Duration
5 days
Outline
- A Crash Course in CISC/RISC and Programming Basics
- Basic concepts
- Assembly languages
- Becoming familiar with x86 (IA-32 and x64)
- Exploring ARM assembly
- Basics of MIPS
- Covering the SuperH assembly
- Working with SPARC
- Moving from assembly to high-level programming languages
- Summary
- Basic Static and Dynamic Analysis for x86/x64
- Working with the PE header structure
- Static and dynamic linking
- Using PE header information for static analysis
- PE loading and process creation
- Dynamic analysis with OllyDbg/immunity debugger
- Debugging malicious services
- Summary
- Unpacking, Decryption, and Deobfuscation
- Exploring packers
- Identifying a packed sample
- Automatically unpacking packed samples
- Manual unpacking using OllyDbg
- Dumping the unpacked sample and fixing the import table
- Identifying different encryption algorithms and functions
- String search detection techniques for simple algorithms
- Identifying the RC4 encryption algorithm
- Standard symmetric and asymmetric encryption algorithms
- Applications of encryption in modern malware – Vawtrak banking Trojan
- Using IDA for decryption and unpacking
- Summary
- Inspecting Process Injection and API Hooking
- Understanding process injection
- DLL injection
- Working with process injection
- Dynamic analysis of code injection
- Memory forensics techniques for process injection
- Understanding API hooking
- Working with API hooking
- Exploring IAT hooking
- Summary
- Bypassing Anti-Reverse Engineering Techniques
- Exploring debugger detection
- Handling debugger breakpoints evasion
- Escaping the debugger
- Obfuscation and anti-disassemblers
- Detecting and evading behavioral analysis tools
- Detecting sandboxes and virtual machines
- Summary
- Understanding Kernel-Mode Rootkits
- Kernel mode versus user mode
- Windows internals
- Rootkits and device drivers
- Hooking mechanisms
- DKOM
- Process injection in kernel mode
- KPP in x64 systems (PatchGuard)
- Static and dynamic analysis in kernel mode
- Summary
- Handling Exploits and Shellcode
- Getting familiar with vulnerabilities and exploits
- Cracking the shellcode
- Exploring bypasses for exploit mitigation technologies
- Analyzing Microsoft Office exploits
- Studying malicious PDFs
- Summary
- Reversing Bytecode Languages: .NET, Java, and More
- Exploring the theory of bytecode languages
- .NET explained
- .NET malware analysis
- The essentials of Visual Basic
- Dissecting Visual Basic samples
- The internals of Java samples
- Python—script language internals
- Analyzing compiled Python
- Summary
- Scripts and Macros: Reversing, Deobfuscation, and Debugging
- Classic shell script languages
- VBScript explained
- Those evil macros inside documents
- The power of PowerShell
- Handling JavaScript
- Behind C&C—even malware has its own backend
- Other script languages
- Summary
- Dissecting Linux and IoT Malware
- Explaining ELF files
- Exploring common behavioral patterns
- Static and dynamic analysis of x86 (32- and 64-bit) samples
- Learning Mirai, its clones, and more
- Static and dynamic analysis of RISC samples
- Handling other architectures
- Summary
- Introduction to macOS and iOS Threats
- Understanding the role of the security model
- File formats and APIs
- Static and dynamic analyses of macOS and iOS samples
- Attack stages
- Advanced techniques
- Analysis workflow
- Summary
- Analyzing Android Malware Samples
- (Ab)using Android internals
- Understanding Dalvik and ART
- Malware behavior patterns
- Static and dynamic analysis of threats
- Summary
Programme scope, delivery arrangements and suitability are confirmed during enquiry.