Skip to content

Latest commit

 

History

History
46 lines (37 loc) · 1.32 KB

README.md

File metadata and controls

46 lines (37 loc) · 1.32 KB
Raw

Malware Reverse Engineering Introduction

  • Get the book chapter here
  • Real Malware samples for didactic purposes: cancoes de ninar.zip (ask for the password)

Content

  • File Identification
  • Strings Identification (with regex)
  • Disassembly (objdump)
  • Packing (UPX)
  • Compilation approaches (dynamic libs, static compilation, blobs)
  • Dynamic Analysis (strace, ltrace)
  • Developing a Tracing Solution (ptrace)
  • Modularity Approaches (Forking)
  • Anti-analysis Approaches (ptrace detection)
  • Binary Patching
  • Rootkits (LDPRELOAD)
  • Networking (Iptables)
  • Filesystem Monitoring (Inotify)
  • Logging (syslog, audit)

Part 1

  • Basic concepts and examples
  • 2 hours
  • Federal University of Paraná (2017)
  • University of Campinas (2018)

Part 2

  • Protection, Anti-Analysis, Behaviors
  • 2 hours
  • University of Campinas (2018)

GDB

  • Extra Material for GDB Debugging
  • Manual Entry Point Identification
  • Automated on RevEngE Check Here

SBSEG

  • Short Course in the XIX SBSEG (Brazilian Security Symposium)
  • 4 hours

SHook