Course Details

Number of Days: 2

Attendance: In-Person Only

Details below last updated: August 18/2026

Course Promise

Students will learn a practical, repeatable way to approach unfamiliar binaries with Ghidra and AI: get oriented, ask better questions, recover structure, follow behavior, verify AI-generated claims, and document what the evidence actually supports.

Course Description

Ever opened a binary in Ghidra, stared at the screen for a while, and wondered where you are supposed to start? This course is for you.

Reverse engineering has traditionally had a pretty intimidating on-ramp: learn assembly, learn operating-system internals, learn a complicated analysis tool, and then - eventually - start figuring out what unfamiliar software actually does. AI changes that equation, but only if you know how to use it without believing everything it tells you.

In this hands-on course, we use Ghidra together with hosted and local AI to explore unfamiliar software one question at a time. Students learn how to get oriented in a binary, make sense of decompiled code, recover useful names and structure, follow interesting behavior, compare related code, and turn a pile of functions into a defensible explanation of what a program is doing.

AI helps us move faster, explain unfamiliar concepts, generate hypotheses, and automate some of the boring parts. Ghidra and the binary itself keep us honest. This is not a ‘click the AI button and let it reverse the binary’ class. Students learn where AI is surprisingly useful, where it confidently gets things wrong, and how to check its answers against actual program evidence.

Most of the course is hands-on. Every student works in an individual lab environment with Ghidra, AI access, exercise binaries, scripts, workflow examples, and BSim resources ready to go. We start small and build toward analyzing unfamiliar software with increasingly less hand-holding.

You do not need to be an experienced reverse engineer. If you understand basic programming concepts and have always wanted to get better at looking inside compiled software, you are in the right place.

Learning Outcomes

• Navigate Ghidra with a purpose instead of randomly clicking around.

• Recognize useful program evidence in strings, imports, functions, references, decompiler output, and call relationships.

• Use AI to explain code, suggest names, summarize functions, generate hypotheses, and support scripting without surrendering analyst control.

• Recover and document program structure while keeping uncertain findings clearly separated from verified facts.

• Use Ghidra BSim and AI-assisted analysis to identify related functionality and significant behavior.

• Verify important AI-generated claims against the binary and document evidence, limitations, and remaining uncertainty.

• Apply a repeatable workflow to an unfamiliar binary and produce a concise technical assessment.

Two-Day Course Outline

Instructional rhythm

Topics progress from brief explanation to live walkthrough, independent exercise, and synthesis. The goal is to spend most class time doing reverse engineering rather than listening to lectures.

Day 1 – Don’t Be Afraid of the Binary

Goal: Build enough Ghidra and reverse-engineering fluency that students can begin asking intelligent, evidence-driven questions of unfamiliar software.

1. Welcome to the Binary

Executable anatomy, compilation, assembly versus decompiler output, what Ghidra discovers automatically, and what still requires analyst judgment.

• Explore a small binary and identify obvious sources of evidence.

• Distinguish what the tool knows from what the analyst is inferring.

2. Finding Your Way Around Ghidra

Functions, strings, references, symbols, decompiler, listing, call relationships, navigation, and annotations.

• Follow references from strings and imports into relevant code.

• Build a small map of how important functions connect.

3. Reading Code You Did Not Write

Functions, arguments, locals, conditionals, loops, library calls, types, and common compiler artifacts.

• Reconstruct the intent of selected functions from decompiler and disassembly evidence.

• Rename and annotate only when evidence supports the change.

4. Bring in AI

Using hosted/local AI for explanations, naming suggestions, summaries, hypotheses, scripting help, and structured requests.

• Compare weak versus strong AI prompts grounded in program context.

• Use AI to accelerate analysis without letting it silently become the source of truth.

5. Do Not Believe the Robot

Failure modes, hallucination, overconfident explanations, missing context, and verification strategies.

• Catch deliberately incorrect AI-generated conclusions.

• Record evidence that supports or refutes each claim.

6. Recover the Program

Names, annotations, types, relationships, data structures, interfaces, and traceability.

• Progressively improve a Ghidra project while preserving uncertainty.

• Create an evidence-supported explanation of a small unfamiliar program.

Day 1 Challenge

Take a small unfamiliar program from "What is this?" to a concise, evidence-supported explanation of its structure and likely behavior.

Day 2 - Now Figure Out What It Does

Goal: Apply the complete workflow to unknown software, moving from triage to recovered structure, behavioral findings, and a defensible technical assessment.

7. Triage an Unknown Binary

Strings, imports, exports, entry points, function inventory, interesting artifacts, quick hypotheses, and choosing an analysis strategy.

• Establish program context before asking AI for explanations.

• Create an evidence-based analysis plan and identify verification needs.

8. Follow the Evidence

References, call relationships, important code paths, program state, interfaces, and traceable annotations.

• Recover function relationships and data structures.

• Keep AI suggestions connected to the exact evidence that motivated them.

9. AI as an RE Partner

Building useful context, asking better questions, comparing explanations, generating hypotheses, and knowing when to abandon an AI-generated lead.

• Use structured context and requests to investigate significant functions.

• Refine or reject hypotheses as new evidence appears.

10. Similarity and Discovery with BSim

Using BSim to compare functions and binaries, identify related functionality, and find useful analysis anchors.

• Explore similarities and differences between related functions.

• Use AI to interpret comparison results without treating similarity as proof of behavior.

11. Behavior Hunt

Following significant code paths, prioritizing interesting behaviors, and turning observations into supported findings.

• Identify and document one or more significant behaviors.

• Separate verified behavior, likely interpretation, and open questions.

Final Exercise - The Mystery Binary

Students receive an unfamiliar binary and an objective, then choose and apply the Ghidra + AI workflow themselves. They triage the program, recover enough structure to understand it, investigate significant behavior, verify important AI-generated claims, and produce annotated analysis artifacts plus a short technical assessment.

Mystery Binary Deliverable

• What the software appears to do.

• The program evidence supporting that conclusion.

• What the analyst is confident about.

• What remains uncertain or unverified.

• What should be investigated next if more time is available.

Audience and Prerequisites

Who Should Attend

This course is designed for security practitioners who are curious about reverse engineering but do not consider themselves expert reverse engineers. It is a good fit for:

• Security analysts

• Incident responders

• SOC and threat analysts

• Vulnerability researchers

• Malware analysts early in their RE journey

• Software and firmware developers

• Digital forensic practitioners

• Penetration testers and red teamers

• Students and researchers

• Experienced practitioners who know some reverse engineering but have not explored AI-assisted workflows

Experienced reverse engineers are welcome too, but the course is deliberately designed so that years of binary-analysis experience are not required to keep up.

Prerequisites

Students should understand basic programming concepts such as:

• Functions

• Variables

• Data types

• Loops and conditional statements

Knowing what a compiler does is useful. Having opened Ghidra, IDA, Binary Ninja, or another reverse-engineering platform before is helpful, but not required. Some command-line or scripting experience will make a few exercises easier.

Not Required

• Expert reverse-engineering experience

• Deep assembly-language expertise

• Malware-analysis experience

• Previous experience deploying local LLMs

• An AI subscription or API key

• A local GPU

Most important prerequisite

Bring curiosity and a willingness to poke at unfamiliar software until it starts giving up its secrets.

Student Environment and Materials

Students should bring a modern Windows, macOS, or Linux laptop with a current web browser, a reliable power adapter, and reliable outbound HTTPS connectivity.

Each student will be provided an individual remote lab environment containing:

• Ghidra with local AI access and integration components

• Exercise binaries and individual course activities

• Reference workflow and configuration guidance

• Reusable prompt, context, script, and workflow examples

• Ghidra projects, BSim resources, and solution guidance

• Post-course reference materials

No local GPU is required. The environment is designed so students can spend class time analyzing software instead of installing and debugging a toolchain.

About the Instructor: Dr. Kara Nance

Dr. Kara Nance is a recognized authority in software reverse engineering, applied artificial intelligence, and cybersecurity with more than 30 years of experience applying AI and machine learning to complex technical problems. She is the author of The Ghidra Book (No Starch Press, 2020; Second Edition, 2026) and a frequent instructor and speaker on reverse engineering, AI, and cybersecurity. Her recent work focuses on AI-assisted reverse engineering, local AI environments, model evaluation, workflow integration, and practical operational deployment. A longtime university professor and cybersecurity educator, she has developed and delivered hands-on technical training for professional, government, and academic audiences.

About the Instructor: Dr. Brian Hay

Dr. Brian Hay is an applied artificial intelligence researcher, and cybersecurity expert with more than two decades of experience designing and integrating advanced software systems for commercial and U.S. government organizations. He served as Technical Editor for both editions of The Ghidra Book and is a frequent instructor and speaker on AI, software analysis, reverse engineering, and cybersecurity. His recent work focuses on local AI environments, workflow automation, model evaluation, AI-assisted software analysis, and building scalable, maintainable AI frameworks that preserve transparency, repeatability, and technical rigor.