Advanced Semantics
• Conditional Return Value
• Compile-Time Rational Arithmetic
• Pseudo-Random Number Generator
• Filesystem Support
— Concurrency and Parallelism
• What is a Concurrency?
• What is a Parallelism?
• Concurrent Programming

•  Asynchronous Tasks 
•  Multithreading Overview
•  Race Condition and Data Races
•  Mutual Execution Policy
• Deadlock Program Death

• Sharing and Coordinating

• std::mutex
• Condition Variables
• Future, Promise and Async
•  Packaged Tasks

• Low-Level Concurrency Facilities

•  std::this_thread::get_id
•  std::this_thread::sleep_for
•  std::this_thread::sleep_until

• Parallel vs Concurrency

•  Concurrency Application
•  Parallelism Application
•  Parallelism Policies

• Lock-Free Programming
— Boost Library Features
• Boost Library Utilities

•  Any 
•  Variant
• Optional
•  PropertyTree 
• Tribool Logic

• Boost Networking

•  Introduction to Networking
•  ASIO Network Programming Model
• The Hypertext Transfer Protocol (HTTP)
• Multithreading Boost Asio
   

• C++ Windows Platform Specific Libraries
  • Static Libraries
    • File Format
    • Compile-time Resolution
    • Load-time Resolution
    • Creating a Static Libraries
    • Linking Static Libraries to Projects
  • Dynamic Libraries
    • File Format
    • Resolution Time
    • Linkage Methods
    • Declaration Specification
• Windows Application Programming Interfaces
  • Windows System Programming
  • User-Mode and Kernel Mode
  • Processors Rings
    • Ring -2 – Godemode
    • Ring 0 – Kernel
    • Ring 3 – User & Application
  • Kernel Interfaces – APIs
    • WinAPIs
    • Posix Interfaces
    • Cocoa Interfaces
  • Creating a Window
    • Windows-Subsystem
    • Console-Subsystem
    • MessageBox API
    • Main and WinMain
  • Different Approaches of Programming
    • Standard Development
    • Native Development
    • System Call Process
• Characters Encoding and Characters Sets
  • Encoding Terms
    • Code Unit
    • Code Point
    • Byte Order
    • Code Pages
    • Hexadecimal Representation
  • Multibyte Encoding Standards
    • ASCII
    • Shift-JIS
    • Advantages and Disadvantages
  • Universal Encoding
    • Unicode 1.0
    • Unicode 2.0
    • Unicode 3.0
    • Advantages and Disadvantages
  • Visual Studio Settings
    • Multibyte Character Set
    • Unicode Character Set
    • String Parsing Methods
    • UTF Comparison
  • Developing an International Program
    • Change Code Page of CMD
    • Change Locale
    • Hello World in Persian
    • Generic Data Type
• Windows Error Handling Mechanism
  • How WinAPI Error Handler Works?
    • Thread Environment Block
    • WinError.h Library
  • GetLastError API
    • API’s Return Value
    • WinError Macros
  • SetLastError API
  • FormatMessage API
  • Practical Project:
    • GUI based Error Handler App
    • CUI based Error Handler App
  • CUI based Application
    • Subsystem: Console
    • EntryPoint: main & wmain
    • EntryPoint: mainCRTStartup & wmainCRTStartup
    • Console Host Infrastructure
  • GUI based Application
    • Subsystem: Window
    • EntryPoint: WinMain & wWinMain
    • EntryPoint: WinMainCRTStartup & wWinMainCRTStartup
    • Windows Explorer Infrastructure
• Windows Kernel Objects
  • Windows Objects
    • GDI Objects
    • User Objects
    • Kernel Objects
  • Kernel Objects
    • Creating Objects
    • manipulating Objects
    • Handle Objects
    • Sample Kernel Objects
    • Analysis and Synthesis
• Process Kernel Object
  • Process Instance Handle
    • Relative Addressing
    • ImageBase Address
    • GetModuleHandle API
    • HInstance and Hmodule
    • Executable File Resources
  • Process Environment Variables
    • Windows Registry Environment Data
    • Process Environment Block
    • Environment Variable’s API
    • Windows Typedefs
    • Windows Version and Edition
  • Process Handle Tables
    • Handle Object
    • Process-based Handle
    • Mutual Execution Object
    • Windows Kits and SDKs
  • Process Kernel Object
    • Process Overview
    • Process Components
    • Primary Thread
    • Thread Scheduling
    • Windows Application Subsystem
    • Process Property
  • Creating Process Kernel Object
    • Multi-process Application
    • Process APIs
    • Process Structures
    • Process Creation Flags
    • Process Search Paths
    • Parent-Child Debugging Issues with OllyDBG
    • Process Termination Issue
  • User Access Control (UAC)
    • Introduction to UAC
    • Executable Manifest File
    • Access Privilege Types
    • TOKEN_ELEVATION_TYPE
    • Privilege Token APIs
    • Reversing a Real Project
• Job Kernel Object
  • Job Object Overview
    • Why we need Job Object?
    • Linux Philosophy
    • Windows Philosophy
  • Creating Job Object
    • CreateJobObject API
  • Placing Restrictions on a Job's Processes
    • Restriction Types
    • SetInformationJobObject
  • Placing a Process in a Job
    • CreateProcess API
    • Primary Thread Suspend
    • AssignProcessToJobObject API
  • Terminating All Processes in a Job
    • TerminateJobObject
  • Querying Job Statistics
    • QueryInformationJobObject API
    • GetQueuedCompletionStatus API
    • GetProcessIoCounters API
  • Job Notifications
    • Job Event Notifications
• Thread Kernel Object
  • Introduction to Threads
    • Thread Kernel Object
    • Thread Stack
    • Thread Local Storage
  • Thread HandleThreads Infrastructure
    • Windows Thread
    • Linux Thread
  • Primary Thread Invocation
    • Unicode and Ascii
    • Thread Internals
  • Preemptive Operating System
    • Special Windows Services
    • Scheduler Priority Classes and Levels

• System Dynamic Boost Priority
• Windows Affinities
• User-Mode Synchronization
  • What is Synchronization?
    • User Mode Synchronization
    • Kernel Mode Synchronization
  • Atomic Access
    • Interlocked API
    • Atomic Variables
    • LOCK Prefix
  • Cache Lines
    • Cache Memory
    • Caching Problems
    • Caching Solutions
  • Critical Sections
    • CriticalSection vs Mutex
    • Atomic and Exclusive Access
    • CRITICAL_SECTION Object
    • Critical Section with Spinlock
  • Slim Reader/Writer (SRW)
    • SRWLock vs CriticalSection
    • SRWLock function
  • Condition Variables
    • Release a Lock
    • Enter Sleeping State
    • WakeOne and WakeAll
    • CONDITION_VARIABLE Object
• Kernel-Mode Synchronization
  • What is difference between KMS and UMS?
    • Performance
    • Limitations
  • Kernel Object Characteristics
    • Kernel Objects
    • Kernel Objects States
    • Wait Functions
    • Primary Thread Wait State
  • Event Kernel Objects
    • Event Types:
    • Event States
    • Events Usage in Producer-Consumer Model
  • Waitable Timer Kernel Objects
    • Signaling Model
    • Waitable Timer Types
    • Waitable Timer APIs
    • Waitable Timers Queue APC Entries
    • Semaphore Kernel Object
    • Mutex Kernel Object
• Asynchronous IO and IO Completion 
  • Synchronous IO vs Asynchronous IO
  • Windows IO Devices
  • Opening and Closing Devices
  • A Detailed Look at CreateFile
    • CreateFile Cache Flags
    • Miscellaneous Flags
    • File Attribute Flags
    • Working with File Devices
  • Performing Synchronous Device I/O
    • Flushing Data to the Device
    • Synchronous I/O Cancellation
  • Basics of Asynchronous Device I/O
    • The OVERLAPPED Structure
    • Asynchronous Device I/O Caveats
    • Canceling Queued Device I/O Requests
    • Receiving Completed I/O Request Notifications
    • Alertable I/O
    • I/O Completion Ports
    • Creating an I/O Completion Port
    • Associating a Device with an I/O Completion Port
    • Architecting Around an I/O Completion Port
    • How the I/O Completion Port Manages the Thread Pool
    • Introduction to the Windows Thread Pool
• Windows Memory Management
  • A Process' Virtual Address Space
    • How a Virtual Address Space Is Partitioned
    • Regions in an Address Space
    • Memory Protections
    • VirtualAlloc Internals
    • VirtualQuery Internals
  • Memory-Mapped Files
    • Memory Mapped Files Overview
    • Memory Mapped Files Categories
    • Usage of Memory Mapped Files
    • Memory-Mapped Files and Coherence
  • Heap Kernel Object
    • Heap Application Overview
    • How to Create an Additional Heap
    • Miscellaneous Heap Functions
• Dynamic Link Libraries
  • Overview of Dynamic Link Libraries
    • Advantages
    • Disadvantages
    • Dll Linking Approaches:
  • Structure of a DLL File
    • DOS Stub
    • File Header
    • Optional Header
    • Section Headers
    • Dll Structure
    • Dumpbin Tool Review
  • Reverse Engineering Crack Me 1
    • Analysis of PE Structure
    • Dynamic Reverse Engineering of the Key Validation Algorithm with Olly
    • Static Reverse Engineering of the Key Validation Algorithm with IDA Pro
    • Key Generator Development
  • Implicit Linking and Import Libraries
    • Why we need implicit linking?
    • Explicit Linking vs Implicit Linking
    • Implicit Dependencies
    • Dll with Entry Point – DllMain
    • Delay Loading Mechanism
• Inter-Process Communication
  • Introduction to IPC
  • Clipboard
  • Anonymous Pipe
  • Named Pipe
  • Mailslots
  • File Mappings
• Networking Sockets
  • Introducing Networks and Protocols
    • The internet and C
    • OSI layer model
    • TCP/IP layer model
    • Port numbers
    • Clients and servers
  • What are sockets?
    • Socket setup
    • Anatomy of a socket program
    • Berkeley sockets versus Winsock sockets
  • Implementing a Client / Server App
• Windows Native Services
  • Writing Windows Services
  • ServiceMain and Main Function
  • The Service Control Handler
  • Event Logging
  • Service Operation and Management
  • Service Control Shell
  • Sharing Kernel Objects with a Service
  • Debugging of Windows Services

• Introduction to COFF/PE 
  • Executables Overview
    • Static Linking
    • Dynamic Linking
    • PE Headers
    • PE Sections
  • PE Headers
    • DOS Header
    • PE NT Header
    • PE File Header
      • Round 1 - Analysis PE File Format Analysis
    • PE NT Header
    • PE Optional Header
      • Round 2 - Analysis PE File Format Analysis
    • PE Section Headers
    • PE File Header Pop Quiz
      • Round 3 - Analysis PE File Format Analysis
  • PE Addressing
    • PE Imports
    • PE Bound Imports
    • PE Delay Load Imports
    • PE Delay Load Imports In Debugger
      • Round 5 - Analysis PE File Format Analysis
    • PE Sections Slide Correction
      • Delay Load Imports Correction and Questions
      • ASLR Questions
    • IAT Hooking Demo and Review
      • Dependency Walker
      • Runtime Importing
    • PE Exports and Forwarded Exports
      • Round 6 - Analysis PE File Format Analysis
  • Debug Information
  • Relocations and Thread Local Storage (TLS)
  • Resources and Load Config
  • Code Signing (Security Directory)
• Introduction to ELF
  • ELF Intro
  • ELF Header
    • Using readelf to View the ELF Header
  • ELF Program (Segment) Headers
    • Using readelf to View Program Headers
    • Graphical Representation of Program (Segment) Headers
    • ELF Segment vs. PE Section Similarities and Differences
    • ELF Section Headers
    • Using readelf to View Section Headers
    • ELF vs. PE Sections Similarities and Differences
  • Procedure Linkage Table (PLT) & Dynamic Linking
    • Packers
    • UPX Packing Example
    • Viruses
    • Code Walkthrough
  • Conclusion
• Windows and Linux Malware Analysis and Synthesis
  • BASIC ANALYSIS
    • Basic Static Techniques
    • Malware Analysis in Virtual Machines
    • Basic Dynamic Analysis
  • ADVANCED STATIC ANALYSIS
    • A Crash Course in x86 Disassembly
    • IDA Pro
    • Recognizing C Code Constructs in Assembly
    • Analyzing Malicious Windows Programs
  • ADVANCED STATIC ANALYSIS
    • Debugging
    • OllyDbg
    • Kernel Debugging with WinDbg
  • MALWARE FUNCTIONALITY
    • Malware Behavior
    • Covert Malware Launching
    • Data Encoding
    • Malware-Focused Network Signatures
  • ANTI-REVERSE-ENGINEERING
    • Anti-Disassembly
    • Anti-Debugging
    • Anti-Virtual Machine Techniques
  • Special Topics
    • Packers and Unpacking
    • Shellcode Analysis
    • 64-Bit Malware