You're reading from Mastering Malware Analysis A malware analyst's practical guide to combating malicious software, APT, cybercrime, and IoT attacks

Product type Paperback

Published in Sep 2022

Publisher Packt

ISBN-13 9781803240244

Length 572 pages

Edition 2nd Edition

Concepts

Malware Analysis

Authors (2):

Amr Thabet

Alexey Kleymenov

View More author details

Table of Contents (20) Chapters

Preface

1. Part 1 Fundamental Theory

2. Chapter 1: Cybercrime, APT Attacks, and Research Strategies FREE CHAPTER

3. Chapter 2: A Crash Course in Assembly and Programming Basics

4. Part 2 Diving Deep into Windows Malware

5. Chapter 3: Basic Static and Dynamic Analysis for x86/x64

6. Chapter 4: Unpacking, Decryption, and Deobfuscation

7. Chapter 5: Inspecting Process Injection and API Hooking

8. Chapter 6: Bypassing Anti-Reverse Engineering Techniques

9. Chapter 7: Understanding Kernel-Mode Rootkits

10. Part 3 Examining Cross-Platform and Bytecode-Based Malware

11. Chapter 8: Handling Exploits and Shellcode

12. Chapter 9: Reversing Bytecode Languages – .NET, Java, and More

13. Chapter 10: Scripts and Macros – Reversing, Deobfuscation, and Debugging

14. Part 4 Looking into IoT and Other Platforms

15. Chapter 11: Dissecting Linux and IoT Malware

16. Chapter 12: Introduction to macOS and iOS Threats

17. Chapter 13: Analyzing Android Malware Samples

18. Index

Why subscribe?

19. Other Books You May Enjoy

Packt is searching for authors like you

.NET malware analysis

As you may know, .NET applications are easy to disassemble and decompile so that they become as close to the original source code as possible. This leaves malware more exposed to reverse engineering. We will describe multiple obfuscation techniques in this section, together with the deobfuscation process. First, let’s explore the available tools for .NET reverse engineering.

.NET analysis tools

Here are the most well-known tools for decompiling and analysis:

ILSpy: This is a good decompiler for static analysis, but it can’t debug malware.
dnSpy: Based on ILSpy and dnlib, it’s a disassembler and decompiler that also allows you to debug and patch code.
.NET reflector: A commercial decompiler tool for static analysis and debugging in Visual Studio.
.NET IL Editor (DILE): Another powerful tool that allows you to disassemble and debug .NET applications.
dotPeek: A tool that’s used to decompile malware into C...

The rest of the chapter is locked

You're reading from Mastering Malware Analysis A malware analyst's practical guide to combating malicious software, APT, cybercrime, and IoT attacks

Table of Contents (20) Chapters

.NET malware analysis

.NET analysis tools

Unlock this book and the full library FREE for 7 days

Authors (2)

Personalised recommendations for you