Table of Contents for

Practical Malware Analysis

X

x command, WinDbg, Searching for Symbols

x64 architecture, 64-Bit Malware, Differences in x64 Architecture, Differences in the x64 Calling Convention and Stack Usage, Detailed Analysis

differences in calling convention and stack usage, Differences in x64 Architecture

exception handling, Differences in the x64 Calling Convention and Stack Usage

malware with component for, Detailed Analysis

x64 Windows, kernel issues for, Loading Drivers

x86 architecture, Reverse-Engineering, Main Memory, Main Memory, Instructions, Instructions, Registers, Flags, Arithmetic, The Stack, The Stack, Function Calls, Stack Layout, Stack Layout, Branching, Rep Instructions, More Information: Intel x86 Architecture Manuals, Vulnerable Instructions, Shellcode Analysis, Position-Independent Code, Short Answers

branching, Stack Layout

C main method and offsets, Rep Instructions

code types and data access, Shellcode Analysis

conditionals, Stack Layout

documentation manuals, More Information: Intel x86 Architecture Manuals

instruction set, general-purpose register for, Position-Independent Code

instructions, Main Memory

main memory, Main Memory

NOP instruction, Arithmetic

opcodes and endianness, Instructions

operands, Instructions

registers, Registers, Vulnerable Instructions

rep instructions, Branching

search for vulnerable instructions, Short Answers

simple instructions, Flags

stack, The Stack, The Stack, Function Calls

function calls, The Stack

layout, Function Calls

x86 disassembly, A Crash Course in x86 Disassembly, Levels of Abstraction, Levels of Abstraction

levels of abstraction, Levels of Abstraction

reverse-engineer, Levels of Abstraction

x86-64 architecture, 64-Bit Malware

x87 floating-point unit (FPU), Using call/pop

Xen, The Structure of a Virtual Machine

XOR cipher, XOR, XOR, Brute-Forcing XOR Encoding, NULL-Preserving Single-Byte XOR Encoding

brute-forcing, XOR

identifying loops in IDA Pro, NULL-Preserving Single-Byte XOR Encoding

NULL preserving single-byte, Brute-Forcing XOR Encoding

XOR encoded strings, decoding, Filename Check

XOR encoding loop, Detailed Analysis

xor instruction, Arithmetic, Identifying XOR Loops in IDA Pro, Detailed Analysis, Detailed Analysis, Short Answers

forms, Identifying XOR Loops in IDA Pro

searching for, Short Answers

searching for nonzeroing, Detailed Analysis

XOR logical operator, in x86 architecture, Arithmetic

xref, Jump Table (see cross-references (xref))

Xrefs window, in IDA Pro, Code Cross-References