Learning resource
Practical Malware Analysis
No Starch Press book, published in February 2012, that teaches hands-on malware analysis from basic static and dynamic techniques in virtual machines through x86 disassembly with IDA Pro, debugging with OllyDbg and kernel debugging with WinDbg. Later chapters cover malicious Windows programs, covert launching, data encoding, network signatures, anti-disassembly, anti-debugging and anti-VM techniques, unpacking, shellcode, C++ and 64-bit malware, and hands-on labs with solutions have readers dissect malware samples.
- Targets
- Binary
- Category
- Learning resources
- Relationship
- Learning resource
- Sources reviewed
Requirements & limits
- Prerequisites: An 800-page book, sold in print with a free ebook or as a PDF, Mobi and ePub ebook. Chapter 12, the detailed table of contents and the index are free PDFs, and an errata PDF is posted.
- Prerequisites: Following the book needs a safe virtual analysis environment, which it teaches readers to set up, and the analysis tools it covers, such as IDA Pro, OllyDbg and WinDbg.
- Limits: The publisher's “Download the labs” link leads to a GitHub repository offering the lab binaries as a self-extracting archive or a password-protected 7-Zip file. Its README warns that the binaries contain malicious code that should not be installed or run without first setting up a safe environment, and that, like real malware, some may crash, leak memory or behave unexpectedly.
- Limits: The labs target Windows XP: many work on newer Windows but some do not, and a separate archive holds labs rebuilt for Windows 7 whose results differ from the book's answers.
About this entry
The description was reviewed against primary sources.
Primary sources
- https://nostarch.com/malware
- README.md GitHub · mikesiko/PracticalMalwareAnalysis-Labs · Revision 5f55de0
More in References and learning
- Windows Malware Analysis training, volume 1 (malware_training_vol1) · Learning resource
- esp-idf-injection-ng · Research
- RE-Workstation · Learning resource
- Walksnail Ascent VRX UART Protocol · Documentation
- T2 platform research · Research
- Glaurung Models · Research