Practical Malware Analysis Ida Pro Tutorial Chapter 5 Lab 5
Practical Malware Analysis is a book written by Michael Sikorski and Andrew Honig and published in 2012. It teaches the tools and techniques used by professional analysts, as well as the methods to safely analyze, debug, and disassemble any malicious software. It comes with a set of labs to exercise the concepts learned in the book.
Time stamps:
0:00 Introduction
0:17 Q1-6
4:55 Q7-9
12:15 Q10-11
20:57 Q12-14
25:39 Q15-17
30:00 Q18-21
Support us on Patreon: http://bit.ly/38mnveC
Discussion: https://bit.ly/3keXXGK
IDA Pro, shorthand for Interactive DisAssembler, is an interactive, programmable, extensible, multi-processor disassembler and debugger developed by Hex-Rays for Windows, Linux, or Mac. It is considered one of the most important tools when it comes to malware analysis, or reverse engineering in general. It features a plug-in system in addition to a scripting engine, which allows external developers to extend its capabilities even more.
In this video, you will be shown the solutions to chapter 5 lab 5 from Practical Malware Analysis. It serves as an IDA pro tutorial and goes through many of the features provided by IDA that will make analyzing and reverse engineering executables easier. In the beginning, IDA locates and analyzes the functions inside the executable and tries to come up with the arguments and local variables of each one. Once the analysis is done, you can view imports, exports, strings, cross references and graph views from or to a certain function. During the lab, gethostbyname is taken as an example which you should locate in the imports window and view its cross references to determine the number of functions that calls it. Moreover, you will use the graph view to get a general idea about some function’s work and determine which APIs it calls. You will also use the “set symbolic constant” capability, which will make the variables/parameters more meaningful.
After watching this video, you will have the knowledge to use IDA pro to navigate through the executable assembly as well viewing the imports, exports and strings which will facilitate analyzing executables and make reverse engineering a lot easier.
Donate on our Forum : http://bit.ly/2HkOco9
Follow us on Facebook : http://bit.ly/2vvHfhk
Follow us on Twitter : http://bit.ly/3bC7J1i
Follow us on Twitch : http://bit.ly/39ywOZ2
Follow us on Reddit : http://bit.ly/3bvOB57
Follow us on GitHub : http://bit.ly/2HoNXIS
Follow us on Instagram : http://bit.ly/2SoDOlu