In the Basic Static Analysis room, we looked at the characteristics of malware, like strings, hashes, import functions, and other key information in the header, to get an idea about the purpose of a given malware. In Advanced Static Analysis, we will move further and reverse engineer malware into the disassembled code and analyze the assembly instructions to understand the malware's core functionality in a better way.

Advanced Static Analysis

Advanced static analysis is a technique used to analyze the code and structure of malware without executing it. This can help us identify the malware's behavior and weaknesses and develop signatures for antivirus software to detect it. By analyzing the code and structure of malware, researchers can also better understand how it works and develop new techniques for defending against it.

Learning Objectives

This room is designed to help you acquire the knowledge needed to reverse engineer malware effectively. It will teach you to approach assembly instructions more systematically, enabling you to identify important functions more easily instead of getting carried away by each instruction.

Some of the topics that are covered in this room are:

• Understand how advanced static analysis is performed.
• Exploring Ghidra's disassembler functionality.
• Understanding and identifying different C constructs in assembly.
  

Prerequisites

Participants are expected to have completed the following rooms to understand better.

• x86 Architecture Overview
  
• x86 Assembly Crash Course
• Basic Static Analysis
  

Let's begin learning.