RE-MA-Roadmap - Reverse Engineering and Malware Analysis Roadmap

项目说明

RE-MA-Roadmap

Reverse Engineering and Malware Analysis Roadmap

!image

Welcome to the comprehensi for mastering reverse engineering and malware analysis. This roadmap is designed to guide indi from beginner to expert level in the field of reverse engineering and malware analysis.

Foundations

0x00 Establishing a Secure Lab En

Build a Malware Analysis Lab (Self-Hosted & Cloud) - The Malware Analysis Project 101

0x01 Mastering Reverse Engineering Tools

Reverse Engineering For E!

Re with Lena151 – learn OllyDbg (old, but still very useful)

RE WITH IDA PRO FROM SCRATCH

Introduction to Windbg and debugging windows

Writing IDA plugins in C/C++

- reference :

IDA Plugin Writing in C++ v1.1

IDA Plugin Writing in C++

Gathering Intelligence

0x02 Sourcing Malware Samples

Malware Traffic Analysis

Malshare

Abuse.ch

TheZoo

MalwareBazaar

0x03 Gathering Threat Intelligence

Benkow

Cybercrime Tracker

Analyzing Malware Families

0x04 Understanding Common Malware Families

Malpedia

Practical Exercises

0x05 Beginner Challenges and Writeups

first of all :

+ Windows Stack Protection I: Assembly Code
+ Windows Stack Protection II: Exploit Without ASLR
+ Windows Stack Protection III: Limitations of ASLR
+ The Wild World of Windows

Material for Reverse Engineering Malware Practical Examples (2020 Jason Reaves)

Beginner Malware Re Challenges (by Malware Tech)

solve the Malwarebytes CrackMe: a step-by-step tutorial

MalwareTech Windows Re Challenge #1 Write-Ups

MalwareTech Windows Re Challenge #2 Write-Ups

MalwareTech Windows Re Challenge #3 Write-Ups

Crackmes.one – crackmes to help you exercise re

"Nightmare" – a reverse engineering course created around CTF tasks

FlareOn Challenge writeups

Devil is : Re Inheritance in C++ Binaries

Understanding Low-Le

0x06 Assembly Language and PE Format

Video 1 and Video 2 for x86 assembly introduction

Free course on assembly for other platforms

Intel official manual on assembly language

An In-Depth Look Into The Win32 Portable Executable File Format

An In-Depth Look into the Win32 Portable Executable File Format

Peering Inside the PE: A Tour of the Win32 Portable Executable File Format

PE101 and PE102 by Ange Albertini

Introduction to the Portable Executable (PE) File Format

Win32 Portable Executable File Format

Inside Windows PE

Windows Internals 7th Edition

Dynamic Linking and Windows PE

Understanding Windows PE Files

Binary Analysis Cookbooks

Windows PE Parsing with Python

Automation Techniques in C++ Reverse Engineering

Additional Assembly Resources

Modern x64 Assembly

Intro to x86 Assembly Language

x86_64 Linux Assembly

Intro x86 (32 bit)

Practical x64 Assembly and C++ Tutorials

Introductory Intel x86: Architecture, Assembly, Applications, & Alliteration

LINUX SYSTEM CALL TABLE FOR X86 64

Learning assembly for linux-x64

x86-assembly-cheat

x86 Assembly Guide

Assembly’s Perspective

A Crash Course in x86 Assembly for Reverse Engineers

Understanding C by learning assembly

x86 Assembly Crash Course → YouTube

x86 and amd64 instruction reference

Learn x86_64 Assembly

- Part 1
- Part 2

x86-64 Assembly Programming with Ubuntu

Assembly for beginners

Assembly Language Succinctly

E you want to know about x86 microcode, but might have been afraid to ask

[Beginner Write your first Assembly Language program – Hello World!! [explained]]()

Quick Guide to Assembly in 161 - Berkeley

godbolt.org - Code ↔️ Assembly

Introduction to ARM

INTRODUCTION TO ARM ASSEMBLY BASICS

Art of Assembly Language, The - Hyde, Randall

Assembly Language Step-by-Step: Programming with Linux - Duntemann, Jeff

0x07 Programming for Reverse Engineering

C/C++, Python, and Assembly

MalwareTech's article on programming for malware analysis

Recommended learning resources:

- x86 Assembly: Iczelion's tutorial, Win32 Assembler for Crackers by Goppit
- C/C++: The C Programming language - by Kernighan & Ritchie, The C++ Programming language, Linux Programming by example - by Kurt Wall

Windows System Programming book

CPP / C++ Notes - Windows API Programming Win32

Start Now with These Books!

After all this learning, you can now start with these essential books on Reverse Engineering & Exploitation:

#### Reverse Engineering & Exploitation

Re: Secrets of Reverse Engineering - Eilam, Eldad

Practical Reverse Engineering: x86, x64, ARM, Windows Kernel - Dang, Bruce & Gazet, Alexandre & Bachaalany, Elias

Malware Unpacking

0x08 Manual Unpacking Techniques

some ways...

- way one :
- way two :

manual unpacking

Malware Analysis - ConfuserEx 2 Deobfuscation with Python and dnlib, BBTok Loader

Unpacking UPX packer

How to unpack UPX packed malware with a SINGLE breakpoint

LL deobfuscation of binaries

Automating Malware Deobfuscation with Binary Ninja - Writing a Static Unpacker

How To Quickly Unpack Qbot Loader Malware

Anti-UPX Unpacking Technique - explains the details of Anti-UPX Unpacking technique, which is often applied to Linux-targeting malware

x64Unpack: Hybrid Emulation Unpacker for 64-bit Windows En and Detailed Analysis Results on 3.4

The Art Of Unpacking part 1

The Art Of Unpacking part 2

Statically Unpacking Shellcode-based PE Loaders

DOSfuscation: Exploring the Depths of Cmd.exe Obfuscation and Detection Techniques

Ad Techniques

0x09 Protectors

Workshop: Obfuscation Analysis

Tigress: Software Obfuscation Pt. 1

3: Software Obfuscation Pt. 2

Discussion on reverse engineering

2 – Detailed Analysis of the Machine Architecture

2 – Part Two, Complete Static Analysis

SpeakEasy: a writeup solving a challenge from UIUCTF 2021

Tickling with LLVM

Cracking programs with custom protectors

Dealing with packer

Unpacking Obfuscators

Machine RE-building

Breaking State-of-the-Art Binary Code Obfuscation Synthesis

Ad Binary Deobfuscation

Deobfuscation of Lumma Stealer

Analyzing Mutation-Coded - and Alcatraz English

[[Research] LL De: Part 1 (EN)]()

ESET’S GUIDE TO DEOBFUSCATING AND DE FINFISHER

0x0a Malware Injection and Hooking

A walk-through techniques (by Endgame)

Ready-made demos of code injection techniques (source code)

Review of injection techniques (BlackHat 2019) Video - PDF

Author's PE injection demos (source code)

"Inline Hooking for programmers" (by MalwareTech) - Part 1 and Part 2

Windows API Hooking (article in Red Teaming Experiments)

Simple userland rootkit - a case study

0x0b Kernel-mode Malware

Before we dive into kernel-mode malware and rootkit techniques, it's important to understand the fundamentals of dri and kernel programming. Below are some great starting points that will guide you through these concepts and provide a solid foundation.

#### Basic Dri Resources

Catalog of key Windows kernel data structures

1. Dri Part 1: Introduction to Drivers
CodeProject: Introduction to Drivers

2. Dri Part 2: Introduction to Implementing IOCTLs
CodeProject: Introduction to Implementing IOCTLs

3. Dri Part 3: Introduction to Dri
CodeProject: Introduction to Dri

4. Dri Part 5: Introduction to the Transport Device Interface
CodeProject: Introduction to Transport Device Interface

5. Dri Part 6: Introduction to Display Drivers
CodeProject: Introduction to Display Drivers

#### Additional Resources

Memory Management in Kernel Mode

The best starting point for these aspects is tutorials written by Four-F:
- How The Kernel Manages Your Memory
- Dri - DMA Concepts
- X-DMA - Extreme DMA for Performance
- MmMapLockedPages(SpecifyCache) with AccessMode == UserMode
- A Common Topic Explained - Sharing Memory Between Drivers and Applications
- Windows NT Memory (Part I)
- Windows NT Memory (Part II)
- Finding File Contents in Memory

Handling IRPs (I/O Request Packets)

- Properly Pending IRPs - IRP Handling for the Rest of Us
- Proper Completion -- Resubmitting IRPs from within a Completion Routine
- Rules for Irp Dispatching and Completion Routines
- Beyond IRPs: Driver to Dri
- IrpTracker
- Rolling Your Own - Building IRPs to Perform I/O
- The Truth About Cancel - IRP Cancel Operations (Part I)
- The Truth About Cancel - IRP Cancel Operations (Part II)

~ A must-read for dri:
- Microsoft: Handling IRPs

The Basics:Bugchecks Explained

+
+
+
+

#### Important Books for Kernel and Dri

- Windows Kernel Programming (First Edition) *(A in the REbooks folder)*
- Windows Kernel Programming, 2nd Edition *(A in the REbooks folder)*
- Windows NT Device Dri *(A in the REbooks folder)*
- Windows Internals, Part 1, 7th Edition - 2017
- Windows Internals, 7th Edition, Part 2 - 2021 *(A in the REbooks folder just extrat the zip)*

#### Web Resources

OSR Online: The first and most important resource about Windows Dri

OSR Online

Other Useful Blogs and Resources

- J00ru Blog - Reverse Engineering & Kernel Research
- Rootkit Analysis Tutorial PDF *(a in the current repo under the REbooks folder)*

#### Transition to Kernel-mode Malware

Once you’ve gone through these foundational resources, you’ll have a better understanding of dri, IRPs, memory management, and more. Now we can proceed to ad topics like kernel-mode malware, rootkit analysis, and related techniques.

---

#### Key Resources for Kernel-mode Malware and Rootkit Techniques

Starting with Windows Kernel Exploitation - setting up the lab

Brief introduction to dri methods by Matt Hand

Rootkit analysis tutorial

#### Kernel-mode Rootkit Techniques:

Hooking IDT

SSDT hooks

IRP hooks

Kernel filters

0x0c Going Deeper

Malware infecting MBR, bootkits, and UEFI firmware

UEFI Reverse Engineering, Discovery, and Exploit De

Learning Resources

0x0d Courses and Tutorials

Mytechnotalent's Reverse Engineering Repository

Octopus Labs

Open Security Training

Practical Malware Analysis learning materials

Malware Analysis course (Uni of Cincinnati)

Red/purple teaming: a malware de course by 0xPat

Building C2 implants in C++

Hasherezade's malware training repository

### - Obfuscation
- Practical Obfuscating Programs
- Program Obfuscation
- In: PowerShell obFUsk8tion Techniques & How To (Try To) D""eTecT 'Th'+'em'
- Obfuscation-based Malware Update: A comparison of Manual and Automated Methods
- Techniques of Program Code Obfuscation for Secure Software
- A Tutorial on Software Obfuscation
- CODE OBFUSCATION AND VIRUS DETECTION
- Software Obfuscation with Non-Linear Mixed Boolean-Arithmetic Expressions
- COMBATING CONTROL FLOW FLATTENING IN .NET MALWARE
- Modern obfuscation techniques (Roman Oravec 2021)
- Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications by the goat Tim Blazytko
- Seeing through obfuscation: interacti and removal of opaque predicates
- Technical Challenges of Indirect Control Flow
- MODERN MALWARE: OBFUSCATION AND EMULATION DEF CON CHINA 1.0 (2019)
- OPAQUE PREDICATE: ATTACK AND DEFENSE IN OBFUSCATED BINARY CODE

0x0e YouTube Channels and

Malware Analysis For Hedgehogs

OALabs

Colin's channel about malware

DuMp-GuY TrIcKsTeR

0x0f Recommended Books

Practical Malware Analysis: A Hands-On Guide to Dissecting Malicious Software

The Art of Computer Virus Research and Defense – Peter Szor

"The "Ultimate"Anti-Debugging Reference" – by Peter Ferrie

Malware Analyst's Cookbook and D and Techniques for Fighting Malicious Code

Hacker Disassembling Uncovered – by Kris Kaspersky

The Rootkit Arsenal: Escape and E in the Dark Corners of the System

Rootkits and Bootkits – by Alex Matroso Rodionov, and Sergey Bratus

Windows System Programming (4th edition) – by Johnson M. Hart

Tips and Advice

0x10 Staying Motivated and Ad Your Career

Stay curious and eager to learn

Practice, practice, practice

Engage with the community

Contribute and share your knowledge

Stay up-to-date with the latest trends and techniques

Develop strong programming skills in languages like C/C++, Python, and Assembly

Embrace failure as a learning opportunity

Maintain a safe and controlled en for your analysis

Respect intellectual property and adhere to ethical guidelines

0x11 Getting a Malware Analyst Job

Contribute to the community through research, blog posts, or open source projects

Stay active and engaged in the field by attending conferences and participating in CTFs

Build a solid online presence by sharing your work and insights on platforms like GitHub and Twitter

Network with industry professionals and join relevant communities and forums

Continuously update your skills and knowledge through self-study and formal training programs

Conclusion

This comprehensi provides a step-by-step guide for mastering reverse engineering and malware analysis. By following the suggested resources and engaging in practical exercises, you can build a strong foundation, develop ad skills, and position yourself for a successful career in this field. Remember to stay motivated, curious, and always eager to learn. Good luck on your reverse engineering and malware analysis journey!

Additional Resources

Blogs and Websites

MalwareTech

Hasherezade's Blog

Malwarebytes Labs

FireEye Threat Research Blog

Talos Intelligence Blog

Securelist by Kaspersky

The Malware Analyst's Cookbook

0xec

Malwarebytes Unpacked

SANS Internet Storm Center

MalwareMustDie

Re

Forums and Communities

MalwareTips

Reverse Engineering Stack Exchange

KernelMode.info

Wilders Security Forums

Malware Analysis Forums on Reddit

Community

OSR De Community

UnKnoWnCheaTs

Reverse Engineering - Stack exchange

ru-board

R0

CrackLab

Tools and Software

IDA Pro

Ghidra

x64dbg

OllyDbg

Immunity Debugger

Wireshark

Cuckoo Sandbox

PEStudio

Sysinternals Suite

YARA

Capstone

Radare2

Binary Ninja

Online Platforms and Challenges

MalwareBazaar

Hybrid Analysis

Flare-On Challenge

CTFTime

Hack The Box

Upcoming Resources

I will be adding some random books to the REbooks folder soon. Stay tuned for more resources!

Acknowledgments

A big thank you to all the researchers, authors, and contributors who ha their knowledge and resources in the field of reverse engineering and malware analysis. This roadmap wouldn't have been possible without their contributions.

Contributing

Contributions are welcome! If you have any suggestions, resources, or impro to this roadmap, please feel free to open an issue or submit a pull request.

channel

Join OrcaCyberWeapons on

Are you ready to dive into the depths of cybersecurity, reverse engineering, and ad threat analysis? Look no further than OrcaCyberWeapons, your gateway to the world of cutting-edge security research and exploration.

What We Offer:

Ad Cybersecurity Insights: Delve into the latest trends, techniques, and strategies employed by cyber ad, shedding light on the vast world of malware, exploits, APTs, and cybercrime across all platforms.

Reverse Engineering Expertise: Uncover the inner workings of sophisticated malware, dissect exploit techniques, and explore the art of reverse engineering with our community of seasoned professionals and enthusiasts.

Malware De and Analysis: Gain insights into the creation, analysis, and mitigation of malware, understanding its behavior, impact, and countermeasures.

APT Techniques and Defense Strategies: Explore the realm of ad persistent threats (APTs), dissect their tactics, and fortify your defenses against sophisticated cyber ad.

Whether you're a seasoned cybersecurity professional, an aspiring ethical hacker, or a curious enthusiast, OrcaCyberWeapons provides a platform for in-depth discussions, practical insights, and collaborati of the e cybersecurity landscape.

Join us on g in the realm of cybersecurity and beyond.

Join OrcaCyberWeapons on

项目信息

开发语言：未知

Star 数：937

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Reverse Engineering and Malware Analysis Roadmap展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。