Cybersecurity Books: Reverse engineering and malware
The hardest part to enter: assembly, operating system internals, and the analysis of malicious code.
Cybersecurity Books: Reverse engineering and malware
Part three of nine. The hardest one to enter: it takes assembly, an understanding of how an operating system works, and patience.
Reading order matters here. Start with malware analysis rather than with binary analysis in general.
Michael Sikorski, Andrew Honig. Practical Malware Analysis (2012)
The de facto standard. More than half the volume is lab work with the samples that ship alongside it.
Topics: static and dynamic analysis, a safe sandbox, working with a debugger, unpacking and obfuscation, anti-debugging techniques, malware behaviour on the network, writing up the analysis.
Bruce Dang, Alexandre Gazet, Elias Bachaalany. Practical Reverse Engineering (2014)
On architectures and system internals: x86, x64, ARM, the Windows kernel, virtualisation mechanisms.
Topics: reading disassembled code, calling conventions, drivers and kernel mode, rootkits, obfuscation and deobfuscation.
Dennis Andriesse. Practical Binary Analysis (2018)
On tooling and automation: how to build your own binary analysis tools on Linux.
Topics: the ELF and PE formats, disassembly and its fundamental limits, control flow and data flow analysis, symbolic execution, instrumentation, taint analysis.
Chris Eagle, Kara Nance. The Ghidra Book (2020)
A guide to the NSA's open source disassembler. The current alternative to the paid IDA Pro.
Topics: the interface and the workflow, the decompiler, data types and structures, scripting in Java and Python, collaborative work, extending the functionality.
Chris Eagle. The IDA Pro Book (2nd edition, 2011)
The classic on the industry's main commercial tool. The edition is old; the fundamentals have not changed.
Topics: navigating disassembled code, recovering structures and types, IDC and IDAPython scripts, the debugger, working with obfuscated code.
Alex Matrosov, Eugene Rodionov, Sergey Bratus. Rootkits and Bootkits (2019)
On the threats that live below the operating system. The authors dissect real malware families and the evolution of defences.
Topics: the boot process and its compromise, bootkits, MBR and UEFI, Secure Boot and how it is bypassed, forensics at the firmware level, virtualisation as an analysis tool.
Michael Hale Ligh, Andrew Case, Jamie Levy, Aaron Walters. The Art of Memory Forensics (2014)
The bridge between reversing and forensics: what can be pulled out of a memory dump.
Topics: acquiring a memory dump, kernel structures in Windows, Linux, and macOS, finding hidden processes, extracting malicious code from memory, Volatility.
Next part: cryptography.
The whole series: