Malware Analysis

6.

Advanced Dynamic Analysis (Debugging)

6.1.

Interactive Code Execution

6.1.1.

Setting Up a Debugging Environment

6.1.2.

Debugger Selection

6.2.

Introduction to Debugging

6.2.1.

User-Mode Debugging

6.2.1.1.

Application Debugging

6.2.1.2.

6.2.2.

Kernel-Mode Debugging

6.2.2.1.

Driver Debugging

6.2.2.2.

System-Level Analysis

6.3.

Using a Debugger

6.3.1.

6.3.1.1.

Interface Overview

6.3.1.2.

6.3.2.

6.3.2.1.

Command Line Interface

6.3.2.2.

Debugging Extensions

6.3.3.

6.3.3.1.

Command Line Debugging

6.3.3.2.

6.3.4.

Attaching to a Process

6.3.4.1.

Process Selection

6.3.4.2.

Attachment Methods

6.3.5.

Setting Breakpoints

6.3.5.1.

Software Breakpoints

6.3.5.2.

Hardware Breakpoints

6.3.5.3.

Conditional Breakpoints

6.3.5.4.

Memory Breakpoints

6.3.6.

Stepping Through Code

6.3.6.1.

6.3.6.2.

6.3.6.3.

6.3.6.4.

6.3.7.

Inspecting Program State

6.3.7.1.

6.3.7.1.1.

General Purpose Registers

6.3.7.1.2.

Special Purpose Registers

6.3.7.2.

6.3.7.2.1.

6.3.7.2.2.

6.3.7.3.

6.3.7.3.1.

Stack Frame Analysis

6.3.7.3.2.

Local Variables

6.3.7.4.

Call Stack Analysis

6.3.7.4.1.

Function Call History

6.3.7.4.2.

Return Addresses

6.4.

Unpacking Malware

6.4.1.

Identifying Packed Executables

6.4.2.

Manual Unpacking Techniques

6.4.3.

Identifying the Original Entry Point (OEP)

6.4.3.1.

6.4.3.2.

Memory Breakpoints

6.4.4.

Dumping the Unpacked Code from Memory

6.4.4.1.

Process Dumping Tools

6.4.4.2.

Manual Memory Extraction

6.4.5.

Rebuilding Import Tables

6.4.5.1.

Import Reconstruction

6.4.5.2.

Previous

5. Advanced Static Analysis (Code-Level)

Go to top

Next

7. Analysis of Obfuscated and Evasive Malware