Reverse Engineering & Vulnerability Research Training
Learn the craft. Keep the tools. Clearseclabs courses are taught live by John McIntosh, the researcher behind ghidriff and PyGhidra-MCP. Work through real binaries, CVEs, and reusable workflows with an instructor who builds and uses the tools.
View Public Dates · Request Private Team Training · Formats & FAQ
Choose Your Course
Start with your current experience and the work you want to do. You do not need to take every course in sequence.
New: Windows Agentic VR is our advanced Windows specialization. Registration is open for the February 1–4, 2027 virtual cohort, and the two-day Black Hat Asia edition runs March 2–3. See the 2027 schedule for all dates.
Manual-First Track
Everyday Ghidra
Analyze Windows binaries in Ghidra and connect static analysis with live debugging.
Start Here If: New to RE, with basic Windows and programming knowledge.
Explore Everyday Ghidra →
Manual-First Track
Patch Diffing in the Dark
Explore vulnerability research with a manual-first approach, guided by real Windows CVEs.
Start Here If: Comfortable reversing binaries; ready for Windows VR.
Explore Patch Diffing in the Dark →
AI-Native Track
Agentic RE
Build private AI stacks, connect RE tools, and orchestrate agents for reverse engineering and vulnerability research across platforms.
Start Here If: Comfortable with RE; new to AI orchestration is fine.
Explore Agentic RE →CSL Virtual · January 25–29, 2027 →
AI-Native Track · New for 2027
Windows Agentic VR
Advanced Windows vulnerability research: combine patch diffing with an agentic loop for speed and efficiency. Use local models to find and validate real bugs.
Start Here If: Experienced in RE and vulnerability research.
Explore Windows Agentic VR →CSL Virtual · February 1–4, 2027 →Manual-First: Learn the analysis by hand, then add AI once the fundamentals are solid. AI-Native: Start with AI orchestration, bringing your existing RE experience.
Training Pathways explains prerequisites and how the courses connect.
Train as a Team
Bring Everyday Ghidra, Patch Diffing in the Dark, Agentic RE, or Windows Agentic VR to your team through a private virtual or on-site session. Share your goals, team size, and preferred date window; we’ll discuss curriculum, logistics, and pricing.
Platform-Specific Advanced Training
Agentic RE covers reverse engineering and vulnerability research workflows across platforms. These specialized courses focus on advanced research within a particular platform. Windows Agentic VR registration is open for February 1–4, 2027; see the 2027 schedule for all dates. Apple Agentic VR is coming soon.
Advanced Specialization · AI-Native
Windows Agentic VR
Combine the research craft from Patch Diffing in the Dark with an agentic loop for speed and efficiency. Use local models to find real bugs, connect static analysis and live debugging, and validate findings. Intended for researchers with RE and debugging experience.
Read the Course Outline →Coming Soon · AI-Native
Apple Agentic VR
The same agentic vulnerability research methodology, applied to Apple platforms. Dates and prerequisites will be announced.
Tell Us Which Course You’re Interested In →
For course announcements, join the newsletter.
Learn by Doing
Courses combine live instruction, hands-on labs, a course CTF, and instructor support via Discord during and after the course. Materials and lab environments are included; check each course’s system requirements before booking.
"This is the first course I've taken where it feels like I can go home and start employing the methods I've learned immediately, instead of having to spend the next month sorting through my own thoughts."
— REcon student, Patch Diffing in the Dark
Formats & Booking
Public courses run live online or through conference and training partners. Private sessions are arranged directly with Clearseclabs. The schedule separates scheduled offerings from provisional plans; a course being in the catalog does not mean a public cohort is currently open.
See the training FAQ for durations, CPE hours, prerequisites, institutional registration, and time-zone guidance. Each event’s registration page provides its price and exact daily schedule.
Your Instructor
John McIntosh (@clearbluejar) is a security researcher specializing in reverse engineering and vulnerability research. His teaching draws on more than a decade of practice, open-source tool development, and research shared at international security conferences.
John’s Research · Open-Source Tools · Recent Training Partners
Take the Next Step
Find a Public Session, discuss a private course, or ask us which course fits.
Conference organizers can discuss a training partnership.