Título: Tutoriales de análisis de malware: un enfoque de ingeniería inversa Publicado por: r32 en 2 Septiembre 2016, 20:55 pm Hoja de ruta: Debe primero seguir los tutoriales de 1 a 4 para establecer la configuración del laboratorio. A continuación, cada tutorial se aborda un tema independiente y se puede completar por separado (cada uno tendrá sus propias instrucciones de configuración de laboratorio).
Malware Analysis Tutorial 1- A Reverse Engineering Approach (Lesson 1: VM Based Analysis Platform) Link: http://fumalwareanalysis.blogspot.com/2011/08/malware-analysis-tutorial-reverse.html Malware Analysis Tutorial 2- Introduction to Ring3 Debugging Link: http://fumalwareanalysis.blogspot.com/2011/08/malware-analysis-tutorial-reverse_31.html Malware Analysis Tutorial 3- Int 2D Anti-Debugging . Link: http://fumalwareanalysis.blogspot.com/2011/09/malware-analysis-3-int2d-anti-debugging.html Malware Analysis Tutorial 4- Int 2D Anti-Debugging (Part II) Link: http://fumalwareanalysis.blogspot.com/2011/10/malware-analysis-tutorial-4-int2dh-anti.html Malware Analysis Tutorial 5- Int 2D in Max++ (Part III) . Link: http://fumalwareanalysis.blogspot.com/2011/10/malware-analysis-tutorial-5-int2d-anti.html Malware Analysis Tutorial 6- Self-Decoding and Self-Extracting Code Segment . Link: http://fumalwareanalysis.blogspot.com/2011/12/malware-analysis-tutorial-6-analyzing.html Malware Analysis Tutorial 7: Exploring Kernel Data Structure . Link: http://fumalwareanalysis.blogspot.com.es/2011/12/malware-analysis-tutorial-7-exploring.html Malware Analysis Tutorial 8: PE Header and Export Table . Link: http://fumalwareanalysis.blogspot.com/2011/12/malware-analysis-tutorial-8-pe-header.html Malware Analysis Tutorial 9: Encoded Export Table . Link: http://fumalwareanalysis.blogspot.com/2011/12/malware-analysis-tutorial-9-encoded.html Malware Analysis Tutorial 10: Tricks for Confusing Static Analysis Tools . Link: http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-10-tricks-for.html Malware Analysis Tutorial 11: Starling Technique and Hijacking Kernel System Calls using Hardware Breakpoints . Link: http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-11-starling.html Malware Analysis Tutorial 12: Debug the Debugger - Fix Module Information and UDD File . Link: http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-12-debug.html Malware Analysis Tutorial 13: Tracing DLL Entry Point . Link: http://fumalwareanalysis.blogspot.com/2012/01/malware-tutorial-13-tracing-dll-entry.html Malware Analysis Tutorial 14: Retrieve Self-Decoding Key . Link: http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-14-retrieve.html Malware Analysis Tutorial 15: Injecting Thread into a Running Process . Link: http://fumalwareanalysis.blogspot.com/2012/02/malware-analysis-tutorial-15-injecting.html Malware Analysis Tutorial 16: Return Oriented Programming (Return to LIBC) Attack . Link: http://fumalwareanalysis.blogspot.com/2012/02/malware-analysis-tutorial-16-return.html Malware Analysis Tutorial 17: Infection of System Modules (Part I: Randomly Pick a Driver). Link: http://fumalwareanalysis.blogspot.com/2012/02/malware-analysis-tutorial-17-infecting.html Malware Analysis Tutorial 18: Infecting Driver Files (Part II: Simple Infection) . Link: http://fumalwareanalysis.blogspot.com/2012/02/malware-analysis-tutorial-18-infecting.html Malware Analysis Tutorial 19: Anatomy of Infected Driver Link: http://fumalwareanalysis.blogspot.com/2012/03/malware-analysis-tutorial-19-anatomy-of.html Malware Analysis Tutorial 20: Kernel Debugging - Intercepting Driver Loading . Link: http://fumalwareanalysis.blogspot.com/2012/03/malware-analysis-tutorial-20-kernel.html Malware Analysis Tutorial 21: Hijacking Disk Driver Link: http://fumalwareanalysis.blogspot.com/2012/03/malware-analysis-tutorial-21-hijack.html Malware Analysis Tutorial 22: IRP Handler and Infected Disk Driver Link: http://fumalwareanalysis.blogspot.com/2012/03/malware-analysis-tutorial-22-irp.html Malware Tutorial Analysis 23: Tracing Kernel Data Using Data Breakpoints Link: http://fumalwareanalysis.blogspot.com/2012/03/malware-tutorial-analysis-23-tracing.html Malware Analysis Tutorial 24: Tracing Malicious TDI Network Behaviors of Max++ Link: http://fumalwareanalysis.blogspot.com/2012/04/malware-analysis-tutorial-24-tracing.html Malware Analysis Tutorial 25: Deferred Procedure Call (DPC) and TCP Connection Link: http://fumalwareanalysis.blogspot.com/2012/04/malware-analysis-tutorial-25-deferred.html Malware Analysis Tutorial 26: Rootkit Configuration Link: http://fumalwareanalysis.blogspot.com/2012/04/malware-analysis-tutorial-26-rootkit.html Malware Analysis Tutorial 27: Stealthy Loading of Malicious Driver Link: http://fumalwareanalysis.blogspot.com/2012/05/malware-analysis-tutorial-27-stealthy.html Malware Analysis Tutorial 28: Break Max++ Rootkit Hidden Drive Protection Link: http://fumalwareanalysis.blogspot.com/2012/05/malware-analysis-tutorial-28-break-max.html Malware Analysis Tutorial 29: Stealthy Library Loading II (Using Self-Modifying APC) Link: http://fumalwareanalysis.blogspot.com/2012/06/malware-analysis-tutorial-29-stealthy.html Malware Analysis Tutorial 30: Self-Overwriting COM Loading for Remote Loading DLL Link: http://fumalwareanalysis.blogspot.com/2012/06/malware-analysis-tutorial-30-loading.html Malware Analysis Tutorial 31: Exposing Hidden Control Flow Link: http://fumalwareanalysis.blogspot.com/2012/08/malware-analysis-tutorial-31-exposing.html Malware Analysis Tutorial 32: Exploration of Botnet Client Link: http://fumalwareanalysis.blogspot.com/2012/08/malware-analysis-tutorial-32.html Malware Analysis Tutorial 33: Evaluation of Automated Malware Analysis System I (Anubis) Link: http://fumalwareanalysis.blogspot.com/2012/09/malware-analysis-tutorial-33-evaluation.html Malware Analysis Tutorial 34: Evaluation of Automated Malware Analysis Tools CWSandBox, PeID, and Other Unpacking Tools Link: http://fumalwareanalysis.blogspot.com/2012/10/malware-analysis-tutorial-34-evaluation.html Author: Dr. Xiang Fu Saludos |