Practical Malware Analysis
Malware analysis is big business, and attacks can cost a company dearly. When malware breaches your defenses, you need to act quickly to cure current infections and prevent future ones from occurring. For those who want to stay ahead of the latest malware, Practical Malware Analysis will teach you the tools and techniques used by professional analysts. With this book as your guide, you'll be able to safely analyze, debug, and disassemble any malicious software that comes your way. You'll learn how to: –Set up a safe virtual environment to analyze malware –Quickly extract network signatures and host-based indicators –Use key analysis tools like IDA Pro, OllyDbg, and WinDbg –Overcome malware tricks like obfuscation, anti-disassembly, anti-debugging, and anti-virtual machine techniques –Use your newfound knowledge of Windows internals for malware analysis –Develop a methodology for unpacking malware and get practical experience with five of the most popular packers –Analyze special cases of malware with shellcode, C++, and 64-bit code Hands-on labs throughout the book challenge you to practice and synthesize your skills as you dissect real malware samples, and pages of detailed dissections offer an over-the-shoulder look at how the pros do it. You'll learn how to crack open malware to see how it really works, determine what damage it has done, thoroughly clean your network, and ensure that the malware never comes back.
Stats for nerds
13recommend
19mentions
16people
2013–2024years
84% recommend16% neutral
Mentions per year
What Hacker News says
- Please don’t take this the wrong way, but googling is a very important skill to have. There’s quite a bit of information out there and I’ll basically just repeat what you can find online already. You’re additionally not very specific about your goals, which makes it hard to give specific advice.
Practical Malware Analysis is a really great book, even if you don’t intend to reverse malware. It has labs after every chapter, along with solutions. It teaches you about windows, how to approach reversing a program and what to focus on to not waste too much time.
Once you worked through that CTFs should be much more approachable.
Reverse Engineering: Secrets of Reverse Engineering and Practical Reverse Engineering are also often mentioned as good books, but I personally haven’t read them. Aside from that, the books from nostarch.com are great.
If you want to learn more about windows itself, there are the “windows internals” books.
It’s also a good idea to find a community with similar interests, learning together is often more fun. And when you ask for help try to properly state your problem and what approaches you already tried to solve it, along with their outcomes.
Good luck!
- > I'd like to be able to do very basic audits of how programs work and precisely what they're doing, and also modify their behavior in simple ways (change hardcoded servers, change program execution flow, disable or enable certain functionality). Reverse engineering with basic modifications.
The listed books should help with that! I think Practical Malware Analysis really is a good start, even for that. When looking at malware you also try to find important functionality and the book teaches you how to get there quickly.
> I'd also like to have a go at modifying firmware of embedded devices, eg a car head unit with a stupid splash screen on startup that I'd like to disable.
There are probably forums for that, where you can find some info. There's also a nostarch book on car hacking (https://nostarch.com/carhacking) and for embedded (https://nostarch.com/hardwarehacking). I haven't read either, but it might be worth to check out some reviews for it. Maybe they're good and can help you achieve your goals.
The difficulty probably depends on how new the car is. In case you need to actually find a vulnerability in the infotainment system to get proper access, something like Hacking: The Art of Exploitation (https://nostarch.com/hacking2.htm), which I heard many good things about, is probably a good read. But if it's too new it might be too time consuming (see e.g. https://www.youtube.com/watch?v=k_F4wHc4h6k)
> For example I have a camera with wifi functionality, and you can control it from a phone app. It would be cool if I could somehow control that from the command line, or create my own basic app for the PC to control it. On top of that it would be good if I could modify the firmware to make it automatically start up in that remote control mode.
I think getting at least a CLI client could be relatively easy. For that you probably don't even need to reverse a binary using IDA/Ghidra/Binary Ninja. You can try to get the .apk file of the app and decompile it using something like jadx (https://github.com/skylot/jadx/). You'll receive mostly readable Java code. It can try to deobfuscate names, if they're obfuscated. The code you're interested in is probably somewhere under "com.manufacturer...".
How easy it is to modify the firmware once again likely depends on how old or new the camera is. They could, for example, have some integrity checks that keep you from doing that. But I have absolutely zero experience here, so it might as well be really easy. I think there could be forums for this, too.
Also be warned that modifying the firmware of your car or camera can break (parts of) them if things go wrong. E.g. I accidentally (soft) bricked a device because I tried to flash it from within a VM. I don't know how big the risk in your cases is, maybe there isn't any. But it's a good idea to read lots before accidentally breaking something expensive!
Happy I could help you :)
- 'Practical Malware Analysis' was required reading for all RE candidates at my previous job.
It's very windows focused but teaches skills that are (somewhat) easily transferable.
- As someone else said. Practical Malware Analysis is great. The ghidra book by Eagle is also decent as well.
The best thing for RE learning though is to use Visual Studio to write a few programs. From the debugger view you can use the assembly, and see what your program ends up in.
You also want to think about it as the programmer. You have a MASSIVE program. You want to see where it creates files. You know that on windows, it HAS to go through CreateFile, or at least NTcreatefile function or system call. So you can watch for these, or look where they are called in Ghidra. Now you can mark all the functions in the chain using xrefs (What references this) and then get all the functions that use createfile out of the way!
And lastly, as a programmer, you know the apis. So think of what cases someone would use printf for example. There's not many. You know by the use of printf, there's some sort of logging at that location. If they use openfile. You have a good idea that all the code surrounding that call is going to be about the file being opened.
TL;DR. Start from api calls, and work backwards. Use your knowledge as a dev for what these api calls are used for. And walk that call chain and mark. Eventually every function is mapped.
- I've looked at recommendations in 25 articles and compiled a list of the most recommended books on cybersecurity sorted by how often they were mentioned.
Hacking Exposed 7 by Stuart McClure
Countdown to Zero Day by Kim Zetter
Ghost in the Wires by Kevin Mitnick
Spam Nation by Brian Krebs
Practical Malware Analysis by Michael Sikorski
Threat Modeling by Adam Shostack
Social Engineering by Christopher Hadnagy
The Hacker Playbook 3 by Peter Kim
The Practice of Network Security Monitoring by Richard Bejtlich
Dark Territory by Fred Kaplan
The Code Book by Simon Singh
Hacked Again by Scott N. Schober
The Hacker Playbook by Peter Kim
The Art of Invisibility by Kevin Mitnick
The Art of Deception by Kevin Mitnick
See the full list at https://www.readthistwice.com/lists/best-cybersecurity-books
- I have done a fair bit of reverse engineering to date including malware analysis. Havent read all the comments but of course a safe environment is important. Virtual environments can even be broken out of if you dont know how to debug simple samples that check for disassemblers or debugger presence. I recommend if you want to get some hands on experience checkout https://nostarch.com/malware (Practical Malware analysis) it will prepare you for messing with real life samples. Techniques are still relevant but technology might be different. Eg: IDA is great but Ghirda is the new hotness on the street.
Anyways have fun, good luck and be safe. Most of all happy hacking :)
Related
Threat modeling
1 recommend · 2
The Art of Invisibility
1 recommend · 2
The IDA Pro book
5 recommend · 8
The Browser Hacker's Handbook
2 recommend · 3
The web application hacker's handbook
31 recommend · 63
The Hacker Playbook 3
2 recommend · 3
A bug hunter's diary
recommend · 8
