-1+1958 
Analyzing deep system stealth malware

This is a meta-class utilizing existing classes that will lead you step by step toward a deep technical understanding of how stealth malware works, with a particular focus on kernel level malware. A series of free video recordings of paid multi-day training classes will cover: how intel assembly works, OS internals that can be manipulated by malware, how the Windows PE binary format works, and finally the techniques used by stealth malware to hide and persist on an infected machine. But the class will teach you how you can still detect them if you have the right knowledge and the right tools. To complete all the material in this class will take approximately 50 hours, not including time spent on labs.

Lectures
    no lectures added
Prerequisites

The student must have a basic understanding of the C programming language, because the Introduction to Intel x86 class shows how snippets of C code correspond to x86 assembly instructions.

Syllabus

Students should watch videos and complete labs for classes in the following order (more details about each class can be found on the respective page):

Introductory Intel x86: Architecture, Assembly, Applications, & Alliteration

http://opensecuritytraining.info/IntroX86.html

(Necessary to know how inline hooking works.)

Intermediate Intel x86: Architecture, Assembly, Applications, & Alliteration

http://opensecuritytraining.info/IntermediateX86.html

(Necessary to know how the Interrupt Descriptor Table (IDT) hooking works, and how paging works for ShadowWalker style memory hiding.)

The Life of Binaries

http://opensecuritytraining.info/LifeOfBinaries.html

(Necessary to know how Import Address Table (IAT)/Export Address Table(EAT) hooking works.)

Rootkits: What they are, and how to find them

http://opensecuritytraining.info/Rootkits.html

(Describes techniques based on previous class knowledge, and new techniques not covered in other classes.)

Additional information

Some of the sub-classes, like Intro x86, are reused as prerequisites for other knowledge paths such as future reverse engineering or trusted computing class paths which will be advertised here. So taking the classes now will save you time later in pursuing other specialty areas.

Individual class forum subreddits have been set up, so that students taking the classes for different knowledge paths can see the questions other students have asked.

Please post individual class questions here:

http://www.reddit.com/r/OST_IntroX86

http://www.reddit.com/r/OST_IntermediateX86

http://www.reddit.com/r/OST_LifeOfBinaries

http://www.reddit.com/r/OST_Rootkits

Teacher qualifications

Xeno Kovah has a Masters in Information Security from Carnegie Mellon University, is a Lead Security Engineer at The MITRE Corporation (which runs CVE), and has spent the last 5 years focusing on security areas related to malware.

Latest Update

none

Roster
1. closetRedditor
2. brossman
3. LarsTM
4. DeathByMonkees
5. Nukiej
6. kalindidur
7. JAe
8. 7roachrush
9. thatsawchewbacca
10. armones
11. heavenlydevil
12. _Nank_
13. Zenith
14. kylep91
15. phyler
16. alienzrcoming
17. JerMenKoO
18. softero
19. ThomasM
20. NinjaOxygen
21. sudoatx
22. mononofu
23. kewlosaurusrex
24. briannnh
25. fambeu
26. Malevolence
27. Ayaq
28. g3tr00t
29. eetborp
30. Fishbot
31. Psionn
32. e2e8
33. rekav0k
34. choleropteryx
35. EmerilLIVE
36. rherzbe
37. youssef
38. Butterloaf
39. vaendryl
40. lawlmuffin
41. katskilla
42. jameson71
43. bobby177
44. balgan
45. MrJay
46. Zekah
47. FeebleOldMan
48. dudeimawizard
49. littleidiot
50. aeonian
51. Antibody
52. 8fatal3
53. spectre1037
54. Liru
55. Snuupy
56. greenrice
57. endfinity
58. shewlayce
59. GimmeASandwich
60. av__
61. Orion
62. stupot
63. tsallanmaa
64. wyrm
65. rogerwilco
66. Tisch
67. TunnyTuna
68. Wofiel
69. heylukeitsme
70. adroc
71. nouboh
72. spicypancakes
73. stormcargo
74. kaji823
75. makash
76. Voido
77. vollkommenes
78. sparksalot
79. LulzyKitten
80. Swineherd
81. Teague
82. JDragon
83. heapface
84. Hbou
85. hasan
86. HenryE
87. Driver1676
88. ciferkey
89. Desley
90. evilnop
91. gauravphoenix
92. gruxo
93. infamouslegato
94. Elendil51
95. vitorlol
96. Aaron_Durant
97. romistrub
98. nickpbrehh
99. jpcaissy
100. isaacktl
101. 3P0CH
102. nullrouted
103. bogartusmaximus
104. pcollard
105. GottaLearnThemAll
106. Ducky2009
107. c2xi3
108. jpcrocker
109. TheMagicPancake
110. emhtiwedir
111. soonersfan
112. darkmatter416
113. silkwire
114. thirteenthirtyseven
115. kovani
116. mroseto
117. AITIronbird
118. day6reak_
119. magneticstain
120. rokei
121. darks0u1
122. khafra
123. codeaholic
124. Childplay
125. Leaf
126. dinossimpson
127. N0tAUsername
128. phuzzzed
129. oneblueham
130. amguevara
131. Anayalator505
132. DSifan
133. i_p_crimson
134. grinning
135. carcor
136. oxgon
137. geekboyuk
138. mchnikola1
139. momentje
140. syphradic
141. ionthecat
142. ittoku
143. Dairith
144. surfingNerd
145. blackcat312
146. khs
147. yash3ahuja
148. shavo
149. AnoNimTeck
150. trunkm0nkey
151. SolarAquarion
152. nameandnumber
153. binahsaurus
154. arethnaar
155. teetotadpole
156. pg1770
157. baloghr
158. TheDoucheyKnight
159. jhoward1368
160. AtlasAnimated
161. uav22
162. LordFisch
163. Kambus
164. Indigo
165. retric
166. marter
167. theonlyrealcolin
168. emulator3
169. dmanww
170. johnnyc27
171. bishop256
172. zvarnell
173. lazyadmin
174. devilry
175. nuega
176. aspud
177. qriocity
178. mrtupins
179. Suraj-Sun
180. thinkerinside
181. superochiba
182. abdul01987
183. Knior
184. hatter6822
185. amivit
186. augbog
187. Swayyde
188. Dr_Rockstein
189. viper1092
190. myknowledge
191. minhtrietphamtran
192. Rizner
193. andrewd
194. sharbor
195. taris300
196. packetn00b
197. an0mn0mn0m
198. xdawg1983
199. manc3r
200. rregassa
201. ElReyNate90
202. oasis
203. Sine_Ira_Et_Studio
204. Zorg
205. mahmood
206. Blink_182
207. teraquendya
208. wydell
209. pantofeller
210. geneg981
211. SeizeTheTime
212. corg
213. jadedstony
214. brendoberry
215. Veyf
216. Zook
217. TheVoluntarist
218. m1218
219. danskete
220. GlobalProsperity
221. mraro
222. cabo_ose
223. y3ahright
224. bweidner77
225. in50mni4
226. pvejunky12
227. rest
228. Djkatscan
229. quodscath
230. poobean
231. pathway27
232. owlsaur
233. youngcd
234. baby.k008
235. ZombiEquinox
236. UVgamma
237. willwilliams111
238. munchieJ
239. insi2304
240. Lordtux
241. Mystique
242. redditorinchief
243. finprog
244. whomperjawed
245. faint26
246. dnafrequency
247. thethundergod
248. confusedcrib
249. thoythoy
250. Jmcjack
251. bartlln
252. cartamo
253. soldierno77
254. lilith
255. distortednet
256. pokemog
257. mikeypuff
258. scottnull
259. irenicus09
260. ppoxie
261. hay112
262. Tenku
263. tommyaung
264. mpd21487
265. keen_bean
266. shiznos
267. hitnrun7
268. 9088
269. SandBoxKing
270. Infectious
271. culturally_lost
272. boneslinger1
273. JosephKahn
274. Lim3s
275. lethal_antidote
276. stephen_burris_0616
277. dbpiv
278. eldrek
279. Tanginess
280. TheRuler123
281. psaffire
282. Indiemoon
283. spiffymcyiffy
284. Nightghos
285. pcza
286. DiscoGypsyFish
287. leftvertical
288. virvdova
289. moreyouknow
290. calimete
291. edwardteach
292. jonschort
293. PhaethonGlare
294. looknohands
295. ragingFlapjacks
296. genki_j
297. GlomB
298. patriotpidgeon
299. glitchmeister
300. gcganley
301. mrtwiddletoes
302. SubtlySincere
303. Cyphre
304. h3X
305. shammish
306. darushe
307. szope
308. cheeselayers
309. Khyrandor
310. tmpntls1
311. roycaboy
312. samonstake
313. cmgrowl
314. bobinbc
315. palion
316. TheMaxul
317. omasque
318. ikeamoah
319. proteanbeing
320. trellos007
321. silverhawk1234
322. drummerboy76
323. HecticBroccoli
324. wldrnryn
325. KingToadz
326. Aeze
327. _flapjacks
328. isingthr4iam
329. LucRSV
330. pcsdoneright
331. punkt2
332. Zoccihedron
333. evlehn
334. Apoptyzm
335. amt
336. Jondeaux
337. AdequatelyRight
338. Shock223
339. prk
340. Snyper
341. Crim
342. LightBringer777
343. minotaurus
344. cdiddy2
345. brickjenks100
346. jacoballen22
347. hoggar
348. jbolivar07
349. program2the2nd
350. Superfluous
351. Nuclear-Cheese
352. mmadil14
353. anonymoosetitties
354. jipson
355. Menippus
356. im_piss
357. pupid
358. sugavaneshb
359. johnthefreeman1
360. zbadgett
361. kolinder
362. refineries
363. AtHeartEngineer
364. nerdape
365. Averagebrown
366. Arthemedus
367. muthy
368. jcrubino
369. buku
370. Maromi
371. weylandchiang
372. LeviHill
373. jasonwhite23
374. xSpartanCx
375. X-N2O
376. victor.rojas0722
377. NoRK
378. orange_sporange
379. x2601
380. redditgodzilla
381. username
382. vjfalk
383. kn0ch3n
384. lazynoodles
385. sean
386. jgerwa
387. craaze
388. hankypanky44
389. Sethionic
390. Nicklesandimes
391. lulzury
392. angelicstrike
393. lynx
394. lovett
395. Kanyebek
396. ketsa
397. trdant
398. Bry6n
399. sendug
400. pwn777
401. rokthewok
402. BpJohnny
403. herpolody
404. jwhst10
405. SkillKillPhil
406. ckshin
407. pickleyperkleton
408. tlim
409. ifnotmethenwho
410. ninjuninju
411. nixx
412. danhje
413. bunjermen
414. bkbenftw
415. kalloc
416. qzpmwxin
417. Cephalic
418. aw1231
419. dmogro
420. tolaug
421. cho_O
422. rpackard1987
423. psil0Sin
424. LuminiferousEther
425. JustHereForTheTips
426. yazzz
427. peeonyou
428. revena
429. Xirdie
430. Mercfh
431. tais9
432. ash244
433. hams-andwich
434. HHHNNNNNGGGGGGG
435. blutweinen
436. ASexualPanda
437. Sarge0341
438. Adv23
439. Islambekm
440. acfarias
441. optimusx
442. _GregWilson
443. elizabeth7888
444. wavemancer
445. somehokie
446. gaolathe
447. swapex
448. Noox
449. STFUandLove
450. Shalemanse
451. sonigajanand
452. tnachen
453. jarabek
454. donde_esta_waldo
455. stefano213
456. sirax
457. gargolito
458. srslySHENANIGANS
459. xslamhoundx
460. wolfram8
461. keifak
462. jcsoybomb
463. dr0k
464. batsh1t
465. u4iak
466. ChrisBarrett
467. Halfnhav4
468. kneeups2
469. musfiqniaz
470. mattyuiop
471. somedrunken
472. paulpc32
473. mimo8080
474. jsstarn1
475. Arrow
476. Xineoph
477. RolandStone
478. afortknight
479. AgentGraves
480. turk15h
481. Noblerazgriz
482. pequod
483. JAMESKOOL
484. freiheitkampfer
485. elhall
486. dibyo
487. oscr
488. alamakota
489. deanstag
490. vfxGer
491. richsin
492. sreeramaraju
493. azram19
494. ebfe
495. Bockwurst
496. kettlelakes
497. rotokayu
498. denver_coder
499. b0mbur
500. gdfsfgdsfgdfg
501. focusgeek
502. Beastcraft
503. netmax2k
504. 0x09
505. patrick.cieplak
506. oodabaga
507. mpfefferle
508. ecanals
509. lakeeffect
510. Larukanpai
511. binhdna
512. wilkinsense
513. abigail
514. TimCapello
515. Seth968
516. blucrunch
517. AdrianusBystrm
518. genericzombie
519. sect
520. djcoax
521. smurfx80
522. ncms1990
523. dweebo
524. joronu
525. silentbob417
526. cfarlin83
527. imabrokendownload
528. neilbo
529. Panno123
530. Pollie
531. 6ru83r
532. budmademewiser
533. moriartyisourking
534. denpaDawn
535. Spellchaser
536. Clockwork_Logic_Bomb
537. simonasorlescu
538. dc17540
539. viceroyjenkins
540. p3pt
541. iron__mind
542. koalalove
543. sqwerl
544. Forrest
545. astronate
546. linuxuser437442
547. Tommibee123
548. mangloid
549. rockies_road
550. randomg
551. GfFoundOtherAccount
552. dwhite73
553. furioustyles
554. martensms
555. g1no23
556. Heerokazen
557. pbr333
558. tech1337
559. Elastic_Penguin
560. chelrae33
561. Clemenreau
562. besz
563. EasyYoke
564. LurksReddit
565. tleisher
566. rulerofera
567. breedx
568. lexluthor
569. mrmoo
570. redbass2
571. rkrishnasanka
572. swapout
573. jca27
574. benwaffle
575. medrolke
576. Legend
577. tinythai
578. Tonon
579. ecoplan
580. hydroperoxyl
581. Shauta
582. Darkskilling
583. tordj
584. names_irrelevant
585. PineMaple
586. suggas
587. Theman00011
588. jennie
589. Jamhammer
590. Hamza20697
591. FatKevin
592. da13omb
593. dopesoap
594. imeatingseeds
595. JAWE
596. ArsonistNightfire
597. Frenzybear
598. mttwtts
599. jmiller
600. envyotcoast
601. Mop6229
602. sirmaxwell90
603. w8cycle
604. buzzeru
605. jeffrflagg
606. MrA1Sauce
607. adamnemecek
608. vivanac
609. ArdRay
610. faptothis
611. saarinx
612. shoshy
613. hnqoliveira
614. nightlion3
615. aboudib
616. Ars-Nocendi
617. salomao
618. cornelius2012
619. neevor
620. iudocus
621. Trapick
622. professorpainx
623. mrhicks
624. MyrtileJudge
625. CosmicSignularity
626. SpreadbleFruit
627. LisaMCooper
628. Kurtismonger
629. atlbravo
630. jason.leon
631. ator22
632. sonikarc
633. talldude4912
634. Pingopango
635. lioncoop
636. ingloriouswallflower
637. subclavia
638. vardhan
639. imconfus
640. hnd
641. mirorakonto
642. ehmohteeoh
643. awesomeness1498
644. tokomonster
645. bjh
646. winkdtm
647. generaldespair
648. Yanni123
649. thekobra1337
650. nakkefame
651. Snake3190
652. whatchuwant1
653. peckhamspring
654. taeyeonbooty
655. TheFlyingCox
656. rlowe
657. ati_ozgur
658. josephb16
659. profryan
660. shemmenway
661. haveatya
662. Stryk3rr
663. ashreipinkus
664. sumnuyungi
665. flano1
666. Batchmuffin
667. kurashima
668. hmoodallahma
669. danskal
670. dreamripper
671. Marionfrey
672. aamirazeem
673. pseaguy
674. adamc
675. Omnicyde
676. romieerome
677. HenryEshbaugh
678. hobn
679. SunSatION
680. jameslovescoloring
681. Rinali
682. shwets
683. makake
684. Halvarian
685. roo11
686. ghostjangles
687. areianea
688. lexiwho
689. Vodka_sec
690. likes_things
691. vannek
692. alwaysfocusing
693. SebastianGaius
694. nushublushu
695. heroyi
696. strandedcat
697. Raad777
698. pvtfawkes
699. jimtow28
700. flyingraccoon
701. danielcatz
702. ajmorey13
703. packersfan25
704. richardcranium69
705. jaredkz
706. pseudoShell
707. ITZCHEESE
708. PhosphorusGL
709. rockstardavid
710. draculatreeforest
711. EXICON
712. schnarfnark
713. lillith
714. frenchie
715. TechJLS3
716. Col13geBoy
717. methane95
718. small_moves
719. Dr_Farenheit
720. Patchureddit
721. Patchreddit
722. Rdslnc
723. retardate
724. chienlou
725. demet8
726. DrollestMoloch
727. alexendoo
728. CodeRunner
729. zzMcgee
730. ncastell77
731. hyste
732. ezrakh
733. zazziethebeast
734. ryustreetfighter
735. mvsm
736. dre2001
737. how_am_i
738. Mr_Perfekt
739. BeauG7
740. dzeko
741. fidelcastro21
742. bert5683
743. osculator
744. enginerrd
745. whelixw
746. Arpitha_Madugundu
747. HolmesSherlockHolmes
748. BlueGuy90
749. mrfuzz
750. adigallo
751. shahsali
752. jmw327
753. Cgorke
754. zeppcg
755. wilnasmith
756. cyimakemoney
757. whereismylife
758. communist_maltipoo
759. Deathnerd
760. ninja007
761. thepluralevan
762. Peps0791
763. lumpy_pumpkin
764. VirtualVirgo
765. hituptony
766. imranshaik12
767. Born2Learn
768. Born2Learn
769. chilukrn
770. corycruse
771. uritz
772. imheretolearn
773. rigamaroo138
774. Thatgguy
775. glassofwater
776. DampedWharf
777. chrisempire
778. highhopes223
779. einarsw
780. jcgoncalves
781. redking79
782. frozentrually
783. Tony116
784. dracoexplosion
785. ctc26
786. screamingstar
787. theshiest
788. pattzalrex
789. Ratking
790. forvino
791. SockRabbit
792. set92
793. JustinHit
794. CoffeeFlux
795. frekdisco
796. mobyxe
797. Omix32
798. NaefAlduhaim
799. DigitalKlepto
800. trumpet6
801. smmitchell2
802. IVantToLearn
803. liebstraum
804. raageo
805. xaliap81
806. SockWitch
807. tmlambert13
808. LCne
809. audunthecyborg
810. JacktheFlying
811. o99o99
812. CrikeyChriss
813. halycononandon
814. learnitall
815. germk4
816. goaneese
817. fluorescentbulb
818. Calinate
819. syedz89
820. Cinergy_
821. beezy
822. jahbagio
823. amathian
824. suicidalfitnessfreak
825. Regicide89
826. darthbottle
827. quantumite
828. shryke1
829. Polysaccharide
830. lx003n
831. Naiyon
832. baggies
833. feebarscevicius
834. admiralgeneral
835. ameyraje
836. olds0ul
837. gurjot89
838. ben.clayton11
839. ecNate
840. cajones86
841. Julian
842. Sarkasmot
843. unmeg
844. crazygamedude
845. Alex78
846. timrabb211
847. muhdnaaim
848. rtnrhl
849. HieGuiz
850. MrQQish
851. ficar
852. agentsvr
853. bitboard
854. Dragonduck
855. Aumnescience
856. Tate413
857. s3ans3ns3i
858. Owan101
859. MarkPena373
860. jerrylearner
861. luboberg
862. ladybughugs2
863. crimsondesigns
864. cowwars28
865. Mightymoron
866. electricjesus
867. teyooo
868. majortennis
869. mmiles
870. pr3sd
871. bxh
872. dubbl
873. donbryan
874. polrbayr
875. blinktigerfire
876. desgrey
877. maneevao
878. tbonesteaks
879. jaredvv86
880. ValiantEntity
881. pieceofmind88
882. unif13d
883. amalgiata
884. midnyght219
885. Oriumpor
886. Zarniwoop
887. Falconjab
888. emanresu_nigol
889. blindchacoll
890. Yenniesaurus
891. ecsx00
892. brick6745
893. jmesnard
894. leonbasin
895. sirr
896. sacc7729
897. Yevgeniya
898. genuineskeptic
899. jone7up
900. slive77
901. Whoofph
902. tks2n
903. w.amico
904. firefokos
905. unitedrulez1
906. thecuriousguy21
907. MisterE
908. teck7878
909. fagroot
910. kgsg
911. russianislifee
912. ifr33m4n
913. shawnrouth
914. RestingOnMyLeftArm
915. NeeBo
916. utkarsh.bhatt12
917. ttymed
918. atmospheric
919. droidlove
920. jubu
921. cowcommander
922. Marwanito
923. dannyeagle
924. mattv111
925. tpkalman
926. lowkee00
927. Sec_fecked
928. WirbSypher
929. SafeW3rd
930. S0HCAHT0A
931. nakeedah
932. nat47
933. adrasteiadarkness
934. sabard
935. amd4005
936. rifche
937. lfry610
938. ruthar
939. kolas54
940. needlehead81
941. xaero
942. vulcaniceruption
943. vpan17
944. L2BSmart
945. jeremiah
946. CodeGamma
947. cdrjameson
948. muglyhacker
949. icy100
950. Serquet70
951. they_called_me_question_mark
952. nutsy
953. ER0_99
954. harukaze1337
955. tht2012
956. reignforest
957. Labman
958. nitins
959. jsmarquez
960. the_morbid_reality
961. Peroviendo
962. yi239
963. shnawpz
964. wt200999
965. konfou
966. bibin57110
967. jtmbags
968. secretagent01
969. Sheut
970. Richo1337
971. Cinergy
972. shashukla85
973. conspiracyofqueens
974. ochala
975. ravensreign
976. SM_Syncronize
977. Janette
978. Abayommii
979. rezz
980. xeromancer
981. semethingunexistant
982. Razski
983. NeinNyet
984. wwalid2050
985. donjoelt
986. bernardosgr
987. DeeDee
988. erdekim
989. jayem163
990. andy2ndlife
991. bbmacarthur
992. doubtme
993. AnC
994. crichm03
995. Sergeivlasov47
996. shamwow19
997. RicoSpartan
998. tbhammontree
999. yesitisme
1000. codeerror
1001. pirehappy
1002. buguoruci
1003. meowmix
1004. dc2000dsl
1005. asteris
1006. Bnealis
1007. sloutsch
1008. thecrazyboyftw
1009. SEL_Work_Account
1010. kataninja
1011. notaterrorist89
1012. boolover
1013. SSVanDine
1014. peanutstand
1015. estudioconreddit
1016. fredeww
1017. fredeww
1018. hash0
1019. Travis.Kraatz
1020. fanazo
1021. devilishagha
1022. pkalchemy
1023. mikinbing
1024. popotheweasel
1025. matrixeffect
1026. prafuture
1027. balcil
1028. freeallbeings
1029. Wykalaczka
1030. clari21