Reverse Engineering Essentials

Tools and Techniques for Windows Malware Analysis

What you'll learn
How to build a virtual environment for malware analysis
How to identify and bypass anti-virtualisation techniques
How to confidently use debuggers and disassemblers
Be able to analyse processes and perform low-level API monitoring
How to monitor changes to the Registry and the file system
Learn how to intercept and investigate network traffic
Execute samples inside a sandbox, extract and analyse artefacts
Become comfortable with tools for static analysis
How to identify packers automatically and manually
Requirements
There are no pre-requisites for this class other that a Windows virtual machine and the will to learn.
All the tools used here are freely available online.
Malware samples and scripts/programs presented are attached as resource.
Description
The aim of this course is to cover the essentials techniques and tools for reverse engineering and malware analysis. As the title suggests, we will cover only the Windows environment in this class, since it is by far the most used and abused. We try to provide a complete picture for the starting reverse engineer but in the same time relevant for the more advanced analysts.There are always multiple ways to do a task. We will insist more on "Why?"s instead of "How?"s since we consider that it's more important to understand WHAT we're trying to achieve and WHY.There are no pre-requisites for this class other that a Windows virtual machine and the will to learn. All the tools discussed here are freely available online. Analyses are demonstrated on a Windows 8.1 virtual machine.Don't worry! Neither professional programming experience nor assembly language knowledge are required to benefit from the course. If you know these already, it would be helpful when we’ll look at identifying encryption algorithms and bypass anti-virtualisation checks. The concepts will be explained clearly and additional resources will be recommended.Some programming experience will definitely be beneficial, however, the focus will be mostly on understanding the technique, the tools and their most useful features. When needed, source code written in C or Python will be provided.To get the most out of this course, we recommended to try all the exercises and assignments that follow the lectures and whenever a concept or idea is not fully explained or clearly understood, either reach out with questions on the Q&A section or consult online resources.

Overview

Section 1: Introduction

Lecture 1 Introduction

Section 2: Building a virtual environment

Lecture 2 Setup

Lecture 3 Setup Practice

Lecture 4 Hardening - VM Detection

Lecture 5 Hardening - VM Detection Practice

Lecture 6 Hardening - Anti VM Detection Practice

Lecture 7 Anti-VM and Anti-Debug

Lecture 8 Anti-VM and Anti-Debug Practice 1

Lecture 9 Anti-VM and Anti-Debug Practice 2

Lecture 10 Anti-VM and Anti-Debug Practice 3

Lecture 11 Anti-VM and Anti-Debug Practice 4

Section 3: Analysis Tools

Lecture 12 Monitor Process Activity

Lecture 13 Monitor Process Activity Practice 1

Lecture 14 Monitor Process Activity Practice 2

Lecture 15 Monitor Process Activity Practice 3

Lecture 16 Monitor Process Activity Practice 4

Lecture 17 Monitor API Calls

Lecture 18 Monitor API Calls Practice 1

Lecture 19 Monitor API Calls Practice 2

Lecture 20 Monitor API Calls Practice 3

Lecture 21 Monitor Registry and File System

Lecture 22 Monitor Registry and File System Practice 1

Lecture 23 Monitor Registry and File System Practice 2

Lecture 24 Monitor Network Activity

Lecture 25 Monitor Network Activity Practice 1

Lecture 26 Monitor Network Activity Practice 2

Lecture 27 Monitor Network Activity Practice 3

Lecture 28 Monitor Network Activity Practice 4

Lecture 29 Sandboxing

Lecture 30 Sandboxing Practice 1

Lecture 31 Sandboxing Practice 2

Lecture 32 Static Analysis

Lecture 33 Static Analysis Practice 1

Lecture 34 Static Analysis Practice 2

Section 4: Next steps

Lecture 35 Next steps

Security testers,Malware analysts,Forensics investigators,System administrators,Information security students,anyone interested in information security in general and reverse engineering in particular