-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Mastering Malware Analysis
By :

For malware authors to keep their operations going without being interrupted by antivirus products or any takedown operations, they have to fight back and equip their tools with various anti-reverse engineering techniques. Debuggers are the most common tools that malware analysts use to dissect malware and reveal its functionality. Therefore, malware authors implement various anti-debugging tricks to complicate the analysis and keep their functionality and configuration details (mainly Command & Control servers or C&Cs) hidden.
Windows provides lots of ways to identify the presence of a debugger; many of them rely on the information stored in the Process Environment Block (PEB). For example, one of its fields located at offset 2 and called BeingDebugged
is set to True when the process is running under a debugger. To access this flag, malware can execute the following instructions:
mov eax, dword ptr fs:...