Dynamic Analysis: Debugging

In the Basic Dynamic Analysis room, we learned to identify malware traces in the infected system during execution. However, malware authors understand that the malware will be analyzed and want to thwart it. This can be done through various evasion techniques. To defeat these evasion techniques, a malware analyst desires more control over malware execution. In this room, we will learn how a malware analyst can control malware execution better to achieve the desired results.

Learning Objectives:

In this room, we will learn:

• The evasion techniques used to evade basic dynamic analysis.
• Introduction to debuggers and how they can help us control the execution flow of malware.
• Manipulating execution flow at runtime by changing registers or other parameters.
• Patching malware to force it to move past the evasion techniques and onto the actual malicious content.

Pre-requisites:

To get the best learning outcome from this room, it is recommended that you complete the following rooms:

• Basic Static Analysis
• Basic Dynamic Analysis
• Advanced Static Analysis