12 pages

Reverse Engineering & Malware

Reading and building Windows binaries: the PE format, shellcode, API hashing, packing, injection, and the static + dynamic analysis workflow.

Page Kind Tags Updated

Reverse-Engineering Workflow

static + dynamic analysis

concept windows, reverse-engineering 07 Sept

Portable Executable format

concept windows, reverse-engineering 07 Sept

x86/x64 position-independent payloads

concept windows, shellcode 07 Sept

nameless API resolution

concept windows, malware 07 Sept

Process Injection

getting code to run in another process

concept windows, malware 07 Sept

Windows Direct Syscalls

Nt* functions, unhooking

concept windows, malware 07 Sept

malware checks for a debugger

concept windows, malware 07 Sept

anti-VM / anti-sandbox checks

concept windows, malware 07 Sept

Packing & Unpacking

hiding the real code

concept windows, malware 07 Sept

NSA reverse-engineering suite

reference tool, reverse-engineering 07 Sept

the Windows x64 debugger

reference tool, reverse-engineering 07 Sept

the reference open-source packer

reference tool, packer 07 Sept

12 pages in this section