IDA: Trainings & Seminars
2011 Trainings
We are happy to announce the location and date of our annual European IDA trainings. They will be held in the same hotel as the last year - Ramada Plaza Hotel - in December 2011:
- STANDARD IDA training: 5-7 December
- PROGRAMMING for IDA: 8-9 December
The training will be held at the Ramada Plaza Hotel, Liege, Belgium.
Please mention Hex-Rays IDA training when booking your room to get the preferential rate of 99 EUR per night (parking and breakfast included).
The training costs
- 2910 EUR (3900 USD) standard training
- 1940 EUR (2599 USD) advanced training
This includes: the class fee, the training handbook and DVD, lunch and coffee breaks.
The order form is available here:
and
You will get a 10% discount if you order before 15 October 2011.
Requirements:
- An IDA license with active support period. There is no need to bring your copy of IDA with you, we will provide you with the latest version at the class. The package will include a free time-limited copy of the decompiler.
- Please bring your laptop with you. For the programming class, we will ask you to have a compiler installed (Visual Studio or Borland compilers are preferred).
Standard IDA training (3 days)
IDA - the binary software analysis tool
Who should attend: Security Engineers, Security Software Developers, Researchers, Forensic Specialists, Virus Analysts, Software Validators
Prerequisites: good x86 assembly knowledge, basics MS Windows API, basic programming skills in any procedural programming languages (C/C++ is preferred)
This training will demonstrate the use of IDA to analyze binary programs on modern operating systems. While the training will be mainly focused on Microsoft Windows programs, the skills taught are universal and usable on other IDA supported platform.
The following topics will be covered:
- Feature oriented introduction to the IDA architecture: the training will focus on making the most of the core IDA disassembly features, its debugger and IDC to dissect modern real world malware such as MyDoom, Zotob and Warezov.
- Binary program analysis in IDA: where to begin, how to proceed toward the goal
- The binary level representation of modern programs and how malware abuses the conventions through code obfuscation, code hiding, etc. Special techniques to handle obfuscated code.
- Problems encountered during analysis and how to handle them.
- Automating IDA: batch processing, scripts, plugins
- IDA overview
- Common executable file features
- Debugger
- IDC
- IDA features
- Memory organization
- FLIRT
- Type system
- IDS files
- Working with IDA
- Creating the database: various information sources
- Various views of the database
- Navigation
- Modifying the listing
- Patching the program
- With all this information, how do I start my analysis?
- Working with high level data
- Arrays
- Structures
- Enumerations and bitfields
- Advanced operations
- Offsets
- Bulk operations
- Special structure types
- Function prototypes
- Processor specific issues
- Code obfuscation
- Overview of obfuscation techniques
- Countermeasures
- Exercises with several real-world sample files
The training material has been updated to cover the latest additions to IDA.
Programming for IDA (2 days)
IDA - extending and building upon it
Who should attend: Security Engineers, Security Software Developers, Researchers, Forensic Specialists, Virus Analysts, Software Validators
Prerequisites: IDA user skills, programming skills in C/C++ languages
This training is intended for experienced IDA users who want to take advantage of its open architecture by extending and improving it. You will learn how to write modules to modify the listing, react to events, decrypt/uncompress data right in the database, and many other things. After the course you will have solid understanding of its concepts, classes, and programming interface.
We will implement several useful plugins. Be prepared to program a lot in this training!
C/C++ programming skills as well as solid reverse engineering experience are required.
- IDA architecture overview
- Modules
- Memory representation
- Database organization
- SDK
- Setting up
- Processor module framework
- Loader framework
- Plugin framework
- How to debug custom modules
- IDA subsystems
- Utils: i/o, custom stl, regex, misc
- Database: netnodes and flags
- Foundations: bytes, names, offsets, etc
- Address range class: segments and functions
- Accessing and using IDC
- Cross-references
- Functions
- Events
- Type information
- Structures and enums
- Debugger
- User interface
- Graphing
- Decompiler framework
- Plugin programming
- General guidelines
- Plugin samples/exercises
- Colorizer
- Object extractor
- Debugger helper
- Type information
- Graph plugin
- Processor extension
- Reaction to events
The Speaker
Mr. Elias Bachaalany is a software developer at Hex-Rays. He is an important member of the team behind IDA and knows it very well. Mr. Bachaalany is passionate about teaching. His classes are easy to follow because knows how to present complex things in simple ways. After attending the training you will have a solid foundation to build upon. Just check the quotes below ;)
What our students say
"Excellent training. Would recommend highly."
"Great class to learn about the powerful features of IDA."
"Very organized, excellent selection of exercises. They build on one another."
"It was the best reverse engineering course I have ever attended."
"Come prepared. A lot was covered. Learning environment was excellent. Staff are very professional. Learned & gained new skills."
"It is a great course for not only using the tool, but for general understanding of binaries."
"This class is indispensible to a beginning RE, make sure to brush up on assembly instructions and concepts."
Order Forms
The order forms are available in two formats: