Joshua Reynolds
Joshua Reynolds is the founder of Invoke RE. With over a decade of experience, Joshua has held senior roles at industry-leading companies, including Cisco and CrowdStrike. Joshua has spoken at major conferences such as REcon, RSA, DEF CON and Virus Bulletin on topics including ransomware, malicious document analysis and automating malware analysis. Joshua’s industry-standard malware analysis training courses are taught to hundreds of students globally through his company Invoke RE.
Session
One of the first steps taken during the reverse engineering process is to recover as much context as possible from a given binary, including symbols, function signatures, classes and structures associated with statically linked code. This is especially important for modern compilers and linkers that embed a plethora of boilerplate that you don't want to spend time reverse engineering. Throughout this workshop we will explore recovering this information using multiple open source tools in Binary Ninja. Our target will be a real-world malware sample written in C++ that is used to terminate EDR and antivirus technologies. The sample contains multiple components, including user-mode and kernel-mode binaries that require symbol and type information recovery for accurate analysis.