Useful Resources for Reverse Engineering and Malware Analysis

I'll update this list regularly to keep it somewhat relevant, so be sure to bookmark this page if you like the contents so far.

Books

• "Reversing: Secrets of Reverse Engineering" by Eldad Eilam

• "Reversing: secrets of reverse engineering practical reverse engineering: x86, x64, ARM, Windows kernel, Reversing tools, and obfuscation" by Bruce Dang, Alexandre Gazet and Elias Bachaalany

• "The Shellcoder's Handbook: Discovering and Exploiting Security Holes" by Chris Anley, John Heasman, Felix Lindner and Gerardo Richarte

• "Hacker Dissassembling Uncovered" by Kris Kaspersky

• "The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System" by Bill Blunden

• "Practical Malware Analysis - The Hands-On Guide to Dissecting Malicious Software" by Michael Sikorski and Andrew Honig

• "Malware Data Science - Attack Detection and Attribution" by Joshua Saxe and Hillary Sanders

• "The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory" by Michael Hale-Ligh, Andrew Case, Jamie Levy and Aaron Walters

• "Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code" by Michael Hale-Ligh, Steven Adair, Blake Hartstein and Matthew Richard

• "Practical Binary Analysis - Build Your Own Linux Tools for Binary Instrumentation, Analysis, and Disassembly" by Dennis Andriesse

• "Practical Forensic Imaging - Securing Digital Evidence with Linux Tools" by Bruce Nikkel

• "Rootkits and Bootkits - Reversing Modern Malware and Next Generation Threats" by Alex Matrosov, Eugene Rodionov and Sergey Bratus

Websites

• https://ghidra.re
• https://begin.re

Blogs

• https://malwaretech.com

• https://hshrzd.wordpress.com/ especially https://hshrzd.wordpress.com/how-to-start/

• https://blog.malwarebytes.com/

• https://blog.talosintelligence.com/

Tools

• Ghidra SRE: The RE Toolkit developed by the NSA
• IDA Free: The Freeware Version of the popular IDA Toolkit by Hex-Rays
• Resource Hacker
• Process Hacker 2: Allows you to view processes with more detail than Windows Task Manager. Can also dump memory etc.
• PEBear
• PESieve
• x64Dbg: x64Debug is the defacto tool for dynamic analysis and dumping
• Detect it easy
• ExeInfo PE: Similar to Detect it easy
• LNKParser: Parses Windows LNK Files
• oledump
• Oracle VirtualBox

Videos