SNSec Lab in July: Two Weeks on Binaries, and a Summer Dinner
July at SNSec Lab was two things: a long stretch of special sessions on binary analysis, and a dinner where all six of us finally sat at the same table.
Special sessions on binary analysis
From July 8 to July 17 we ran special sessions in the lab, every day from 10:30 to 16:00. The idea was to spend an uninterrupted block of the summer on something our group had only touched in passing — how compiled programs actually look from the outside, and what it takes to read one.
We started from static analysis and basic reverse engineering, then worked through the things you cannot skip once you open a real executable: calling conventions, the PE file format, and the layout of headers, sections, and the import and export tables. From there we moved to dynamic linking — how a DLL is built, how it is linked, how imports get resolved at load time, and what DLL injection looks like when someone abuses that machinery. We closed with memory protection and call hijacking.
Rather than only reading about the PE format, we wrote a small PE parser in C++ from scratch and checked its output against PEview, so the structure fields stopped being a diagram on a slide and became bytes at an offset. We also spent time on classic crackme binaries, which are a fast way to build the habit of following control flow you did not write.
What the sessions really set up is what we have been doing since they ended. Our group works on data-driven security, so the question waiting on the other side of two weeks of manual disassembly was what happens when a neural network is pointed at a binary. We are working through how the field has approached that so far — Asm2Vec (IEEE S&P 2019), jTrans (ISSTA 2022), Trex, and CodeArt (FSE 2024) — alongside HermesSim (USENIX Security 2024), whose “code is not natural language” framing is a useful provocation, and two papers from the learning side, Neural Networks and the Chomsky Hierarchy (ICLR 2023) and Stack Attention (ICLR 2024). Coming to these papers straight from the disassembler changes how they land. Once you have spent a morning tracing arguments through registers and the stack across a function boundary, a model that treats the same instructions as a flat sequence of tokens starts to feel like it is leaving something on the table. That is roughly where our reading is pointed now.
Five and a half hours a day for two weeks is a lot of assembly, and the breaks mattered as much as the sessions. We walked out for lunch together every day, came back with coffee, and there was almost always dessert involved.
Somewhere in the middle of all this, Chaeri and Hyekyo got their new monitors.
A dinner with all six of us
On July 30 we closed out the month with a lab dinner. This was the first time the whole lab was in one place since Hyekyo joined us in July, so all six of us — Chaeri, Chaeyoung, Jisoo, Hyekyo, Semin, and me — were finally at the same table, with the city and Namsan behind the window.
Over dinner Chaeyoung shared her own news: she is graduating this August. Congratulations, Chaeyoung.
It has been a full first half of the year — a conference trip to Charlotte, a first journal submission, papers accepted, a new member, and two weeks of assembly. Everyone earned the break. Stay cool this summer, and see you all back in the lab rested.
Other posts...
Here are some more articles you might like to read next: