Calypso Labs/Windows Instrumentation With Frida

  • $1,400

Windows Instrumentation With Frida

  • Course
  • 90 Lessons
  • 365-day access

Windows Instrumentation with Frida

Binary instrumentation is an invaluable skill across all platforms, yet it is often under-appreciated on Windows specifically. In this course you will learn how to use the Frida framework on Windows. You will master function hooking and binary instrumentation and apply those skills in a wide variety of scenarios. You'll gain the ability to discover Black Box application functionality using static and dynamic techniques. These learnings will empower you to understand what an application is doing, modify its functionality and augment its operation.

This expertise is invaluable in Defence, Offense, and Research. Whether you're aiming to develop a novel detection method, assess the viability of a post-exploitation strategy, or do Windows internals research, this course is designed to equip you with the necessary, real-world, practical, skills.

We start from the ground up, assuming no prior knowledge, allowing you to build your capabilities step-by-step. Through 27 practical labs, you'll solidify your understanding and gradually refine your skill set, gaining experience that will seamlessly integrate into your professional workflow. Although the primary focus is on native code applications for Windows, the techniques and skills you'll learn are equally applicable to native code applications on other platforms.

Moreover, this course also includes some specials learnings and benefits. You will receive a Binary Ninja personal license and will become familiar with the use of Binary Ninja for static analysis. Other domain specific tools are also used extensively, like API Monitor.

Binary Ninja

Labs partners with Vector35 on the Windows Instrumentation with Frida course. When you sign up, you will receive access to a complementary Non-Commercial (Personal) license for Binary Ninja valued at $299. This entitles you to permanent use of Binary Ninja in addition to 12 months of software updates. After one year you will have the option to renew your license to continue to receive product updates. A discounted upgrade path to a Commercial license is also available, further details are provided in the course.

Certification

All courses on Labs provide a certificate of completion. At Labs we understand that you may need to prove completion to third parties. To facilitate this all our courses also offer custom, verifiable badges based on the IMS Open Badge Ecosystem. These badges are issued by us and can be validated in real-time.

Course Badge

Course badges are issued through Canvas Badges, you can view the public course badge page at the link below.

Course Trainers

Labs courses are taught by industry professionals with a proven track-record in their field. Your trainers will guide you through your course to ensure you successfully complete all learning objectives.

Curriculum Vitae

Ruben Boonen has over a decade of industry experience in the United Kingdom and the USA. He has a broad background in Security Consulting, Research & Development and Defence. He previously achieved a number of industry recognized certifications like CREST CCT and OSEE. Additionally, he has presented or delivered training at many international conferences, including, Black Hat, DefCon, BlueHat IL, HackInParis, and DerbyCon.

Currently Ruben works on the Adversary Services team at IBM as CNE Capability Development Lead. He is mostly focused on post-exploitation capability development, vulnerability research and all things Windows.

Frequently asked questions (FAQ's)

What are we learning?

We are covering a lot of ground. We will learn to use the tools-of-the-trade, do some light reverse engineering, hook native code functions, perform in-memory function calling, traverse data structures, analyse Black Box behaviours and hack a video game!

How can I get support?

Labs has established a dedicated Discord channel where you can engage with peers and seek guidance from instructors. Email support is also available, ensuring you have the assistance you need to navigate the course successfully. At Labs we are excited to make you sweat, push you to do the hard work, and watch you acquire the professional aptitudes you were looking for!

How is the course structured?

The course is made up of two general categories of content. The first category is video lectures accompanied by slides and the second category is labs accompanied by written lab instructions and full lab solutions. There is also a dedicated VMWare virtual machine that is configured with all necessary tools to complete the course work.

How much content is there?

  • 12 hours of video

  • 27 practical labs

Course content may be updated over time. Please make sure you check back, even if you have completed all course modules.

Course Overview

Syllabus

Introduction

Introduction
Preview
Binary Ninja License & Course Materials
Environment Setup

API Instrumentation

Well-Known Tools
Lab 1: Evaluating ProcMon & APIMonitor
Frida API Tracing
Lab 2: Frida Trace
Lab 2: Lab Guide

Introducing Fermion

Introducing Fermion
Lab 3: Fermion
Lab 3: Lab Guide

Hooking to -> Change Application Behaviour

Changing Application Behaviour
Lab 4: Manipulating Message Boxes
Lab 4: Lab Guide

Hooking to -> Inspect Data

Inspecting Application Data
Lab 5: Shoulder Surfing Terminal Sessions
Lab 5: Lab Guide

Hooking to -> Hide Data

Hiding Application Data
Lab 6: Hooking the API
Lab 6: Lab Guide
Traversing In-Memory Data Structures
Lab 7: Pointer Arithmetic
Lab 7: Lab Guide
Abusing Data Parsers
Lab 8: Mischief Managed
Lab 8: Lab Guide
Lab 8: Quiz

Calling Native Functions

Calling Native functions
Lab 9: Going Native
Lab 9: Lab Guide

Case Study: Defeating Symantec 2FA

UX/UI Romance Story
Lab 10: A Window to the Heart
Lab 10: Lab Guide
API Automation
Lab 11: Automation
Lab 11: Lab Guide

Case Study: Antimalware Scan Interface (AMSI)

Antimalware Scan Interface (AMSI)
Lab 12: HAMSICONTEXT
Lab 12: Lab Guide

Binary Instrumentation With Stalker

Binary Instrumentation With Stalker
Lab 13: Stalker
Lab 13: Lab Guide

Case Study: Minesweeper

Finally something that matters, Minesweeper
Lab 14: Parsing Board State
Lab 14: Lab Guide
We must go deeper
Lab 15: Automation
Lab 15: Lab Guide

Case Study: DLL Side-Loading

DLL Side-Loading
Lab 16: LoadLibraryExW
Lab 16: Lab Guide
Unit Testing
Lab 17: In-Memory Unit Testing
Lab 17: Lab Guide

PwnAdventure3 Introduction

It's only Game -> PwnAdventure3
Lab 18: Jump Mechanics
Lab 18: Lab Guide
__thiscall Calling Convention
Lab 19: Accessing __thiscall Objects
Preview
Lab 19: Lab Guide

Implementing A "Cheat Engine"

Repurposing Application Functionality
Lab 20: Talk talk talk
Lab 20: Lab Guide
Symbol Analysis
Lab 21: Porting to our "Cheat Engine"
Lab 21: Lab Guide

Leveraging Native Game Functionality

Traveling Fast, Traveling Far
Lab 22: Teleportation
Lab 22: Lab Guide
What about p0wn?
Lab 23: Bears With Guns
Lab 23: Lab Guide
Alternate p0wnage -> I Take No Damage
Alternate p0wnage -> The Birds and the Bears
Preview
Bonus p0wnage -> Loot Goblin

Advanced Data Structures

PwnAdventure3 Server Setup
C++ Map Containers
Lab 24: Leaking the ClientWorld
Lab 24: Lab Guide
Traversing Red/Black Trees In Memory
Lab 25: Reading the ClientWorld
Lab 25: Lab Guide

Hooking Network Traffic

Overtrained, Overspecialized
Lab 26: Dumping Packets
Lab 26: Lab Guide
Implementing the Network Protocol
Lab 27: Parsing Packets
Lab 27: Lab Guide

Course Review

Course Review
Course Feedback

  • $1,400

Windows Instrumentation With Frida

  • Course
  • 90 Lessons
  • 365-day access