An Intermediate Level Course on Reverse Engineering and Analyzing Malware
InstructorPaul Chin, PhD
Editorial course preview
These 4 complementary views highlight concrete, legible examples from the course presentation.
The dnSpy decompiler interface displays static analysis of a .NET binary, revealing method signatures and implementation details for reverse engineering.
This desktop view highlights advanced reverse engineering procedures including fixing section alignments, unmapping, IAT manipulation, and re-basing within a file explorer context.
A desktop view displaying a file explorer window containing a binary file, overlaid with a red banner titled 'Unpacking vmprotect trojan - part 1: using api hooking' to introduce the malware analysis topic.
This slide illustrates how 32-bit x86 registers are subdivided into smaller 16-bit and 8-bit segments, using the EAX register as a concrete example to demonstrate data access.
The curriculum utilizes specific malware samples, including Emotet, Trickbot, and Dridex, to demonstrate unpacking procedures such as fixing section alignments and un-mapping dumped files.
Instruction integrates essential tools like Scylla, xdbg, dnSpy, and PE-Studio for memory dumping and analysis.
One signal suggests that certain breakpoints and API behaviors observed in the course's Windows 7 environment may not behave identically on modern Windows 10 systems. Note that this review predates the displayed update date, so the update label does not prove a correction of these environmental mismatches.
The curriculum aligns with the target of intermediate learners, though environmental requirements should be carefully noted.