Learning resource
Windows Malware Analysis training, volume 1 (malware_training_vol1)
Slides and exercises for a Windows malware analysis training that builds an understanding of common malware techniques through programming, reverse engineering and Windows internals, and shows how analysis tools are used for particular goals. Module 1 covers compilation, the PE format, processes, WoW64, shellcode and PE loaders; module 2 introduces malware missions and tactics, hooking, persistence and banking trojans; module 3 introduces evasion and self-defence and fingerprinting, with obfuscation, anti-hooking, deobfuscation and kernel-mode components planned.
- Targets
- Binary
- Category
- Learning resources
- Relationship
- Learning resource
- Sources reviewed
Requirements & limits
- Prerequisites: Aimed at people who already know the basics of programming and reverse engineering and want to enter Windows malware analysis. Slides are in slides/ and exercises in exercises/.
- Limits: The README marks the material as a work in progress: several topics still lack slides or exercises. The reviewed main commit dates from 2024-07-01.
- License: Published under the Creative Commons Attribution 4.0 license, per the README; the repository has no license file.
About this entry
The description was reviewed against primary sources.
Primary sources
More in References and learning
- esp-idf-injection-ng · Research
- RE-Workstation · Learning resource
- Walksnail Ascent VRX UART Protocol · Documentation
- T2 platform research · Research
- Glaurung Models · Research
- CrackMes · Learning resource