An Intermediate Level Course on Reverse Engineering and Analyzing Malware
InstructorPaul Chin, PhDThe curriculum utilizes specific malware samples, including Emotet, Trickbot, and Dridex, to demonstrate unpacking procedures such as fixing section alignments and un-mapping dumped files.
Instruction integrates essential tools like Scylla, xdbg, dnSpy, and PE-Studio for memory dumping and analysis.
Editorial course preview
These 4 complementary views highlight concrete, legible examples from the course presentation.
The dnSpy decompiler interface displays static analysis of a .NET binary, revealing method signatures and implementation details for reverse engineering.
This desktop view highlights advanced reverse engineering procedures including fixing section alignments, unmapping, IAT manipulation, and re-basing within a file explorer context.
A desktop view displaying a file explorer window containing a binary file, overlaid with a red banner titled 'Unpacking vmprotect trojan - part 1: using api hooking' to introduce the malware analysis topic.
This slide illustrates how 32-bit x86 registers are subdivided into smaller 16-bit and 8-bit segments, using the EAX register as a concrete example to demonstrate data access.
One signal suggests that certain breakpoints and API behaviors observed in the course's Windows 7 environment may not behave identically on modern Windows 10 systems. Note that this review predates the displayed update date, so the update label does not prove a correction of these environmental mismatches.
The curriculum aligns with the target of intermediate learners, though environmental requirements should be carefully noted.
