Skip to content

A collection of resources if you want to get into malware research. Pull requests are very welcome.

Notifications You must be signed in to change notification settings

0xr001/malware-analysis-resources

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

6 Commits
 
 

Repository files navigation

Collection of malware analysis resources

This collection is specifically intended for people who would like to get into malware analysis. It attempts to include material that is easy to understand, even without an in-depth pre-existing knowledge in computer science or related topics. I don't claim for it to be complete or that these are the best resources out there and if I missed your resource, please don't assume I deem it unworthy of inclusion. Instead, just let me know, and I will add it or send a pull request. :)

Which programming languages should I learn?

That depends a little bit on what kind of malware you aim to analyse. Personally, I see the following three programming languages as a good base:

  • Python: While malware written in Python is rare it has large applications in malware analysis and malware research due to a lot of tools being scriptable using Python. Besides, it offers a vast amount of libraries aimed explicitly at reverse engineering.
  • C: C may be a bit controversial from the software development point of view, but the reality is that large portions of all major operating systems these days are still based on C. Therefore, a lot of API documentation is very C-centric. You will have a way easier time reading documentation and manuals if you know C. It is also the basis of inspiration for a lot of other programming languages. So knowing C will make learning other programming languages like C++, C#, JavaScript, Java, and so on a lot easier.
  • Assembly: That's ultimately the language that the processor in your computer works with. If you genuinely want to know what precisely some code does, you will often have to go down to the lowest possible level. While assembly may look strange at first and the multitude of instruction sets consisting of literally hundreds of instructions seem intimidating, you will ultimately only come across a small portion (two to three dozens) of possible instructions that are easy to grasp and that everyone can get a handle of quickly. For the rest, it is sufficient to know how to read the documentation properly to look them up in the off-chance you ever come across it.

I know a lot of malware analysts, who don't know any of these programming languages who still do very well in their field. So don't see any of them as a hard requirement. However, learning at least the basics of each of them will prove tremendously helpful not only for malware analysis but your future career in general.

Open-sourced university courses

Video tutorials and guides

  • Malware Analysis for Hedgehogs has a lot of different videos covering various malware research topics. While not precisely guides, most of the videos are well explained and easy to follow.
  • Open Analysis Live! provides walkthroughs and guide videos for a lot of different topics related to malware research: From setting up a secure environment for you analyse malware in, over how to use some of the tools of the trade, to walkthroughs of dealing with specific malware samples.
  • Open Security Training probably provides the most comprehensive collection of video tutorials out there. The content taught in these videos is somewhat advanced, and if you have absolutely no experience with programming, you will probably struggle. However, the course material, as well as the content of the videos, is outstanding and they cover almost every single topic you may come across if you want to become a malware researcher. If you are unsure which course to start with I would recommend Introductory Intel x86: Architecture, Assembly, Applications, & Alliteration and then follow the "Malware Analysis" skill tree at the bottom.

Written online guides

  • MalwareUnicorn's Reverse Engineering 101 is a great starter that covers the basics and aims to get you started quickly. The tutorials are easy to follow and cover most bases. I highly recommend going through it even if you don't like written guides, as it teaches you a lot of fundamentals in a very concise manner. Let's hope she releases Reverse Engineering 102 soon. :)
  • Reverse Engineering for Beginners is so exhaustive, that I considered putting it into the book section. But since it is available as a PDF only, I guess it fits in better here. The one small drawback is that Dennis asks for your email address to download the PDF. But if you don't mind sharing your email address in return for one of the best and most comprehensive tutorials for reverse engineering out there, it's an excellent pick. Plus, you can always get a throwaway address.

Books

  • Practical Malware Analysis is a very hands-on guide on how to dissect malware and figure out what exactly it is doing. It's one of those books that a lot of malware analysts and researcher would consider "a classic" and recommend without reservations. Rightfully so I may add. :)
  • Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code is the other standard recommendation people give. Like Practical Malware Analysis, it is full of exercises and practical examples and well worth the money.
  • Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation is a more advanced book that requires a lot of studies. If you are new to this, I wouldn't wholeheartedly recommend it. But if you read one of the other books before or used some of the other material mentioned on this site and you want to go even deeper into the various concepts, it's an outstanding pick.
  • The Art of Computer Virus Research and Defense is one of the very few books that looks specifically into how anti-viruses work. While it is a bit older and slightly outdated, the techniques explained in that book are still in use today. So if you are specifically interested in becoming an anti-virus software engineer, it's a great start.

About

A collection of resources if you want to get into malware research. Pull requests are very welcome.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published