Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Assuming a machine has malware, regardless of how it got there, one thing I would like to learn to do is to take the binary file and reverse engineer it to see what the malware is doing/has already done.

It would be good to know what has been compromised, as well as look for routes to successfully remove it.

I have found tools such as IDAPro and OllyDbg, which are proving to be useful, however, I won't lie and pretend I understand what to look for, or what the data shown in each means.

What are some good resources for learning and truly comprehending the data shown in these debuggers, as well as some resources for general reverse-engineering of malware?

I am not just looking for removal tools, I'm trying to dig into the malware and see what it does.

Thanks!

share|improve this question
5  
This video shows you a bit more about IDApro and how to use it: securitytube.net/… –  Chris Andrè Dale Jan 21 '11 at 14:54
    
Assembly and OS details like for windows Ntdll, winlogon etc should be first on your priority. –  Novice User Jan 15 '13 at 19:05

4 Answers 4

up vote 12 down vote accepted

Malware is a tricky one stuff - Malware RE is not only about disassembling or debugging - it is also about behavior, changes monitoring, etc.

I suppose you will be interested in some blogs that describes malware analysis, then you could look for them here: https://code.google.com/p/it-sec-catalog/wiki/Malware. Don't know if it is worth to mention resources about RE - there are really a lot of materials all over the internet.

Also you should consider buying following book: http://www.amazon.com/Malware-Analysts-Cookbook-DVD-Techniques/dp/0470613033/ref=wl_mb_recs_5_dp

share|improve this answer
1  
That book looks awesome! Thanks! –  Purge Jan 21 '11 at 15:33
    
+1 for the book as well just added it to my amazon wishlist. –  Mark Davidson Jan 21 '11 at 15:40

Introduction to Reverse Engineering Software - covers reverse engineering on both Linux and Windows. Haven't read it all the way through yet but seems to have some good coverage.

Malware Analysis and Antivirus Technologies is a course being at Aalto University in Helsinki. They have the Chief Research Officer from f-secure giving some lectures. The first lecture was on Wednesday and they should be publishing the course material online shortly. Hopefully it will prove to provide some good resources.

share|improve this answer

this Blog Post will get you started in the malware analysis field Malware Analysis by Sans

share|improve this answer

Depending on what level you want to go to, the course Lenny Zeltser is doing at SANS is supposed to be very good.

Wes Brown gives a good talk here.

Paul Melson blogs about this kind of thing, and has a presentation up here.

But check the laws in your area - some types of reverse engineering are illegal in some jurisdictions, even if it is just for your own learning, so be careful!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.