Assessment
Assessment
Three pieces of work, adding to 100%. All three mark the same thing — whether you can say what your evidence supports — and each of them puts a quarter of its marks on what you decline to conclude.
There is no exam. An exam would test whether you can recognise a technique, and recognising techniques is the part of this subject that generalises worst.
What the three assessments test instead is the reasoning: given evidence, what follows, what does not, and what would you have to check. The weights climb because the judgement required climbs — A1 gives you a pair and asks what happened, A2 gives you a pile of results and a claim and asks whether the claim holds, and the capstone gives you a sample and no help at all.
A1 — Trace the transformation
Follow one operation from C to IR to x64 across a clean/obfuscated pair you have not seen, and write down what you established and what you did not.
Due 26 March 2027 · Weight: 25%
A2 — Recover the semantics
Given a flattened or gated function, a recovered graph and a set of solver results, decide what has been established — and defend the boundary you draw.
Due 7 May 2027 · Weight: 30%
Capstone — Seeing through an unfamiliar binary
One sample, withheld identity, every method you have. Choose an approach, justify it, validate whatever you conclude, and state the boundary of your own result.
Due 28 May 2027 · Weight: 45%
The four outcomes every rubric uses#
Each brief is marked against a criterion for what it did not establish, and each asks you to place your conclusions among these four:
- Analysis success
- A tool ran, produced output, and did not error.
- Semantic proof
- A property holds — under a stated model, state and path prefix.
- Binary rewriting
- Bytes changed and a file still loads.
- Runtime correctness
- The program answered correctly, on the inputs that were actually run.
A submission that reaches the third and reports it as the fourth has made the exact mistake that two of this course’s specimens were kept to demonstrate. It costs marks in all three assessments.
Weekly work, which is not marked#
Every week has a studio exercise on its page. None of them is graded and none of them is collected.
That is a deliberate choice rather than a kindness. The studios are where you get something wrong in front of somebody who can tell you, and a graded studio turns that into a performance. The exercises feed the assessments directly — A1 is week 3’s exercise on a pair you have not seen, A2 is week 7’s, and the capstone is week 12’s — so the practice is not optional in any sense that matters. It just is not worth marks.
Declaring your working#
Reading the evidence together is encouraged. Writing the analysis is individual. Declare any collaboration and name the people involved.
Tool output is not yours and is not evidence on its own: if a simplifier, decompiler or lifter produced something you rely on, name the tool and its version and treat its output as a claim you now have to support. That rule is not an integrity technicality here — it is the subject of the course.