-1+1987 
Analyzing deep system stealth malware

This is a meta-class utilizing existing classes that will lead you step by step toward a deep technical understanding of how stealth malware works, with a particular focus on kernel level malware. A series of free video recordings of paid multi-day training classes will cover: how intel assembly works, OS internals that can be manipulated by malware, how the Windows PE binary format works, and finally the techniques used by stealth malware to hide and persist on an infected machine. But the class will teach you how you can still detect them if you have the right knowledge and the right tools. To complete all the material in this class will take approximately 50 hours, not including time spent on labs.

Lectures
    no lectures added
Prerequisites

The student must have a basic understanding of the C programming language, because the Introduction to Intel x86 class shows how snippets of C code correspond to x86 assembly instructions.

Syllabus

Students should watch videos and complete labs for classes in the following order (more details about each class can be found on the respective page):

Introductory Intel x86: Architecture, Assembly, Applications, & Alliteration

http://opensecuritytraining.info/IntroX86.html

(Necessary to know how inline hooking works.)

Intermediate Intel x86: Architecture, Assembly, Applications, & Alliteration

http://opensecuritytraining.info/IntermediateX86.html

(Necessary to know how the Interrupt Descriptor Table (IDT) hooking works, and how paging works for ShadowWalker style memory hiding.)

The Life of Binaries

http://opensecuritytraining.info/LifeOfBinaries.html

(Necessary to know how Import Address Table (IAT)/Export Address Table(EAT) hooking works.)

Rootkits: What they are, and how to find them

http://opensecuritytraining.info/Rootkits.html

(Describes techniques based on previous class knowledge, and new techniques not covered in other classes.)

Additional information

Some of the sub-classes, like Intro x86, are reused as prerequisites for other knowledge paths such as future reverse engineering or trusted computing class paths which will be advertised here. So taking the classes now will save you time later in pursuing other specialty areas.

Individual class forum subreddits have been set up, so that students taking the classes for different knowledge paths can see the questions other students have asked.

Please post individual class questions here:

http://www.reddit.com/r/OST_IntroX86

http://www.reddit.com/r/OST_IntermediateX86

http://www.reddit.com/r/OST_LifeOfBinaries

http://www.reddit.com/r/OST_Rootkits

Teacher qualifications

Xeno Kovah has a Masters in Information Security from Carnegie Mellon University, is a Lead Security Engineer at The MITRE Corporation (which runs CVE), and has spent the last 5 years focusing on security areas related to malware.

Latest Update

none

Roster
1. closetRedditor
2. brossman
3. LarsTM
4. DeathByMonkees
5. Nukiej
6. kalindidur
7. JAe
8. 7roachrush
9. thatsawchewbacca
10. armones
11. heavenlydevil
12. _Nank_
13. Zenith
14. kylep91
15. phyler
16. alienzrcoming
17. JerMenKoO
18. softero
19. ThomasM
20. NinjaOxygen
21. sudoatx
22. mononofu
23. kewlosaurusrex
24. briannnh
25. fambeu
26. Malevolence
27. Ayaq
28. g3tr00t
29. eetborp
30. Fishbot
31. Psionn
32. e2e8
33. rekav0k
34. choleropteryx
35. EmerilLIVE
36. rherzbe
37. youssef
38. Butterloaf
39. vaendryl
40. lawlmuffin
41. katskilla
42. jameson71
43. bobby177
44. balgan
45. MrJay
46. Zekah
47. FeebleOldMan
48. dudeimawizard
49. littleidiot
50. aeonian
51. Antibody
52. 8fatal3
53. spectre1037
54. Liru
55. Snuupy
56. greenrice
57. endfinity
58. shewlayce
59. GimmeASandwich
60. av__
61. Orion
62. stupot
63. tsallanmaa
64. wyrm
65. rogerwilco
66. Tisch
67. TunnyTuna
68. Wofiel
69. heylukeitsme
70. adroc
71. nouboh
72. spicypancakes
73. stormcargo
74. kaji823
75. makash
76. Voido
77. vollkommenes
78. sparksalot
79. LulzyKitten
80. Swineherd
81. Teague
82. JDragon
83. heapface
84. Hbou
85. hasan
86. HenryE
87. Driver1676
88. ciferkey
89. Desley
90. evilnop
91. gauravphoenix
92. gruxo
93. infamouslegato
94. Elendil51
95. vitorlol
96. Aaron_Durant
97. romistrub
98. nickpbrehh
99. jpcaissy
100. isaacktl
101. 3P0CH
102. nullrouted
103. bogartusmaximus
104. pcollard
105. GottaLearnThemAll
106. Ducky2009
107. c2xi3
108. jpcrocker
109. TheMagicPancake
110. emhtiwedir
111. soonersfan
112. darkmatter416
113. silkwire
114. thirteenthirtyseven
115. kovani
116. mroseto
117. AITIronbird
118. day6reak_
119. magneticstain
120. rokei
121. darks0u1
122. khafra
123. codeaholic
124. Childplay
125. Leaf
126. dinossimpson
127. N0tAUsername
128. phuzzzed
129. oneblueham
130. amguevara
131. Anayalator505
132. DSifan
133. i_p_crimson
134. grinning
135. carcor
136. oxgon
137. geekboyuk
138. mchnikola1
139. momentje
140. syphradic
141. ionthecat
142. ittoku
143. Dairith
144. surfingNerd
145. blackcat312
146. khs
147. yash3ahuja
148. shavo
149. AnoNimTeck
150. trunkm0nkey
151. SolarAquarion
152. nameandnumber
153. binahsaurus
154. arethnaar
155. teetotadpole
156. pg1770
157. baloghr
158. TheDoucheyKnight
159. jhoward1368
160. AtlasAnimated
161. uav22
162. LordFisch
163. Kambus
164. Indigo
165. retric
166. marter
167. theonlyrealcolin
168. emulator3
169. dmanww
170. johnnyc27
171. bishop256
172. zvarnell
173. lazyadmin
174. devilry
175. nuega
176. aspud
177. qriocity
178. mrtupins
179. Suraj-Sun
180. thinkerinside
181. superochiba
182. abdul01987
183. Knior
184. hatter6822
185. amivit
186. augbog
187. Swayyde
188. Dr_Rockstein
189. viper1092
190. myknowledge
191. minhtrietphamtran
192. Rizner
193. andrewd
194. sharbor
195. taris300
196. packetn00b
197. an0mn0mn0m
198. xdawg1983
199. manc3r
200. rregassa
201. ElReyNate90
202. oasis
203. Sine_Ira_Et_Studio
204. Zorg
205. mahmood
206. Blink_182
207. teraquendya
208. wydell
209. pantofeller
210. geneg981
211. SeizeTheTime
212. corg
213. jadedstony
214. brendoberry
215. Veyf
216. Zook
217. TheVoluntarist
218. m1218
219. danskete
220. GlobalProsperity
221. mraro
222. cabo_ose
223. y3ahright
224. bweidner77
225. in50mni4
226. pvejunky12
227. rest
228. Djkatscan
229. quodscath
230. poobean
231. pathway27
232. owlsaur
233. youngcd
234. baby.k008
235. ZombiEquinox
236. UVgamma
237. willwilliams111
238. munchieJ
239. insi2304
240. Lordtux
241. Mystique
242. redditorinchief
243. finprog
244. whomperjawed
245. faint26
246. dnafrequency
247. thethundergod
248. confusedcrib
249. thoythoy
250. Jmcjack
251. bartlln
252. cartamo
253. soldierno77
254. lilith
255. distortednet
256. pokemog
257. mikeypuff
258. scottnull
259. irenicus09
260. ppoxie
261. hay112
262. Tenku
263. tommyaung
264. mpd21487
265. keen_bean
266. shiznos
267. hitnrun7
268. 9088
269. SandBoxKing
270. Infectious
271. culturally_lost
272. boneslinger1
273. JosephKahn
274. Lim3s
275. lethal_antidote
276. stephen_burris_0616
277. dbpiv
278. eldrek
279. Tanginess
280. TheRuler123
281. psaffire
282. Indiemoon
283. spiffymcyiffy
284. Nightghos
285. pcza
286. DiscoGypsyFish
287. leftvertical
288. virvdova
289. moreyouknow
290. calimete
291. edwardteach
292. jonschort
293. PhaethonGlare
294. looknohands
295. ragingFlapjacks
296. genki_j
297. GlomB
298. patriotpidgeon
299. glitchmeister
300. gcganley
301. mrtwiddletoes
302. SubtlySincere
303. Cyphre
304. h3X
305. shammish
306. darushe
307. szope
308. cheeselayers
309. Khyrandor
310. tmpntls1
311. roycaboy
312. samonstake
313. cmgrowl
314. bobinbc
315. palion
316. TheMaxul
317. omasque
318. ikeamoah
319. proteanbeing
320. trellos007
321. silverhawk1234
322. drummerboy76
323. HecticBroccoli
324. wldrnryn
325. KingToadz
326. Aeze
327. _flapjacks
328. isingthr4iam
329. LucRSV
330. pcsdoneright
331. punkt2
332. Zoccihedron
333. evlehn
334. Apoptyzm
335. amt
336. Jondeaux
337. AdequatelyRight
338. Shock223
339. prk
340. Snyper
341. Crim
342. LightBringer777
343. minotaurus
344. cdiddy2
345. brickjenks100
346. jacoballen22
347. hoggar
348. jbolivar07
349. program2the2nd
350. Superfluous
351. Nuclear-Cheese
352. mmadil14
353. anonymoosetitties
354. jipson
355. Menippus
356. im_piss
357. pupid
358. sugavaneshb
359. johnthefreeman1
360. zbadgett
361. kolinder
362. refineries
363. AtHeartEngineer
364. nerdape
365. Averagebrown
366. Arthemedus
367. muthy
368. jcrubino
369. buku
370. Maromi
371. weylandchiang
372. LeviHill
373. jasonwhite23
374. xSpartanCx
375. X-N2O
376. victor.rojas0722
377. NoRK
378. orange_sporange
379. x2601
380. redditgodzilla
381. username
382. vjfalk
383. kn0ch3n
384. lazynoodles
385. sean
386. jgerwa
387. craaze
388. hankypanky44
389. Sethionic
390. Nicklesandimes
391. lulzury
392. angelicstrike
393. lynx
394. lovett
395. Kanyebek
396. ketsa
397. trdant
398. Bry6n
399. sendug
400. pwn777
401. rokthewok
402. BpJohnny
403. herpolody
404. jwhst10
405. SkillKillPhil
406. ckshin
407. pickleyperkleton
408. tlim
409. ifnotmethenwho
410. ninjuninju
411. nixx
412. danhje
413. bunjermen
414. bkbenftw
415. kalloc
416. qzpmwxin
417. Cephalic
418. aw1231
419. dmogro
420. tolaug
421. cho_O
422. rpackard1987
423. psil0Sin
424. LuminiferousEther
425. JustHereForTheTips
426. yazzz
427. peeonyou
428. revena
429. Xirdie
430. Mercfh
431. tais9
432. ash244
433. hams-andwich
434. HHHNNNNNGGGGGGG
435. blutweinen
436. ASexualPanda
437. Sarge0341
438. Adv23
439. Islambekm
440. acfarias
441. optimusx
442. _GregWilson
443. elizabeth7888
444. wavemancer
445. somehokie
446. gaolathe
447. swapex
448. Noox
449. STFUandLove
450. Shalemanse
451. sonigajanand
452. tnachen
453. jarabek
454. donde_esta_waldo
455. stefano213
456. sirax
457. gargolito
458. srslySHENANIGANS
459. xslamhoundx
460. wolfram8
461. keifak
462. jcsoybomb
463. dr0k
464. batsh1t
465. u4iak
466. ChrisBarrett
467. Halfnhav4
468. musfiqniaz
469. mattyuiop
470. somedrunken
471. paulpc32
472. mimo8080
473. jsstarn1
474. Arrow
475. Xineoph
476. RolandStone
477. afortknight
478. AgentGraves
479. turk15h
480. Noblerazgriz
481. pequod
482. JAMESKOOL
483. freiheitkampfer
484. elhall
485. dibyo
486. oscr
487. alamakota
488. deanstag
489. vfxGer
490. richsin
491. sreeramaraju
492. azram19
493. ebfe
494. Bockwurst
495. kettlelakes
496. rotokayu
497. denver_coder
498. b0mbur
499. gdfsfgdsfgdfg
500. focusgeek
501. Beastcraft
502. netmax2k
503. 0x09
504. patrick.cieplak
505. oodabaga
506. mpfefferle
507. ecanals
508. lakeeffect
509. Larukanpai
510. binhdna
511. wilkinsense
512. abigail
513. TimCapello
514. Seth968
515. blucrunch
516. AdrianusBystrm
517. genericzombie
518. sect
519. djcoax
520. smurfx80
521. ncms1990
522. dweebo
523. joronu
524. silentbob417
525. cfarlin83
526. imabrokendownload
527. neilbo
528. Panno123
529. Pollie
530. 6ru83r
531. budmademewiser
532. moriartyisourking
533. denpaDawn
534. Spellchaser
535. Clockwork_Logic_Bomb
536. simonasorlescu
537. dc17540
538. viceroyjenkins
539. p3pt
540. iron__mind
541. koalalove
542. sqwerl
543. Forrest
544. astronate
545. linuxuser437442
546. Tommibee123
547. mangloid
548. rockies_road
549. randomg
550. GfFoundOtherAccount
551. dwhite73
552. furioustyles
553. martensms
554. g1no23
555. Heerokazen
556. pbr333
557. tech1337
558. Elastic_Penguin
559. chelrae33
560. Clemenreau
561. besz
562. EasyYoke
563. LurksReddit
564. tleisher
565. rulerofera
566. breedx
567. lexluthor
568. mrmoo
569. redbass2
570. rkrishnasanka
571. swapout
572. jca27
573. benwaffle
574. medrolke
575. Legend
576. tinythai
577. Tonon
578. ecoplan
579. hydroperoxyl
580. Shauta
581. Darkskilling
582. tordj
583. names_irrelevant
584. PineMaple
585. suggas
586. Theman00011
587. jennie
588. Jamhammer
589. Hamza20697
590. FatKevin
591. da13omb
592. dopesoap
593. imeatingseeds
594. JAWE
595. ArsonistNightfire
596. Frenzybear
597. mttwtts
598. jmiller
599. envyotcoast
600. Mop6229
601. sirmaxwell90
602. w8cycle
603. buzzeru
604. jeffrflagg
605. MrA1Sauce
606. adamnemecek
607. vivanac
608. ArdRay
609. faptothis
610. saarinx
611. shoshy
612. hnqoliveira
613. nightlion3
614. aboudib
615. Ars-Nocendi
616. salomao
617. cornelius2012
618. neevor
619. iudocus
620. Trapick
621. professorpainx
622. mrhicks
623. MyrtileJudge
624. CosmicSignularity
625. SpreadbleFruit
626. LisaMCooper
627. Kurtismonger
628. atlbravo
629. jason.leon
630. ator22
631. sonikarc
632. talldude4912
633. Pingopango
634. lioncoop
635. ingloriouswallflower
636. subclavia
637. vardhan
638. imconfus
639. hnd
640. mirorakonto
641. ehmohteeoh
642. awesomeness1498
643. tokomonster
644. bjh
645. winkdtm
646. generaldespair
647. Yanni123
648. thekobra1337
649. nakkefame
650. Snake3190
651. whatchuwant1
652. peckhamspring
653. taeyeonbooty
654. TheFlyingCox
655. rlowe
656. ati_ozgur
657. josephb16
658. profryan
659. shemmenway
660. haveatya
661. Stryk3rr
662. ashreipinkus
663. sumnuyungi
664. flano1
665. Batchmuffin
666. kurashima
667. hmoodallahma
668. danskal
669. dreamripper
670. Marionfrey
671. aamirazeem
672. pseaguy
673. adamc
674. Omnicyde
675. romieerome
676. HenryEshbaugh
677. hobn
678. SunSatION
679. jameslovescoloring
680. Rinali
681. shwets
682. makake
683. Halvarian
684. roo11
685. ghostjangles
686. areianea
687. lexiwho
688. Vodka_sec
689. likes_things
690. vannek
691. alwaysfocusing
692. SebastianGaius
693. nushublushu
694. heroyi
695. strandedcat
696. Raad777
697. pvtfawkes
698. jimtow28
699. flyingraccoon
700. danielcatz
701. ajmorey13
702. packersfan25
703. richardcranium69
704. jaredkz
705. pseudoShell
706. ITZCHEESE
707. PhosphorusGL
708. rockstardavid
709. draculatreeforest
710. EXICON
711. schnarfnark
712. lillith
713. frenchie
714. TechJLS3
715. Col13geBoy
716. methane95
717. small_moves
718. Dr_Farenheit
719. Patchureddit
720. Patchreddit
721. Rdslnc
722. retardate
723. chienlou
724. demet8
725. DrollestMoloch
726. alexendoo
727. CodeRunner
728. zzMcgee
729. ncastell77
730. hyste
731. ezrakh
732. zazziethebeast
733. ryustreetfighter
734. mvsm
735. dre2001
736. how_am_i
737. Mr_Perfekt
738. BeauG7
739. dzeko
740. fidelcastro21
741. bert5683
742. osculator
743. enginerrd
744. whelixw
745. Arpitha_Madugundu
746. HolmesSherlockHolmes
747. BlueGuy90
748. mrfuzz
749. adigallo
750. shahsali
751. jmw327
752. Cgorke
753. zeppcg
754. wilnasmith
755. cyimakemoney
756. whereismylife
757. communist_maltipoo
758. Deathnerd
759. ninja007
760. thepluralevan
761. Peps0791
762. lumpy_pumpkin
763. VirtualVirgo
764. hituptony
765. imranshaik12
766. Born2Learn
767. Born2Learn
768. chilukrn
769. corycruse
770. uritz
771. imheretolearn
772. rigamaroo138
773. Thatgguy
774. glassofwater
775. DampedWharf
776. chrisempire
777. highhopes223
778. einarsw
779. jcgoncalves
780. redking79
781. frozentrually
782. Tony116
783. dracoexplosion
784. ctc26
785. screamingstar
786. theshiest
787. pattzalrex
788. Ratking
789. forvino
790. SockRabbit
791. set92
792. JustinHit
793. CoffeeFlux
794. frekdisco
795. mobyxe
796. Omix32
797. NaefAlduhaim
798. DigitalKlepto
799. trumpet6
800. smmitchell2
801. IVantToLearn
802. liebstraum
803. raageo
804. xaliap81
805. SockWitch
806. tmlambert13
807. LCne
808. audunthecyborg
809. JacktheFlying
810. o99o99
811. CrikeyChriss
812. halycononandon
813. learnitall
814. germk4
815. goaneese
816. fluorescentbulb
817. Calinate
818. syedz89
819. Cinergy_
820. beezy
821. jahbagio
822. amathian
823. suicidalfitnessfreak
824. Regicide89
825. darthbottle
826. quantumite
827. shryke1
828. Polysaccharide
829. lx003n
830. Naiyon
831. baggies
832. feebarscevicius
833. admiralgeneral
834. ameyraje
835. olds0ul
836. gurjot89
837. ben.clayton11
838. ecNate
839. cajones86
840. Julian
841. Sarkasmot
842. unmeg
843. crazygamedude
844. Alex78
845. timrabb211
846. muhdnaaim
847. rtnrhl
848. HieGuiz
849. MrQQish
850. ficar
851. agentsvr
852. bitboard
853. Dragonduck
854. Aumnescience
855. Tate413
856. s3ans3ns3i
857. Owan101
858. MarkPena373
859. jerrylearner
860. luboberg
861. ladybughugs2
862. crimsondesigns
863. cowwars28
864. Mightymoron
865. electricjesus
866. teyooo
867. majortennis
868. mmiles
869. pr3sd
870. bxh
871. dubbl
872. donbryan
873. polrbayr
874. blinktigerfire
875. desgrey
876. maneevao
877. tbonesteaks
878. jaredvv86
879. ValiantEntity
880. pieceofmind88
881. unif13d
882. amalgiata
883. midnyght219
884. Oriumpor
885. Zarniwoop
886. Falconjab
887. emanresu_nigol
888. blindchacoll
889. Yenniesaurus
890. ecsx00
891. brick6745
892. jmesnard
893. leonbasin
894. sirr
895. sacc7729
896. Yevgeniya
897. genuineskeptic
898. jone7up
899. slive77
900. Whoofph
901. tks2n
902. w.amico
903. firefokos
904. unitedrulez1
905. thecuriousguy21
906. MisterE
907. teck7878
908. fagroot
909. kgsg
910. russianislifee
911. ifr33m4n
912. shawnrouth
913. RestingOnMyLeftArm
914. NeeBo
915. utkarsh.bhatt12
916. ttymed
917. atmospheric
918. droidlove
919. jubu
920. cowcommander
921. Marwanito
922. dannyeagle
923. mattv111
924. tpkalman
925. lowkee00
926. Sec_fecked
927. WirbSypher
928. SafeW3rd
929. S0HCAHT0A
930. nakeedah
931. nat47
932. adrasteiadarkness
933. sabard
934. amd4005
935. rifche
936. lfry610
937. ruthar
938. kolas54
939. needlehead81
940. xaero
941. vulcaniceruption
942. vpan17
943. L2BSmart
944. jeremiah
945. CodeGamma
946. cdrjameson
947. muglyhacker
948. icy100
949. Serquet70
950. they_called_me_question_mark
951. nutsy
952. ER0_99
953. harukaze1337
954. tht2012
955. reignforest
956. Labman
957. nitins
958. jsmarquez
959. the_morbid_reality
960. Peroviendo
961. yi239
962. shnawpz
963. wt200999
964. konfou
965. bibin57110
966. jtmbags
967. secretagent01
968. Sheut
969. Richo1337
970. Cinergy
971. shashukla85
972. conspiracyofqueens
973. ochala
974. ravensreign
975. SM_Syncronize
976. Janette
977. Abayommii
978. rezz
979. xeromancer
980. semethingunexistant
981. Razski
982. NeinNyet
983. wwalid2050
984. donjoelt
985. bernardosgr
986. DeeDee
987. erdekim
988. jayem163
989. andy2ndlife
990. bbmacarthur
991. doubtme
992. AnC
993. crichm03
994. Sergeivlasov47
995. shamwow19
996. RicoSpartan
997. tbhammontree
998. yesitisme
999. codeerror
1000. pirehappy
1001. buguoruci
1002. meowmix
1003. dc2000dsl
1004. asteris
1005. Bnealis
1006. sloutsch
1007. thecrazyboyftw
1008. SEL_Work_Account
1009. kataninja
1010. notaterrorist89
1011. boolover
1012. SSVanDine
1013. peanutstand
1014. estudioconreddit
1015. fredeww
1016. fredeww
1017. hash0
1018. Travis.Kraatz
1019. fanazo
1020. devilishagha
1021. pkalchemy
1022. mikinbing
1023. popotheweasel
1024. matrixeffect
1025. prafuture
1026. balcil
1027. freeallbeings
1028. Wykalaczka
1029. clari21
1030. Joka999
1031. gatea
1032. gatea
1033. clatter
1034. coffeeblack198
1035. addqd
1036. gokul
1037. kingosraigi
1038. TheSn4ke
1039. Jpmulongo
1040. Theguybehindthescreen
1041. geniiissss
1042. _stupified
1043. haraf_ijhal
1044. cms
1045. Hugh472
1046. shinyhappyrobbie
1047. abhijitmone
1048. Cinci555
1049. soxfan849
1050. BatmanClubSandwich
1051. nrrrrb
1052. Figure14
1053. vinsanity16985
1054. SokolA
1055. awh
1056. blank_quest
1057. Leyeon
1058. digidawg
1059. P3t3rU5
1060. vaGnomeMagician
1061. izdiwho
1062. nlarosa