Menu > Articles de la revue de presse : - l'ensemble [tous | francophone] - par mots clé [tous] - par site [tous] - le tagwall [voir] - Top bi-hebdo de la revue de presse [Voir]

---

S'abonner au fil RSS global de la revue de presse

---

Présentation : Recently I was asked to review a pre-publication copy of Mike Sikorski and Andrew Honig s book Practical Malware Analysis by Nostarch Press. I gave it an enthusiastic review, and I strongly believe this will become the defacto text for learning malware analysis in the future. This is a review of that book, and a short rant on reverse engineering. Before getting into Practical Malware Analysis, I hope you will indulge me in a rant about other books on the reverse engineering topic They are not pretty. If you ve taken one of my classes I recommend a few books for learning reversing, but climbing the steep mountain of pre-requisite material before you can attempt to be somewhat proficient is daunting. Specifically the books I recommended were based off of each individual author s own personal style of reverse engineering with the tools that were available at the time. The field has gotten much more accessible thanks to the awesome tools that are out there from companies like Hex-Rays and Zynamics. Practical Malware Analysis does a good job of tying together the methods of modern malware analysis. While most of the previous texts have done a good job of presenting the state of the art at their time, PMA overviews many of the tools that are in use in the modern day. Part 1 starts off with the basic static techniques, how to set up a virtual environment, and dynamic analysis. These initial steps are the basis for any good reversing environment. What is nice is that these topics aren t dwelled on for an entire book. Part 2 goes over the relationships of the Intel architecture, IDA Pro, modern compilers, and the Windows operating system to reverse engineering. Having an understanding of this as it applies to the reversing process is extremely important. Outside implementing a compiler, learning the fundamentals of the architecture is the most important skill a reverser can have for understanding the field. The difference between an adequate reverser and a great reverser lies in the understanding of how the system interactions work. The rest of the book is focused on the advanced topics of dynamic analysis. Part 5 deals with all the ways that malware authors can make your life miserable, from anti-disassembly to packers. Part 6, Special Topics, talks about shellcode analysis, C specifics, and the ever-looming threat of 64-bit malware. I suspect that there will be a second edition once 64-bit malware comes in vogue. Overall the book is excellent for those that are new to this field. Experts love to curmudgeonly talk about how nothing is new anymore, everything sucks, and pine for the good old days of reverse engineering with some wire-wrap, a lead pencil, a 9-volt Duracell, and a single LED. If you consider yourself one of these people, reading this book is going to feel a lot like wearing someone else s underwear. If, on the other hand, you read it and put aside your natural skepticism of all things new, you might learn something. I really do like this book. read more

Les mots clés de la revue de presse pour cet article : malware reverse engineering
Les videos sur SecuObs pour les mots clés : malware reverse engineering
Les mots clés pour les articles publiés sur SecuObs : malware reverse engineering
Les éléments de la revue Twitter pour les mots clé : malware reverse engineering





Les derniers articles du site "Offensive Computing Community Malicious code research and analysis" :

- State of Offensive Computing
- VizSec 2012 Call for Papers Out
- Scalable, Automated Baremetal Malware Analysis
- BHO Reversing
- Practical Malware Analysis - A Book Review and Curmudgeonly Rant on the State of Reverse Engineering
- CAST Slides Hunting malware with Volatility v2.0
- The WOW-Effect Imho something the IT-Security community should be aware of ...
- Introduction to IDA Python
- CSI Internet series - Spyeye detection with Volatility v2 and kernel debugging the TDL4 rootkit
- Three Million Samples

---

S'abonner au fil RSS global de la revue de presse

---