-1+1838 
Analyzing deep system stealth malware

This is a meta-class utilizing existing classes that will lead you step by step toward a deep technical understanding of how stealth malware works, with a particular focus on kernel level malware. A series of free video recordings of paid multi-day training classes will cover: how intel assembly works, OS internals that can be manipulated by malware, how the Windows PE binary format works, and finally the techniques used by stealth malware to hide and persist on an infected machine. But the class will teach you how you can still detect them if you have the right knowledge and the right tools. To complete all the material in this class will take approximately 50 hours, not including time spent on labs.

Lectures
    no lectures added
Prerequisites

The student must have a basic understanding of the C programming language, because the Introduction to Intel x86 class shows how snippets of C code correspond to x86 assembly instructions.

Syllabus

Students should watch videos and complete labs for classes in the following order (more details about each class can be found on the respective page):

Introductory Intel x86: Architecture, Assembly, Applications, & Alliteration

http://opensecuritytraining.info/IntroX86.html

(Necessary to know how inline hooking works.)

Intermediate Intel x86: Architecture, Assembly, Applications, & Alliteration

http://opensecuritytraining.info/IntermediateX86.html

(Necessary to know how the Interrupt Descriptor Table (IDT) hooking works, and how paging works for ShadowWalker style memory hiding.)

The Life of Binaries

http://opensecuritytraining.info/LifeOfBinaries.html

(Necessary to know how Import Address Table (IAT)/Export Address Table(EAT) hooking works.)

Rootkits: What they are, and how to find them

http://opensecuritytraining.info/Rootkits.html

(Describes techniques based on previous class knowledge, and new techniques not covered in other classes.)

Additional information

Some of the sub-classes, like Intro x86, are reused as prerequisites for other knowledge paths such as future reverse engineering or trusted computing class paths which will be advertised here. So taking the classes now will save you time later in pursuing other specialty areas.

Individual class forum subreddits have been set up, so that students taking the classes for different knowledge paths can see the questions other students have asked.

Please post individual class questions here:

http://www.reddit.com/r/OST_IntroX86

http://www.reddit.com/r/OST_IntermediateX86

http://www.reddit.com/r/OST_LifeOfBinaries

http://www.reddit.com/r/OST_Rootkits

Teacher qualifications

Xeno Kovah has a Masters in Information Security from Carnegie Mellon University, is a Lead Security Engineer at The MITRE Corporation (which runs CVE), and has spent the last 5 years focusing on security areas related to malware.

Latest Update

none

Roster
1. closetRedditor
2. brossman
3. LarsTM
4. DeathByMonkees
5. Nukiej
6. kalindidur
7. JAe
8. 7roachrush
9. thatsawchewbacca
10. armones
11. heavenlydevil
12. _Nank_
13. Zenith
14. kylep91
15. phyler
16. alienzrcoming
17. JerMenKoO
18. softero
19. ThomasM
20. NinjaOxygen
21. sudoatx
22. mononofu
23. kewlosaurusrex
24. briannnh
25. fambeu
26. Malevolence
27. Ayaq
28. g3tr00t
29. eetborp
30. Fishbot
31. Psionn
32. e2e8
33. rekav0k
34. choleropteryx
35. EmerilLIVE
36. rherzbe
37. youssef
38. Butterloaf
39. vaendryl
40. lawlmuffin
41. katskilla
42. jameson71
43. bobby177
44. balgan
45. MrJay
46. Zekah
47. FeebleOldMan
48. dudeimawizard
49. littleidiot
50. aeonian
51. Antibody
52. 8fatal3
53. spectre1037
54. Liru
55. Snuupy
56. greenrice
57. endfinity
58. shewlayce
59. GimmeASandwich
60. av__
61. Orion
62. stupot
63. tsallanmaa
64. wyrm
65. rogerwilco
66. Tisch
67. TunnyTuna
68. Wofiel
69. heylukeitsme
70. adroc
71. nouboh
72. spicypancakes
73. stormcargo
74. kaji823
75. makash
76. Voido
77. vollkommenes
78. sparksalot
79. LulzyKitten
80. Swineherd
81. Teague
82. JDragon
83. heapface
84. Hbou
85. hasan
86. HenryE
87. Driver1676
88. ciferkey
89. Desley
90. evilnop
91. gauravphoenix
92. gruxo
93. infamouslegato
94. Elendil51
95. vitorlol
96. Aaron_Durant
97. romistrub
98. nickpbrehh
99. jpcaissy
100. isaacktl
101. 3P0CH
102. nullrouted
103. bogartusmaximus
104. pcollard
105. GottaLearnThemAll
106. Ducky2009
107. c2xi3
108. jpcrocker
109. TheMagicPancake
110. emhtiwedir
111. soonersfan
112. darkmatter416
113. silkwire
114. thirteenthirtyseven
115. kovani
116. mroseto
117. AITIronbird
118. day6reak_
119. magneticstain
120. rokei
121. darks0u1
122. khafra
123. codeaholic
124. Childplay
125. Leaf
126. dinossimpson
127. N0tAUsername
128. phuzzzed
129. oneblueham
130. amguevara
131. Anayalator505
132. DSifan
133. i_p_crimson
134. grinning
135. carcor
136. oxgon
137. geekboyuk
138. mchnikola1
139. momentje
140. syphradic
141. ionthecat
142. ittoku
143. Dairith
144. surfingNerd
145. blackcat312
146. khs
147. yash3ahuja
148. shavo
149. AnoNimTeck
150. trunkm0nkey
151. SolarAquarion
152. nameandnumber
153. binahsaurus
154. arethnaar
155. teetotadpole
156. pg1770
157. baloghr
158. TheDoucheyKnight
159. jhoward1368
160. AtlasAnimated
161. uav22
162. LordFisch
163. Kambus
164. Indigo
165. retric
166. marter
167. theonlyrealcolin
168. emulator3
169. dmanww
170. johnnyc27
171. bishop256
172. zvarnell
173. lazyadmin
174. devilry
175. nuega
176. aspud
177. qriocity
178. mrtupins
179. Suraj-Sun
180. thinkerinside
181. superochiba
182. abdul01987
183. Knior
184. hatter6822
185. amivit
186. augbog
187. Swayyde
188. Dr_Rockstein
189. viper1092
190. myknowledge
191. minhtrietphamtran
192. Rizner
193. andrewd
194. sharbor
195. taris300
196. packetn00b
197. an0mn0mn0m
198. xdawg1983
199. manc3r
200. rregassa
201. ElReyNate90
202. oasis
203. Sine_Ira_Et_Studio
204. Zorg
205. mahmood
206. Blink_182
207. teraquendya
208. wydell
209. pantofeller
210. geneg981
211. SeizeTheTime
212. corg
213. jadedstony
214. brendoberry
215. Veyf
216. Zook
217. TheVoluntarist
218. m1218
219. danskete
220. GlobalProsperity
221. mraro
222. cabo_ose
223. y3ahright
224. bweidner77
225. in50mni4
226. pvejunky12
227. rest
228. Djkatscan
229. quodscath
230. poobean
231. pathway27
232. owlsaur
233. youngcd
234. baby.k008
235. ZombiEquinox
236. UVgamma
237. willwilliams111
238. munchieJ
239. insi2304
240. Lordtux
241. Mystique
242. redditorinchief
243. finprog
244. whomperjawed
245. faint26
246. dnafrequency
247. thethundergod
248. confusedcrib
249. thoythoy
250. Jmcjack
251. bartlln
252. cartamo
253. soldierno77
254. lilith
255. distortednet
256. pokemog
257. mikeypuff
258. scottnull
259. irenicus09
260. ppoxie
261. hay112
262. Tenku
263. tommyaung
264. mpd21487
265. keen_bean
266. shiznos
267. hitnrun7
268. 9088
269. SandBoxKing
270. Infectious
271. culturally_lost
272. boneslinger1
273. JosephKahn
274. Lim3s
275. lethal_antidote
276. stephen_burris_0616
277. dbpiv
278. eldrek
279. Tanginess
280. TheRuler123
281. psaffire
282. Indiemoon
283. spiffymcyiffy
284. Nightghos
285. pcza
286. DiscoGypsyFish
287. leftvertical
288. virvdova
289. moreyouknow
290. calimete
291. edwardteach
292. jonschort
293. PhaethonGlare
294. looknohands
295. ragingFlapjacks
296. genki_j
297. GlomB
298. patriotpidgeon
299. glitchmeister
300. gcganley
301. mrtwiddletoes
302. SubtlySincere
303. Cyphre
304. h3X
305. shammish
306. darushe
307. szope
308. cheeselayers
309. Khyrandor
310. tmpntls1
311. roycaboy
312. samonstake
313. cmgrowl
314. bobinbc
315. palion
316. TheMaxul
317. omasque
318. ikeamoah
319. proteanbeing
320. trellos007
321. silverhawk1234
322. drummerboy76
323. HecticBroccoli
324. wldrnryn
325. KingToadz
326. Aeze
327. _flapjacks
328. isingthr4iam
329. LucRSV
330. pcsdoneright
331. punkt2
332. Zoccihedron
333. evlehn
334. Apoptyzm
335. amt
336. Jondeaux
337. AdequatelyRight
338. Shock223
339. prk
340. Snyper
341. Crim
342. LightBringer777
343. minotaurus
344. cdiddy2
345. brickjenks100
346. jacoballen22
347. hoggar
348. jbolivar07
349. program2the2nd
350. Superfluous
351. Nuclear-Cheese
352. mmadil14
353. anonymoosetitties
354. jipson
355. Menippus
356. im_piss
357. pupid
358. sugavaneshb
359. johnthefreeman1
360. zbadgett
361. kolinder
362. refineries
363. AtHeartEngineer
364. nerdape
365. Averagebrown
366. Arthemedus
367. muthy
368. jcrubino
369. buku
370. Maromi
371. weylandchiang
372. LeviHill
373. jasonwhite23
374. xSpartanCx
375. X-N2O
376. victor.rojas0722
377. NoRK
378. orange_sporange
379. x2601
380. redditgodzilla
381. username
382. vjfalk
383. kn0ch3n
384. lazynoodles
385. sean
386. jgerwa
387. craaze
388. hankypanky44
389. Sethionic
390. Nicklesandimes
391. lulzury
392. angelicstrike
393. lynx
394. lovett
395. Kanyebek
396. ketsa
397. trdant
398. Bry6n
399. sendug
400. pwn777
401. rokthewok
402. BpJohnny
403. herpolody
404. jwhst10
405. SkillKillPhil
406. ckshin
407. pickleyperkleton
408. tlim
409. ifnotmethenwho
410. ninjuninju
411. nixx
412. danhje
413. bunjermen
414. bkbenftw
415. kalloc
416. qzpmwxin
417. Cephalic
418. aw1231
419. dmogro
420. tolaug
421. cho_O
422. rpackard1987
423. psil0Sin
424. LuminiferousEther
425. JustHereForTheTips
426. yazzz
427. peeonyou
428. revena
429. Xirdie
430. Mercfh
431. tais9
432. ash244
433. hams-andwich
434. HHHNNNNNGGGGGGG
435. blutweinen
436. ASexualPanda
437. Sarge0341
438. Adv23
439. Islambekm
440. acfarias
441. optimusx
442. _GregWilson
443. elizabeth7888
444. wavemancer
445. somehokie
446. gaolathe
447. swapex
448. Noox
449. STFUandLove
450. Shalemanse
451. sonigajanand
452. tnachen
453. jarabek
454. donde_esta_waldo
455. stefano213
456. sirax
457. gargolito
458. srslySHENANIGANS
459. xslamhoundx
460. wolfram8
461. keifak
462. jcsoybomb
463. dr0k
464. batsh1t
465. u4iak
466. ChrisBarrett
467. Halfnhav4
468. kneeups2
469. musfiqniaz
470. mattyuiop
471. somedrunken
472. paulpc32
473. mimo8080
474. jsstarn1
475. Arrow
476. Xineoph
477. RolandStone
478. afortknight
479. AgentGraves
480. turk15h
481. Noblerazgriz
482. pequod
483. JAMESKOOL
484. freiheitkampfer
485. elhall
486. dibyo
487. oscr
488. alamakota
489. deanstag
490. vfxGer
491. richsin
492. sreeramaraju
493. azram19
494. ebfe
495. Bockwurst
496. kettlelakes
497. rotokayu
498. denver_coder
499. b0mbur
500. gdfsfgdsfgdfg
501. focusgeek
502. Beastcraft
503. netmax2k
504. 0x09
505. patrick.cieplak
506. oodabaga
507. mpfefferle
508. ecanals
509. lakeeffect
510. Larukanpai
511. binhdna
512. wilkinsense
513. abigail
514. TimCapello
515. Seth968
516. blucrunch
517. AdrianusBystrm
518. genericzombie
519. sect
520. djcoax
521. smurfx80
522. ncms1990
523. dweebo
524. joronu
525. silentbob417
526. cfarlin83
527. imabrokendownload
528. neilbo
529. TwoCookiesInAJar
530. Panno123
531. Pollie
532. 6ru83r
533. budmademewiser
534. moriartyisourking
535. denpaDawn
536. Spellchaser
537. Clockwork_Logic_Bomb
538. simonasorlescu
539. dc17540
540. viceroyjenkins
541. p3pt
542. iron__mind
543. koalalove
544. sqwerl
545. Forrest
546. astronate
547. linuxuser437442
548. Tommibee123
549. mangloid
550. rockies_road
551. randomg
552. GfFoundOtherAccount
553. dwhite73
554. furioustyles
555. martensms
556. g1no23
557. Heerokazen
558. pbr333
559. tech1337
560. Elastic_Penguin
561. chelrae33
562. Clemenreau
563. besz
564. EasyYoke
565. LurksReddit
566. tleisher
567. rulerofera
568. breedx
569. lexluthor
570. mrmoo
571. redbass2
572. rkrishnasanka
573. swapout
574. jca27
575. benwaffle
576. medrolke
577. Legend
578. tinythai
579. Tonon
580. ecoplan
581. hydroperoxyl
582. Shauta
583. Darkskilling
584. tordj
585. names_irrelevant
586. PineMaple
587. suggas
588. Theman00011
589. jennie
590. Jamhammer
591. Hamza20697
592. FatKevin
593. da13omb
594. dopesoap
595. imeatingseeds
596. JAWE
597. ArsonistNightfire
598. Frenzybear
599. mttwtts
600. jmiller
601. envyotcoast
602. Mop6229
603. sirmaxwell90
604. w8cycle
605. buzzeru
606. jeffrflagg
607. MrA1Sauce
608. adamnemecek
609. vivanac
610. ArdRay
611. faptothis
612. saarinx
613. shoshy
614. hnqoliveira
615. nightlion3
616. aboudib
617. Ars-Nocendi
618. salomao
619. cornelius2012
620. neevor
621. iudocus
622. Trapick
623. professorpainx
624. mrhicks
625. MyrtileJudge
626. CosmicSignularity
627. SpreadbleFruit
628. LisaMCooper
629. Kurtismonger
630. atlbravo
631. jason.leon
632. ator22
633. sonikarc
634. talldude4912
635. Pingopango
636. lioncoop
637. ingloriouswallflower
638. subclavia
639. vardhan
640. imconfus
641. hnd
642. mirorakonto
643. ehmohteeoh
644. awesomeness1498
645. tokomonster
646. bjh
647. winkdtm
648. generaldespair
649. Yanni123
650. thekobra1337
651. nakkefame
652. Snake3190
653. whatchuwant1
654. peckhamspring
655. taeyeonbooty
656. TheFlyingCox
657. rlowe
658. ati_ozgur
659. josephb16
660. profryan
661. shemmenway
662. haveatya
663. Stryk3rr
664. ashreipinkus
665. sumnuyungi
666. flano1
667. Batchmuffin
668. kurashima
669. hmoodallahma
670. danskal
671. dreamripper
672. Marionfrey
673. aamirazeem
674. pseaguy
675. adamc
676. Omnicyde
677. romieerome
678. HenryEshbaugh
679. hobn
680. SunSatION
681. jameslovescoloring
682. Rinali
683. shwets
684. makake
685. Halvarian
686. roo11
687. ghostjangles
688. areianea
689. lexiwho
690. Vodka_sec
691. likes_things
692. vannek
693. alwaysfocusing
694. SebastianGaius
695. nushublushu
696. heroyi
697. strandedcat
698. Raad777
699. pvtfawkes
700. jimtow28
701. flyingraccoon
702. danielcatz
703. ajmorey13
704. packersfan25
705. richardcranium69
706. jaredkz
707. pseudoShell
708. ITZCHEESE
709. PhosphorusGL
710. rockstardavid
711. draculatreeforest
712. EXICON
713. schnarfnark
714. lillith
715. frenchie
716. TechJLS3
717. Col13geBoy
718. methane95
719. small_moves
720. Dr_Farenheit
721. Patchureddit
722. Patchreddit
723. Rdslnc
724. retardate
725. chienlou
726. demet8
727. DrollestMoloch
728. alexendoo
729. CodeRunner
730. zzMcgee
731. ncastell77
732. hyste
733. ezrakh
734. zazziethebeast
735. ryustreetfighter
736. mvsm
737. dre2001
738. how_am_i
739. Mr_Perfekt
740. BeauG7
741. dzeko
742. fidelcastro21
743. bert5683
744. osculator
745. enginerrd
746. whelixw
747. Arpitha_Madugundu
748. HolmesSherlockHolmes
749. BlueGuy90
750. mrfuzz
751. adigallo
752. shahsali
753. jmw327
754. Cgorke
755. zeppcg
756. wilnasmith
757. cyimakemoney
758. whereismylife
759. communist_maltipoo
760. Deathnerd
761. ninja007
762. thepluralevan
763. Peps0791
764. lumpy_pumpkin
765. VirtualVirgo
766. hituptony
767. imranshaik12
768. Born2Learn
769. Born2Learn
770. chilukrn
771. corycruse
772. uritz
773. imheretolearn
774. rigamaroo138
775. Thatgguy
776. glassofwater
777. DampedWharf
778. chrisempire
779. highhopes223
780. einarsw
781. jcgoncalves
782. redking79
783. frozentrually
784. Tony116
785. dracoexplosion
786. ctc26
787. screamingstar
788. theshiest
789. pattzalrex
790. Ratking
791. forvino
792. SockRabbit
793. set92
794. JustinHit
795. CoffeeFlux
796. frekdisco
797. mobyxe
798. Omix32
799. NaefAlduhaim
800. DigitalKlepto
801. trumpet6
802. smmitchell2
803. IVantToLearn
804. liebstraum
805. raageo
806. xaliap81
807. SockWitch
808. tmlambert13
809. LCne
810. audunthecyborg
811. JacktheFlying
812. o99o99
813. CrikeyChriss
814. halycononandon
815. learnitall
816. germk4
817. goaneese
818. fluorescentbulb
819. Calinate
820. syedz89
821. Cinergy_
822. beezy
823. jahbagio
824. amathian
825. suicidalfitnessfreak
826. Regicide89
827. darthbottle
828. quantumite
829. shryke1
830. Polysaccharide
831. lx003n
832. Naiyon
833. baggies
834. feebarscevicius
835. admiralgeneral
836. ameyraje
837. olds0ul
838. gurjot89
839. ben.clayton11
840. ecNate
841. cajones86
842. Julian
843. Sarkasmot
844. unmeg
845. crazygamedude
846. Alex78
847. timrabb211
848. muhdnaaim
849. rtnrhl
850. HieGuiz
851. MrQQish
852. ficar
853. agentsvr
854. bitboard
855. Dragonduck
856. Aumnescience
857. Tate413
858. s3ans3ns3i
859. Owan101
860. MarkPena373
861. jerrylearner
862. luboberg
863. ladybughugs2
864. wbecker2
865. crimsondesigns
866. cowwars28
867. Mightymoron
868. electricjesus
869. teyooo
870. majortennis
871. mmiles
872. pr3sd
873. bxh
874. dubbl
875. donbryan
876. polrbayr
877. blinktigerfire
878. desgrey
879. maneevao
880. tbonesteaks
881. jaredvv86
882. ValiantEntity
883. pieceofmind88
884. uroboru
885. unif13d
886. amalgiata
887. midnyght219
888. Oriumpor
889. Zarniwoop
890. Falconjab
891. emanresu_nigol
892. blindchacoll
893. Yenniesaurus
894. ecsx00
895. brick6745
896. jmesnard
897. leonbasin
898. sirr
899. sacc7729
900. Yevgeniya
901. genuineskeptic
902. jone7up
903. slive77
904. Whoofph
905. tks2n