Reverse Engineering Essentials

Name: Reverse Engineering Essentials
Rating: 4.1 (116 reviews)

Tools and Techniques for Windows Malware Analysis

Created byCristina Gheorghisan

Last updated 9/2020

English

What you'll learn

How to build a virtual environment for malware analysis
How to identify and bypass anti-virtualisation techniques
How to confidently use debuggers and disassemblers
Be able to analyse processes and perform low-level API monitoring
How to monitor changes to the Registry and the file system
Learn how to intercept and investigate network traffic
Execute samples inside a sandbox, extract and analyse artefacts
Become comfortable with tools for static analysis
How to identify packers automatically and manually

Course content

4 sections • 35 lectures • 5h 32m total length

Introduction7:15
Delve into Windows-focused reverse engineering with static and dynamic analysis tools, networking investigations, and a guided virtual environment, emphasizing why techniques work and when to apply them.

Setup12:16
Setup Practice8:50
Hardening - VM Detection8:40
Explore how malware detects virtual environments, why researchers use sandboxes, and practical hardening tips to make virtual machines less detectable, including VMware config tweaks and removing shared features.
Hardening - VM Detection Practice13:14
Play with few VM detection tools and understand how they work.
Hardening - Anti VM Detection Practice12:44
Make your virtual machine resilient against being detected, using WMI and Registry tricks.
Anti-VM and Anti-Debug10:26
Anti-VM and Anti-Debug Practice 17:44
Anti-VM and Anti-Debug Practice 26:43
Anti-VM and Anti-Debug Practice 36:34
Explore anti-vm and anti-debug techniques by examining sample3.exe in IDA Pro, using text and binary searches, ASCII view, and overlay handling to reveal vmware strings.
Anti-VM and Anti-Debug Practice 45:08
Examine debugger detection using the process environment block and the being debugged flag, and demonstrate manual bypass and phantom plugin-based hiding techniques.

Monitor Process Activity13:59
Monitor process activity using Process Explorer and Process Hacker to spot malware indicators, inspect connections, threads, and disk I/O, and perform memory dumps for analysis.
Monitor Process Activity Practice 14:32
Monitor Process Activity Practice 29:28
Demonstrate how a crypter conceals malware by disguising a legitimate Notepad, manipulating memory, and evading static checks, using Process Explorer and dumps to uncover a backdoor.
Monitor Process Activity Practice 31:54
Monitor Process Activity Practice 43:26
Spotting suspicious process
Monitor API Calls9:37
Monitor API Calls Practice 15:14
Monitor API Calls Practice 28:43
Monitor API Calls Practice 36:29
Monitor API Calls Assignment
Monitor Registry and File System8:55
Monitor registry and file system changes caused by unknown samples using Process Monitor, RegShot, FolderChangesView, and FileActivityWatch; learn filtering, snapshots, and real-time monitoring.
Monitor Registry and File System Practice 14:51
Monitor Registry and File System Practice 22:47
Observe how FolderChangesView and FileActivityView monitor file and folder activity, analyzing a keylogger sample and related prefetch and ETL files, including Total Commander and system PID 4 access.
Monitor Registry and File System Assignment
Monitor Network Activity16:24
Learn static analysis and practical techniques to monitor and redirect network traffic for malware analysis, using ApateDNS, FakeNet-NG, Wireshark, Burp Suite, Proxifier, and Fiddler.
Monitor Network Activity Practice 18:01
Monitor Network Activity Practice 26:33
Monitor Network Activity Practice 39:15
Monitor Network Activity Practice 45:38
Monitor Network Activity Practice Assignment
Sandboxing17:13
Sandboxing Practice 18:13
Analyze the sample inside and outside Sandboxie with md5, Strings, ExeinfoPE, and Exe2Aut to reveal an AutoIt v3 executable; note Sandboxie process checks and obfuscated strings, plus an extracted image.
Sandboxing Practice 213:02
Analyze ransomware behavior inside a sandbox, observe registry changes and file encryption, and examine ECB mode weaknesses using Process Explorer and Windows Registry Recovery tool.
Static Analysis16:44
Explore static analysis of portable executable files and key PE header fields. Learn about entry point, image base, RVA/VA, sections, and use PEView and ExeInfoPE to detect packers.
Static Analysis Practice 12:43
Static Analysis Practice 213:11
Practice static analysis of a PE file by inspecting the PE header, import table, and sections to detect packing indicators such as UPX using tools like PEview.

Requirements

There are no pre-requisites for this class other that a Windows virtual machine and the will to learn.
All the tools used here are freely available online.
Malware samples and scripts/programs presented are attached as resource.

Description

The aim of this course is to cover the essentials techniques and tools for reverse engineering and malware analysis. As the title suggests, we will cover only the Windows environment in this class, since it is by far the most used and abused. We try to provide a complete picture for the starting reverse engineer but in the same time relevant for the more advanced analysts.

There are always multiple ways to do a task. We will insist more on "Why?"s instead of "How?"s since we consider that it's more important to understand WHAT we're trying to achieve and WHY.

There are no pre-requisites for this class other that a Windows virtual machine and the will to learn. All the tools discussed here are freely available online. Analyses are demonstrated on a Windows 8.1 virtual machine.

Don't worry! Neither professional programming experience nor assembly language knowledge are required to benefit from the course. If you know these already, it would be helpful when we’ll look at identifying encryption algorithms and bypass anti-virtualisation checks. The concepts will be explained clearly and additional resources will be recommended.

Some programming experience will definitely be beneficial, however, the focus will be mostly on understanding the technique, the tools and their most useful features. When needed, source code written in C or Python will be provided.

To get the most out of this course, we recommended to try all the exercises and assignments that follow the lectures and whenever a concept or idea is not fully explained or clearly understood, either reach out with questions on the Q&A section or consult online resources.

Who this course is for:

Security testers
Malware analysts
Forensics investigators
System administrators
Information security students
anyone interested in information security in general and reverse engineering in particular

Reverse Engineering Essentials

What you'll learn

Explore related topics

Course content

Introduction1 lecture • 7min

Building a virtual environment10 lectures • 1hr 32min

Analysis Tools23 lectures • 3hr 17min

Next steps1 lecture • 5min

Requirements

Description

Who this course is for: