Softwarica College of IT & E-Commerce 
ST6052CEM Reverse Engineering
Assignment Brief 2024/25
|
Module Title Reverse Engineering |
Ind/Group Ind |
Cohort Sep 2024- Regular |
Module Code ST6052CEM |
|
|---|---|---|---|---|
|
Coursework Title ST6052CEM Coursework Component |
Hand out date: 24 January,2025 |
|||
|
Module Leader Prashant Shrestha |
Due date: 5 March,2025 |
|||
|
Estimated Time (hrs): ST6048CEM Expects 100 hours of self-study over the semester. Word Limit*: N/A |
Coursework type: Coursework 1 |
% Of Module Mark CW1-Practical Static Reverse Engineering Report writing: 50% |
||
|
Submission arrangement online via Schoolworkspro: Upload through Schoolworkspro portal Mark and Feedback date: TBD Mark and Feedback method: All marks and written feedback will be given via Schoolworkspro |
||||
|
Module Learning Outcomes Assessed: 1.Demonstrate understanding of link between compiled software and the source code it is generated from 2. Analyze communication, processing, and network data to derive the underlying protocol 3. Make use of tools to examine the memory state of a running process with the aim of deriving the underlying algorithm 4. Examine and evaluate the differences in tools used for reverse engineering, patching and binary mangling. |
|---|
|
Tasks and Mark distribution: a. Coursework 1- Practical Static Reverse Engineering Report writing (50%) b. Coursework 2- Practical Dynamic Analysis report writing (50%) These make up 100% of the module mark. |
|
1. Coursework 1- Practical Static Reverse Engineering Report writing (50%) |
|---|
50% of the final assessment will be done with a report around 2500 words on Static Analysis of a given malware sample. The malware sample and hash will be provided later.
∙ Scenario:
∙ Scenario Background:
∙ You are a cybersecurity analyst at CyberShield Security Solutions, a firm specializing in incident response and malware analysis. The IT department of TechCorp Ltd. has reported unusual network activity, potentially linked to a malicious executable discovered on one of their servers. They have engaged your company to analyze the binary and provide a detailed report.
∙ Coursework Task:
∙ Objective:
∙ Your task is to conduct a thorough static reverse engineering analysis of the provided binary file. You are to document your findings in a comprehensive report tailored to a non-technical management audience, ensuring that it highlights the key risks and actionable recommendations.
∙ Report Requirements:
∙ Overview:
∙ Provide an executive summary of your findings. Include a brief description of the binary, its origin (if known), and the potential impact on the organization. ∙ File Information:
∙ Detail the file’s properties, including size, hash values, and file signature. Discuss any discrepancies or signs of tampering.
∙ Process Graph:
∙ Illustrate the process graph of the binary, identifying parent-child relationships. Highlight any unusual or suspicious processes.
∙ Initial Analysis:
∙ Conduct a static analysis of the binary. Focus on file signatures, embedded resources, and any detected obfuscation techniques.
∙ Detailed Technical Analysis:
o Import Address Table (IAT) Analysis:
∙ Identify potentially interesting imports in the IAT. Describe their usage within the binary and provide examples of how these functions could be exploited. o Network Behavior:
∙ Analyze the binary’s network behavior. Identify the protocols used, types of connections established, and potential outcomes if the binary were executed in a live environment.
Recommendations:
∙ Based on your analysis, provide actionable recommendations to mitigate the identified risks. Suggest both short-term and long-term strategies.
∙ Conclusion:
∙ Summarize the key points of your report. Reinforce the potential impact of the binary on the organization and the importance of implementing your
recommendations.
∙ Additional Requirements:
∙ Screenshots:
∙ Include relevant screenshots throughout the report to support your findings. ∙ References:
∙ Cite any tools, frameworks, or external resources used during your analysis. The malware for the assignment will be uploaded here: Reverse Engineering
Your report should be a detailed discussion and evaluation of the tools, finding and techniques. As a guide, your paper should be about 2500 words (excluding references).
Care should be taken to ensure that your report is unbiased and accurately referenced using the APA 7th (Coventry University) referencing system (see attached sheet for an explanation of this and potential sources of help).
Your report should be appropriately sectioned, well-structured and should clearly set out your own analysis and conclusions. Your conclusions should be backed up by well reasoned arguments and should be suitably illustrated with appropriate examples. It is not enough to regurgitate or summarize material found in literature. A reference list must be included at the end of the research paper.
You should submit your paper as a PDF file formatted precisely as specified in the instructions for publication (these instructions are available via Schoolworkspro)
Note:
The Individual Coursework is assessed by module leader that take place at the end of the semester by giving some configuration work in the Lab. Students should attend their allocated slot and can only take the at another time under exceptional circumstances with permission of their Course Director.
1. Students are encouraged to use their own user-defined data structure rather than built-in data structure of given language.
2. You are expected to use the Coventry University APA style for referencing. For support and advice on this, students can contact Centre for Academic Writing (CAW).
3. Please notify your academic services team and module leader for disability support.
4. The college cannot take responsibility for any coursework lost or corrupted on disks, laptops or personal computer. Students should therefore regularly back-up any work and are advised to save it on the cloud based services.
5. If there are technical or performance issues that prevent students submitting coursework through the online coursework submission system on the day of a coursework deadline, an appropriate extension to the coursework submission deadline will be agreed. This extension will normally be 24 hours or the next working day if the deadline falls on a Friday or over the weekend period. This will be communicated via your Module Leader.
|
6. Collusion between students (where sections of your work are similar to the work submitted by other students in this or previous module cohorts) is taken extremely seriously and will be reported to the academic conduct panel. This applies to both coursework and exam answers. 7. A marked difference between your writing style, knowledge and skill level demonstrated in class discussion, any test conditions and that demonstrated in a coursework assignment may result in you having to undertake a Viva Voce in order to prove the coursework assignment is entirely your own work. 8. If you make use of the services of a proof reader in your work you must keep your original version and make it available as a demonstration of your written efforts. 9. You must not submit work for assessment that you have already submitted (partially or in full), either for your current course or for another qualification of this college, with the exception of resits, where for the coursework, you may be asked to rework and improve a previous attempt. This requirement will be specifically detailed in your assignment brief or specific course or module information. Where earlier work by you is citable, i.e., it has already been published/submitted, you must reference it clearly. Identical pieces of work submitted concurrently may also be considered to be self-plagiarism. |
|---|
Learning Outcomes matrix:
|
Question No. |
Learning Outcomes Assessed |
|---|---|
|
CW1-Practical Static Reverse Engineering Report writing |
1,3, and 4 |
Mark allocation guideline to students
|
0-39 |
40-49 |
50-59 |
60-69 |
70+ |
80+ |
|---|---|---|---|---|---|
|
Work mainly incomplete and /or weaknesses in most areas |
Most elements completed; weaknesses outweigh strengths |
Most elements are strong, minor weaknesses |
Strengths in all elements |
Most work exceeds the standard expected |
All work substantially exceeds the standard expected. |
Mark allocation guidelines to students: marking rubric for Coursework 1-Research Report writing (50%)
Pass marks will be awarded for dissatisfactory assessment of the given software, with rudimentary explanation with no use of proper tools and weak reporting skills.
Good marks will be awarded for satisfactory assessment of the given software, with good explanation with use proper tools and proper reporting skills.
Excellent marks will be awarded for comprehensive assessment of the given software, with excellent tooling knowledge, and excellent reporting skills and documentation.
The table below shows the detailed marks breakdown that you can achieve by completing the different aspects of the assignment.
|
Assessment (20) Assessment of the given software |
5 No identification of the packer/compiler, persistence techniques, and steps required to reverse the binary. |
10 Satisfactory identification of the packer/compiler persistence techniques, and steps required to reverse the binary but not clear and thorough. |
15 Comprehensive assessment with satisfactory identification of the packer/compiler persistence techniques, and steps required to reverse the binary |
20 Clear identification of the packer used persistence techniques, and detailed steps to unpack the binary are provided. |
|
|---|---|---|---|---|---|
|
Screenshot and Process (45) Reverse Engineering process demonstrated with screenshots. |
5 No screenshots or process documentation are provided. |
15 Screenshots and process documentation are provided, but they are not clear or thorough. |
30 Clear screenshots and detailed process documentation are provided for static analysis. |
45 Clear screenshots and detailed process documentation are provided with new variable names and comments for static analysis. |
|
|
Exfiltration Domain and Process (20) Evaluating and justifying exfiltration or exploit process and technology, port, protocol. |
5 No identification or description of the exfiltration domain is provided. |
10 Evaluation shows some understanding of the exfiltration process and extraction. |
15 The domain used for exfiltration is identified but the description is not clear or thorough. |
20 The domain used for exfiltration is identified and described in detail. |
|
Overall Presentation (15) |
5 The report is disorganized, difficult to follow, and/or contains numerous errors in grammar or spelling. |
10 The report is organized and presented adequately but could be more concise and/or contain some errors in grammar or spelling. |
15 The report is well organized, easy to follow, and clearly presented with proper grammar and spelling. |
|---|
