5

I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst.

I know it is not enough to just know how to read assembly to become a malware analyst. But won't it help a lot and make the remaining things easier?

closed as off-topic by asheeshr Dec 25 '13 at 17:06

  • This question does not appear to be about reverse engineering within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Assembly is definitely important but the the key is your patience, not to loose your mind. Some reversing ventures may last for days. – 0xec Dec 23 '13 at 16:02
  • @ExtremeCoders, only days? ;) – Devolus Dec 23 '13 at 19:36
  • 2
    You may google for crack me and you can find sites where you can find sample programs for reversing, which is a good way to learn the basic stuff. – Devolus Dec 23 '13 at 19:40
  • This question appears to be off-topic because it is about career advice and development. – asheeshr Dec 25 '13 at 17:06
  • The answer to your question is "NO". Assembly Language is just one little tool in the toolbox. In fact, Assembly is much easier to learn than C/C++. – BraveNewCurrency Dec 30 '13 at 0:59
14

To be a malware analyst, the minimum knowledge typically needed is:

  • Assembly language
  • Operating system internals
  • Deobfuscation and anti-anti-debugging techniques

Obviously, there are other useful areas of knowledge for malware analysis (like an understanding of network protocols, exploit analysis techniques, knowledge of VB P-code and JavaScript and .NET languages, etc.), but it looks like you're making progress ;)

Most of the things you'll need to know you'll learn along the way. For example, you may come across a malware sample that exploits Adobe Flash player. This will give you the opportunity to learn about the SWF file format, ActionScript source and bytecode, etc.

  • how security research find malware?? how detect that system has infected?? – AminM Jul 13 '18 at 13:19
4

FROM SANS.ORG

When discussing malware analysis, There is 3 main phases of the process: behavioral analysis, code analysis and memory analysis.

Here's a brief outline of each phase:

  • Behavioral analysis

    examines the malware specimen's interactions with its environment: the file system, the registry (if on Windows), the network, as well as other processes and OS components. As the malware investigator notices interesting behavioral characteristics, he modifies the laboratory environment to evoke newcharacteristics. To perform this work, theinvestigatortypically infects the isolated system while having the necessary monitoring tools observe the specimen's execution. Some of the free tools that can help in this analysis phase are Process Monitor, Process Explorer, RegShot and Wireshark. Several free on-line tools can automate some aspects of behavioral analysis; there are also several free frameworks you can use to script the analysis process in a local lab.

  • Code analysis

    reverse-engineers the malicious program to understand the code that implements the specimen's behavior. When looking at compiled programs, this process involves using a disassembler, a debugger and, perhaps, a decompiler to examine the program's low-level assembly or byte-code instructions.A disassembler converts the instructions from their binary form into the human-readable assembly form. A decompiler attempts to recreate the original source code of the program. A debugger lets the analyst step through the most interesting parts of the code, interacting with it and observing the effects of its instructions to understand their purpose. OllyDbg and IDA Pro Freeware are popular free disassembler/debuggers that can handle Windows programs.

  • Memory analysis

    examines memory of the infected system to extract artifacts relevant to the malicious program. In the context of reverse-engineering malware, memory analysis can help identify malicious code that is trying to hide itself (i.e., rootkits), can clarify the program's run-time dependencies, and can explain how the specimen was used on the victim's system. Memory analysis saves time and allows theinvestigatorto take shortcuts when studying the specimen's behavior or code. Free tools for performing memory analysis are The Volatility Framework and its malware-related plugins, as well as Memoryze and the associated Audit Viewer program.

I Hope this would be an added Value to the above response

4

When I started with Malware Analyses at some anti-virus vendor. I only had reversed a couple of aspects of video games and created a number of tools to extract graphics etc. I also knew a fair bit of malware culture etc.. Read a lot of Malware source code (vxheavens) and all that jazz.

I however, didn't know about Obfuscation, unpacking, shellcode etc. This is something I learned over the course of a few years while on the job.

However, a SOLID understanding of x86 and your debugging / dis-assembler is required!

  • So should someone just start applying when they've gotten these basics down? The field definitely seems to be niche so there's not a lot of mainstream career advice out there on it. – the_endian Feb 21 '17 at 9:33
  • Times have changed most av analysts I know rely on behavoral analyses now – Stolas Feb 21 '17 at 13:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.