Abstract

This is an advanced malware analysis class that was planned to provide students with elaborated concepts and practical techniques to analyze modern threats.

We will perform a throughout approach about sophisticated resources of IDA Pro such as FLIRT Signatures and IDA SDK. The next section covers details of IDA Pro such as IDC and IDA Python, which will be taught using a mixed approach of concepts and practical examples. Following IDC/IDA Python section, we will explain how to write IDA Pro plugins that makes a huge difference while automating reverse procedures. The next topic teaches how to do dump memory using IDA Pro as well as offers an introduction to analysis using WinDbg, backend with reverse engineering offered by IDA Pro.

The second part of the class we show a practical approach on how to analyze ransomware threats and manage respective details and hurdles found throughout analysis. The course proceeds with an introduction on C++ reversing and explains a methodology to analyze C++ malware threats.

The third part of the course presents an introduction to modern topics such as emulation, instrumentation, binary analysis and symbolic execution that can be applied to malware threats. Finally, the course ends with a solid explanation on kernel drivers and mini-filter driver, and how to analyze kernel driver threats.

This class will focus exclusively on x86/x64 Windows operating system.

Who Should Attend

This class is produced for professionals with a solid knowledge about malware analysis, which is offered by previous Malware Analysis 1 and 2 courses. Definitely, this is an advanced course for seasoned reverse engineering and malware analysts.

This a challenging and demanding course, and students should be prepared.

Key Learning Objectives

Students attending this class will:

  • Refresh native binary techniques learned from Malware Analysis 2.
  • Learn how to write FLIRT Signatures and use IDA Pro SDK.
  • Learn how to write IDC/IDA Python programs.
  • Learn how to write IDA Plugins.
  • Learn how to analyze dumps using different techniques.
  • Learn how to analyze ransomware threats.
  • Learn fundamental concepts and practical techniques to analyze C++ threats.
  • Introduce techniques such as instrumentaion, binary analysis and symbolic execution.
  • Master main kernel and minifilter drivers concepts.
  • Learn how to analyze kernel driver threats.

Prerequisite Knowledge

The recommended prior knowledge for attending this class follows below:

  • Knowledge on static and dynamic analysis.
  • Experience on IDA Pro or equivalent disassembler/decompiler.
  • Experience on reverse engineering.
  • Experience on malware analysis.
  • Prior experience on Python programming.

Lab Requirements

Students must prepare the following lab configuration:

  • Having VMware Workstation, Oracle VirtualBox or Microsoft Hyper-V installed on the system.
  • Two virtual machines running Windows 11.
  • One virtual machine running Ubuntu 22.04+ or REMnux.
  • Malwoverview installed on both virtual machines, including all necessary APIs already configured.
  • Visual Studio Code installed in both Windows virtual machines.
  • Visual Studio and SDK installed on both Windows machines.
  • Recent versions IDA Pro or IDA Free.
  • x64dbg installed in all Windows virtual machines.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

The list of sections presented in this class follows:

  • Key reversing concepts and lab configuration.
  • Native binary analysis review.
  • FLIRT Signature and IDA SDK.
  • IDC/IDA Python.
  • Dump file analysis.
  • Ransomware Analysis.
  • Introduction to C++ Reversing.
  • Introduction to emulation, instrumentation, binary analysis and symbolic execution.
  • Kernel drivers and minifilter drivers: concepts and threat analysis.

Note: Topics can be added, merged or removed without prior notice!