{
  "added_at": "2026-11-06",
  "additional_evidence_urls": [
    "https://github.com/mikesiko/PracticalMalwareAnalysis-Labs/blob/5f55de02a10748247f7511dafaaf18a37d332ff5/README.md"
  ],
  "category": "learning",
  "description_en": "No Starch Press book, published in February 2012, that teaches hands-on malware analysis from basic static and dynamic techniques in virtual machines through x86 disassembly with IDA Pro, debugging with OllyDbg and kernel debugging with WinDbg. Later chapters cover malicious Windows programs, covert launching, data encoding, network signatures, anti-disassembly, anti-debugging and anti-VM techniques, unpacking, shellcode, C++ and 64-bit malware, and hands-on labs with solutions have readers dissect malware samples.",
  "description_zh": "No Starch Press 于 2012 年 2 月出版的书籍，以动手实践的方式讲解恶意软件分析：从在虚拟机中运用基础静态与动态分析技术入手，进而讲解用 IDA Pro 进行 x86 反汇编、用 OllyDbg 调试以及用 WinDbg 进行内核调试。后续章节涵盖恶意 Windows 程序、隐蔽启动、数据编码、网络特征、反反汇编、反调试与反虚拟机技术、脱壳、shellcode、C++ 和 64 位恶意软件；书中配有附解答的动手实验，让读者剖析恶意软件样本。",
  "entry_url": "https://awesomerea.org/resources/practical-malware-analysis/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/practical-malware-analysis/",
  "evidence_url": "https://nostarch.com/malware",
  "group": "learn",
  "id": "practical-malware-analysis",
  "json_url": "https://awesomerea.org/resources/practical-malware-analysis/record.json",
  "kind": "learning-resource",
  "markdown_url": "https://awesomerea.org/resources/practical-malware-analysis/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/practical-malware-analysis/index.md",
  "name": "Practical Malware Analysis",
  "name_zh": "《Practical Malware Analysis》恶意软件分析实战指南",
  "record_type": "resource",
  "relationship": "learning",
  "requirement_facets": [
    "prerequisites",
    "prerequisites",
    "limits",
    "limits"
  ],
  "requirements": [
    "An 800-page book, sold in print with a free ebook or as a PDF, Mobi and ePub ebook. Chapter 12, the detailed table of contents and the index are free PDFs, and an errata PDF is posted.",
    "Following the book needs a safe virtual analysis environment, which it teaches readers to set up, and the analysis tools it covers, such as IDA Pro, OllyDbg and WinDbg.",
    "The publisher's “Download the labs” link leads to a GitHub repository offering the lab binaries as a self-extracting archive or a password-protected 7-Zip file. Its README warns that the binaries contain malicious code that should not be installed or run without first setting up a safe environment, and that, like real malware, some may crash, leak memory or behave unexpectedly.",
    "The labs target Windows XP: many work on newer Windows but some do not, and a separate archive holds labs rebuilt for Windows 7 whose results differ from the book's answers."
  ],
  "requirements_zh": [
    "全书 800 页，有纸质版（附赠电子书）和 PDF、Mobi、ePub 电子版。第 12 章、详细目录和索引可免费下载 PDF，出版社还发布了勘误表 PDF。",
    "跟随书中内容操作需要一个安全的虚拟分析环境（书中会教读者搭建），以及书中讲到的 IDA Pro、OllyDbg 和 WinDbg 等分析工具。",
    "出版社页面上的“Download the labs”链接指向一个 GitHub 仓库，实验二进制文件以自解压包或带密码的 7-Zip 压缩包形式提供。其 README 警告这些二进制文件含有恶意代码，未先搭建安全环境就不应安装或运行；与真实恶意软件一样，其中一些可能崩溃、内存泄漏或出现其他意外行为。",
    "实验以 Windows XP 为目标平台：许多实验在更新的 Windows 上也能运行，但有些不行；另有单独的压缩包收录为 Windows 7 重写的实验，其结果与书中答案不同。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://nostarch.com/malware",
  "verification": "source-reviewed",
  "verified_at": "2026-11-05"
}