Duration
4 days
Overview
The malware author’s job is to develop software that can collect and return data, run undetected, frustrate reverse-engineering efforts and make detection as difficult as possible. Building on the material presented in our MANDIANT Introduction to Malware Analysis, this course focuses on three areas critical to successful malware reverse engineering: disassembly, debugging and Windows internals.
Other topics covered include: dynamic analysis, identification of host- and network-based indicators and Windows APIs often used by malware authors. All concepts and material presented are reinforced with demonstrations, real-world case studies, follow-along exercises and student labs that allow students to practice what they have learned.
Who Should Attend
Information technology staff, information security staff, corporate investigators or others requiring an understanding of how malware works and the steps and processes involved in Malware Analysis.
Prerequisites
Excellent knowledge of computer and operating system fundamentals is required. Some exposure to software development is highly recommended. Completion of MANDIANT’s Introduction to Malware Analysis, while not required, is extremely beneficial.
Objectives
- Static program analysis methodology
- Dynamic program analysis methodology
- Windows internals and APIs
- Use of IDA Pro
- Debugging programs
- Advanced use of the OllyDbg debugger
Exercises & Labs
- Recognizing coding constructs in disassembly (multipart)
- Utilizing dynamic analysis to understand functionality of a backdoor (multipart)
- Understanding Windows internals (multipart): file API, loader, networking, registry usage, threads
- Final lab: complete analysis of a fully functioning, real-world based backdoor
Binary Disassembly
Students learn how to use the industry standard disassembler (IDA Pro) to translate complex machine code into a more manageable representation.
Major topics of disassembly covered include:
- x86 assembly language
- reversing basics: branches, loops, switches
- differences between code and data
- cross-references
- imports & exports
- searching
- defining arrays, structures and functions
- standard library functions and FLIRT
- IDA scripts and plugins
Debuggers
Learn how to use debuggers to monitor the internal workings of a program as it runs. Students will use debuggers to view and modify memory, disassembly, registers and the call stack. Students will also learn how to create labels, comments, bookmarks and breakpoints (conditional & hardware) using OllyDbg. Students will understand the value of controlling execution by stepping as well as patching binaries for temporary or permanent behavior modification.
Windows Internals
Instructors will teach students the pertinent details on the Windows environment. During this section, students will learn about PE file formats, loaders, dynamically linked libraries, processes, threads and Windows APIs. Students will also explore the Windows Registry, network functions and the Native API.
Class Exercises
Throughout the class, key concepts are reinforced through exercises. Students will use IDA Pro to disassemble and step through multiple binaries and perform executable runtime analysis using OllyDbg.
As the final exercise, students perform complete analysis of functional malware designed to emulate real-world examples.
Programme scope, delivery arrangements and suitability are confirmed during enquiry.