Malware Analysis

  1. Advanced Static Analysis (Code-Level)
    1. Disassembly
      1. Introduction to Assembly Language
        1. x86 Architecture
          1. General Purpose Registers
            1. Segment Registers
              1. Flag Registers
                1. Instruction Set
                  1. Data Movement Instructions
                    1. Arithmetic Instructions
                      1. Logic Instructions
                        1. Control Flow Instructions
                      2. x64 Architecture
                        1. Extended Registers
                          1. Calling Conventions
                            1. Differences from x86
                            2. ARM Architecture
                              1. ARM Registers
                                1. Instruction Set
                                  1. Thumb Mode
                                2. Using Disassemblers
                                  1. IDA Pro
                                    1. Interface Navigation
                                      1. Function Analysis
                                        1. Cross-References
                                        2. Ghidra
                                          1. Project Setup
                                            1. Code Browser
                                              1. Decompiler Integration
                                              2. Radare2
                                                1. Command Line Interface
                                                  1. Visual Mode
                                                    1. Scripting Capabilities
                                                  2. Control Flow Graphs
                                                    1. Understanding Program Flow
                                                      1. Identifying Branches and Loops
                                                        1. Basic Block Analysis
                                                      2. Decompilation
                                                        1. Converting Machine Code to High-Level Language
                                                          1. Limitations and Inaccuracies of Decompilers
                                                            1. Decompiler Tools
                                                              1. Hex-Rays Decompiler
                                                                1. Ghidra Decompiler
                                                                  1. Snowman Decompiler
                                                                2. Identifying Key Code Structures
                                                                  1. Functions and Procedures
                                                                    1. Function Prologue and Epilogue
                                                                      1. Calling Conventions
                                                                        1. Parameter Passing
                                                                        2. Loops and Conditionals
                                                                          1. For Loops
                                                                            1. While Loops
                                                                              1. If-Else Statements
                                                                                1. Switch Statements
                                                                                2. Data Structures
                                                                                  1. Arrays
                                                                                    1. Linked Lists
                                                                                      1. Structures
                                                                                        1. Hash Tables
                                                                                      2. Analyzing API and System Calls
                                                                                        1. Windows API
                                                                                          1. Kernel32.dll Functions
                                                                                            1. User32.dll Functions
                                                                                              1. Advapi32.dll Functions
                                                                                                1. Commonly Abused Functions
                                                                                                  1. CreateProcess
                                                                                                    1. WriteProcessMemory
                                                                                                      1. VirtualAlloc
                                                                                                        1. RegSetValue
                                                                                                      2. Linux System Calls
                                                                                                        1. System Call Table
                                                                                                          1. Common System Calls
                                                                                                            1. execve
                                                                                                              1. fork
                                                                                                                1. open
                                                                                                                  1. write
                                                                                                                2. Identifying Malicious Functionality
                                                                                                                  1. File Operations
                                                                                                                    1. File Creation and Deletion
                                                                                                                      1. File Encryption
                                                                                                                      2. Network Operations
                                                                                                                        1. Socket Creation
                                                                                                                          1. Network Communication
                                                                                                                          2. Process Manipulation
                                                                                                                            1. Process Injection
                                                                                                                              1. DLL Injection

                                                                                                                        Previous

                                                                                                                        4. Basic Dynamic Analysis

                                                                                                                        Go to top

                                                                                                                        Next

                                                                                                                        6. Advanced Dynamic Analysis (Debugging)