Malware-Analysis-Training - Retired beginner/intermediate malware analysis tra

项目说明

Malware-Analysis-Training

Retired beginner/intermediate malware analysis training materials from and . This course was last given in 2010 and the materials were open sourced in 2020. Written in LaTeX + Beamer, the course materials can be rendered in slideshow and article modes.

O

Reverse engineering has e from a "dark art" traditionally restricted to the elite few, to a learnable methodology using public and commercial tools. researchers utilize the art to go beyond the reachable depth of traditional fuzzer technology and locate the more obscure finds. Because of ad in today's malicious code, analysts can no longer rely solely on li techniques for mapping the internal workings of malware. In general, more and more researchers are finding the need to peek "under the hood". This class is meant to impart cutting-edge understanding of malicious code analysis upon attendees, ultimately taking them to an ad level of reverse engineering skills applicable to other security domains.

What You Will Learn

This course was designed for students who have an introductory / basic understanding of x86 assembly and reverse engineering as well as more ad students wishing to refresh their skills and learn new approaches to familiar problems. The course will cover the basics of x86 assembly and pattern recognition, Windows process memory layout, tools of the trade (such as IDA Pro and OllyDbg), the PE file format and basic exploitation methodologies abused by worms to penetrate a target system (stack/heap o). As this course is focused on malicious code analysis, students will be gi virus samples to reverse engineer. The details of executable packing, obfuscation methods, anti-debugging and anti-disassembling will be re and re-enforced with hands-on exercises.

Toward the end of the course more ad reverse engineering techniques with applications to malicious code analysis will be taught—including:

* approaches to automation
* Malware classification
* Applications of binary matching/diffing

Course Structure

This is a two-day course where the notion of "rapid response" is taken into consideration with each aspect, focusing on techniques and methodologies that can be applied in a timely and effecti. We will force you to learn shortcuts and put your mouse to rest. At the completion of this course, students will walk away with applicable real world knowledge that can be directly applied to reverse engineering related tasks, especially with regards to malicious code analysis.

How the Course is Run

This course is by no means a two-day lecture. Instead, you will be engaged in a number of indi and group hands-on exercises to reinforce and solidify e that is taught in the class. Some of the exercises are held in a competiti, followed by class discussion to pin point elegant approaches and solutions that indi or groups may have used. Despite the fact that the course is held in Vegas, take home exercises will be a for the type-A personalities attending the course.

Who Should Attend

If you are interested in the field of reverse engineering, want to learn how to dissect unknown code faster, want to discuss cutting edge technologies, techniques and ideas, or simply want to impress your friends ... then this class is for you.

Learning En

Aside from direct class materials, slides and hands-on exercises, students will have many opportunities to engage in one-on-one questions with instructors. Furthermore, students will be divided into groups by experience to foster student-student knowledge transfer as well.

Prerequisites

Prospecti should be comfortable operating Microsoft Windows and have a basic understanding of x86 assembly and high le and OS concepts.

Course Length: Two days. All course materials, lunch and two coffee breaks will be provided. A Certificate of Completion will be offered. You must provide your own laptop.

Trainers

Pedram Amini

Pedram currently leads the Zero Day Initiative at TippingPoint, a di of 3Com. Previous to TippingPoint, he was the assistant director and one of the founding members of iDEFENSE Labs. Despite the fancy titles he spends much of his time in the shoes of a reverse engineer- de automation tools, plug-ins and scripts for software like IDA Pro and OllyDbg.

In conjunction with his passion for the field, he launched OpenRCE.org, a community website dedicated to the art and science of reverse engineering. He has pre presented at DEFCON, RECon, ToorCon and taught a sold out reverse engineering course at Black Hat US 2005. Pedram holds a computer science degree from Tulane Uni.

Ero Carrera

Ero is currently a reverse engineering automation researcher at SABRE Security, home of BinDiff and BinNavi. Ero has pre spent several years as a Virus Researcher at F-Secure where his main duties ranged from reverse engineering of malware to research in analysis automation methods. Prior to F-Secure, he was in in miscellaneous research and de projects and always had a passion for mathematics, reverse engineering and computer security.

While at F-Secure he ad the field of malware classification introducing a joint paper with Gergely Erdelyi on applying genomic methods to binary structural classification. Other projects he's worked on include seminal research on generic unpacking.

Additionally, Ero is a habitual lurker on OpenRCE and has contributed to miscellaneous reverse engineering tools such as pydot, pype, pyreml and idb2reml.

项目信息

开发语言：HTML

Star 数：907

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Retired beginner/intermediate malware analysis training materials from @pedramamini and @erocarrera.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。