为什么值得关注

它提供了罕见的实战机会，包含真实的 MIPS 恶意软件样本和预建的 Binary Ninja 项目，配合结构化挑战，使跨架构逆向工程教育变得实用且引人入胜。

适合谁使用

希望扩展 x86-64 和 ARM 以外架构的逆向工程师
安全研究人员和恶意软件分析师
寻找新架构技能的 CTF 参与者
软件安全或底层编程课程的学生

典型使用场景

通过真实示例学习 MIPS 指令集和调用约定
使用 Binary Ninja 练习恢复剥离的 libc 函数
分析 MIPS 恶意软件中的守护进程化和擦除代码流程
将已有的逆向工程知识迁移到小众架构

项目优势

提供完整的研讨会结构（幻灯片、实验、方案讨论），适合自学或教学
包含真实的恶意软件样本（AcidRain），可用于逼真分析
附带预恢复 libc 函数名的 Binary Ninja 数据库，节省初始设置时间
强调从 x86-64/ARM 到 MIPS 的可转移概念，降低学习曲线

使用前须知

样本是真实恶意软件，解压时会被杀毒软件删除，需要谨慎处理
假设用户具备 x86-64 或 ARM 逆向工程的基础知识，不完全适合零基础学习者
仅专注于 MIPS-32 和单一恶意软件家族，更广泛的 MIPS 知识可能需要额外资源

README 快速开始

MIPS Reverse Engineering Workshop at Recon 2026

You'll find the class slide deck, the lab exercise and the sample here, accompanied by a Binary Ninja .bndb with recovered LIBC library function names. The sample is encrypted, the password is 'infected'. Do not unpack this on a host thats running an AV, your AV will delete it. Do not worry about this malware infecting anything, if you're not trying to analyze it on your Playstation2, you should be fine. And Playstation2 doesn't even have the right MIPS version, duh.

Sales Pitch :)

Curious about expanding your reverse engineering skills to another architecture? Lets go learn MIPS! Both x86-64 and ARM reverse engineering knowledge transfer really well to MIPS, and with some basics and an instruction cheat sheet we're on our way in no time. We'll analyze AcidRain, a piece of MIPS-32 malware, a Russian wiper malware none the less. The sample is stripped, and we'll learn how to quickly recover essential libc functions, to then reconstruct the malware's code flow.

Outline

Workshop outline (45 min lecture / 45 min lab / 30 min discussion of solutions):

MIPS architecture 101 and a brief history
The MIPS pipeline
Delay slots
Instruction categories
MIPS registers and their purpose
The MIPS stack
The O32 calling convention
Syscall calling convention and numbering
Function prologues/epilogues
Other MIPS architectures and their calling conventions, briefly
Hands on: AcidRain -- Challenge 1: Understand daemonization -- Challenge 2: Reconstruct wiping code flow

A lot of us are stuck on one architecture, and its not actually that hard learning another one, since we don't need to learn from scratch but can easily transfer understanding of one architecture to another. This workshop will show how, with the example of MIPS, assuming that many students are not familiar with this somewhat obscure architecture. That, while the basics of MIPS are actually rather simple, especially AcidWiper is quite easy to read once the basics are understood.

项目描述

Materials for my MIPS workshop at Recon 2026

MIPSReverseEngineeringWorkshop