Source: OpenSecurityTraining
- Gather information
- IAT (Import Address Table)
- Strings
- Dynamic analysis
- Identify function of interest
- Identify CALLs
- Identify algorithms and data structures
- Pseudo-code it!
- If having trouble, draw the memory and CPU and map what happens at each instruction
- Rename function(s), argument(s), variable(s)
- Add comments
- GOTO 2
Reverse Engineering, Malware Deep Insight 