Getting Started with Windows Malware Development: A High-Level Overview
0:01:13 Motivation: The talk aims to provide a starting point for those interested in Windows malware development, compiling resources and guidance that the speaker wished they had when starting out.
0:02:13 Learn to Program: Emphasizes the importance of strong software development skills as a foundation for malware development, recommending C as the most critical language for Windows implants.
0:03:10 Implant Languages: C is most important. C++, Go, or Rust are alternatives. C# is also a popular option.
0:06:31 Assembly Understanding: Recommends understanding assembly for evasion techniques (indirect syscalls). Mentioned "Computer Systems: A Programmer's Perspective" and OST2's Arch 1001 course. Goal: Be comfortable debugging with/without symbols.
0:09:10 Windows Internals: Suggests focusing on the first three chapters of "Windows Internals" (memory, threading, processes). Supplement with ReactOS source code.
0:12:23 Read Leaked Malware Source Code: Advocates studying leaked source code (Zeus, Movie, Carberp) to understand real-world implementations and problem-solving techniques. VX Underground is a recommended place to search.
0:16:53 Resources: VX Underground, ModExp blog, x86 Matthew blog, Preempt blog, Steven Fewer's reflective DLL injection, Rapid7's Meterpreter. Mentions OA Labs streams for blue team perspective.
0:19:26 Mental Model: "The map is not the territory." Don't blindly trust documentation; explore the territory and verify information.
0:20:48 Ask Better Questions: Understanding the problem and goal before asking questions improves the quality of answers.
0:22:37 Game Hacking vs Malware Dev: The speaker hasn't done the Game Hacking Bible, but mentions both have different goals and aren't directly comparable. Game hacking is generally technically more advanced.
0:23:15 Courses: Warns that some courses may spoon-feed information and inhibit exploration, suggesting VX Underground as a valuable resource for learning on your own.
0:24:27 Blue Team Perspective: Reverse engineering knowledge is more important for the blue teamer, but understanding the motivation behind malicious activities helps.
0:25:14 EDR Bypassing: To bypass an EDR, the speaker recommends replicating the behavior that triggered it in a controlled environment, narrowing down the triggering API calls, and then exploring alternative methods to achieve the same behavior.
0:26:33 Basic Reversing: Taking random malware samples and reversing them.
0:27:53 First piece of malware made: A simple shellcode runner.
0:28:14 Linux to Windows Malware Development: Grasp Windows internals by reading chapters 1-3 of 'Windows Internals"
0:29:46 Obfuscation: Recommend checking out surreptitious software by Christian Kohlberg.