Friday
Jun122009
Getting your fill of Reverse Engineering and Malware Analysis
Friday, June 12, 2009 at 2:46PM
Matt, from the Exotic Liability forums, posed a suggestion for a episode: "Getting started [in] reverse engineering hardware drivers?". I thought this was an interesting topic to attack so, I dug a bit into my RSS feed pile of goo and compiled this list of links. Hope this helps Matt.
Skywing - http://www.nynaeve.net/
Egypt - http://0xegypt.blogspot.com/
Yoni - http://blogs.msdn.com/michael_howard/
Raymond Chen - http://blogs.msdn.com/oldnewthing/
Sia0 - http://blogs.msdn.com/michkap/
Rob P - http://geekswithblogs.net/robp/Default.aspx
Quantam - http://qstuff.blogspot.com/
Phn1x - http://hamsterswheel.com/techblog/
Halavar Flake - http://addxorrol.blogspot.com/
Pedram - http://pedram.redhive.com/blog
Tyler Shields - http://www.donkeyonawaffle.org/
Wesley Shields - http://www.atarininja.org/
Peter Wieland - http://blogs.msdn.com/peterwie/
Michael Howard - http://blogs.msdn.com/michael_howard/
Doron Holan - http://blogs.msdn.com/doronh/
Nico Waisman - http://eticanicomana.blogspot.com/
Dmitry Vostokov - http://www.dumpanalysis.org/blog/
Nicolas Sylvain - http://nsylvain.blogspot.com/
Alex Ionescu - http://www.alex-ionescu.com/
Mattheiu Suiche - http://www.msuiche.net/
Larry Osterman - http://blogs.msdn.com/larryosterman/
Koby Kahane - http://kobyk.wordpress.com/
Jason Geffner - http://malwareanalysis.com/communityserver/blogs/geffner/default.aspx
Ero Carrera - http://blog.dkbza.org/
Dino Dai Zovi - http://blog.trailofbits.com/
Ilja - http://blogs.23.nu/ilja/
Nate Lawson - http://rdist.root.org/
Mark Russinovich - http://blogs.technet.com/markrussinovich/
Jose Nazario - http://www.wormblog.com/
Jonathan Morrison - http://blogs.msdn.com/itgoestoeleven/
John Robbins - http://www.wintellect.com/cs/blogs/jrobbins/default.aspx
Ilias Tsigkogiannis - http://blogs.msdn.com/iliast/
Daniel Reynaud - http://indefinitestudies.org/
Joanna Rutkowska - http://theinvisiblethings.blogspot.com/
Matthieu Kaczmarek - http://www.loria.fr/~kaczmare/index.en.htm
Silvio Cesare - http://silviocesare.wordpress.com/
Philippe Beaucamps - http://www.loria.fr/~beaucphi/
Debugging Toolbox - http://blogs.msdn.com/debuggingtoolbox/
Fravia's saved works (RIP) - http://www.woodmann.com/fravia/index.htm
Offensive Computing - http://www.offensivecomputing.net/
The Cover of Night - http://www.thecoverofnight.com/blog/
LHS - http://lhs.loria.fr/
NT Debugging - http://blogs.msdn.com/ntdebugging/
Hex Blog - http://www.hexblog.com/
Engineering for Fun - http://blog.engineeringforfun.com/
OpenRCE - http://www.openrce.org/articles/
DV Labs - http://dvlabs.tippingpoint.com/blog/
Matasano - http://www.matasano.com/log/
VeraCode - http://www.veracode.com/blog/
Trend Micro - http://blog.trendmicro.com/
Reverse Engineering - http://community.reverse-engineering.net/index.php
OpenRCE - http://www.openrce.org/forums/
Assembly Forums - http://www.asmcommunity.net/board/
Joe Box - http://www.joebox.org/
Virus Total - http://www.virustotal.com/
Wepawet - http://wepawet.cs.ucsb.edu/
F-Secure -http://www.f-secure.com/en_US/security/security-lab/
Anubis - http://anubis.iseclab.org/
Jotti - http://virusscan.jotti.org/en
Sunbelt CWSandbox - http://www.sunbeltsecurity.com/Submit.aspx?type=cwsandbox&cs=A41CD150B37359889A553671CBFD2360
Code Breakers Journal - http://www.codebreakers-journal.com/
The Art of Assembly - http://webster.cs.ucr.edu/AoA/DOS/AoADosIndex.html
Intel Processor Instruction Set A-M/N-Z - http://www.intel.com/products/processor/manuals/
WASM.ru with translation - http://66.196.80.202/babelfish/translate_url_content?lp=ru_en&url=http://www.wasm.ru&.intl=us
Individuals ---
Skywing - http://www.nynaeve.net/
Egypt - http://0xegypt.blogspot.com/
Yoni - http://blogs.msdn.com/michael_howard/
Raymond Chen - http://blogs.msdn.com/oldnewthing/
Sia0 - http://blogs.msdn.com/michkap/
Rob P - http://geekswithblogs.net/robp/Default.aspx
Quantam - http://qstuff.blogspot.com/
Phn1x - http://hamsterswheel.com/techblog/
Halavar Flake - http://addxorrol.blogspot.com/
Pedram - http://pedram.redhive.com/blog
Tyler Shields - http://www.donkeyonawaffle.org/
Wesley Shields - http://www.atarininja.org/
Peter Wieland - http://blogs.msdn.com/peterwie/
Michael Howard - http://blogs.msdn.com/michael_howard/
Doron Holan - http://blogs.msdn.com/doronh/
Nico Waisman - http://eticanicomana.blogspot.com/
Dmitry Vostokov - http://www.dumpanalysis.org/blog/
Nicolas Sylvain - http://nsylvain.blogspot.com/
Alex Ionescu - http://www.alex-ionescu.com/
Mattheiu Suiche - http://www.msuiche.net/
Larry Osterman - http://blogs.msdn.com/larryosterman/
Koby Kahane - http://kobyk.wordpress.com/
Jason Geffner - http://malwareanalysis.com/communityserver/blogs/geffner/default.aspx
Ero Carrera - http://blog.dkbza.org/
Dino Dai Zovi - http://blog.trailofbits.com/
Ilja - http://blogs.23.nu/ilja/
Nate Lawson - http://rdist.root.org/
Mark Russinovich - http://blogs.technet.com/markrussinovich/
Jose Nazario - http://www.wormblog.com/
Jonathan Morrison - http://blogs.msdn.com/itgoestoeleven/
John Robbins - http://www.wintellect.com/cs/blogs/jrobbins/default.aspx
Ilias Tsigkogiannis - http://blogs.msdn.com/iliast/
Daniel Reynaud - http://indefinitestudies.org/
Joanna Rutkowska - http://theinvisiblethings.blogspot.com/
Matthieu Kaczmarek - http://www.loria.fr/~kaczmare/index.en.htm
Silvio Cesare - http://silviocesare.wordpress.com/
Philippe Beaucamps - http://www.loria.fr/~beaucphi/
Debugging Toolbox - http://blogs.msdn.com/debuggingtoolbox/
Fravia's saved works (RIP) - http://www.woodmann.com/fravia/index.htm
Groups ---
Offensive Computing - http://www.offensivecomputing.net/
The Cover of Night - http://www.thecoverofnight.com/blog/
LHS - http://lhs.loria.fr/
NT Debugging - http://blogs.msdn.com/ntdebugging/
Hex Blog - http://www.hexblog.com/
Engineering for Fun - http://blog.engineeringforfun.com/
Company ---
OpenRCE - http://www.openrce.org/articles/
DV Labs - http://dvlabs.tippingpoint.com/blog/
Matasano - http://www.matasano.com/log/
VeraCode - http://www.veracode.com/blog/
Trend Micro - http://blog.trendmicro.com/
Forums ---
Reverse Engineering - http://community.reverse-engineering.net/index.php
OpenRCE - http://www.openrce.org/forums/
Assembly Forums - http://www.asmcommunity.net/board/
Sandboxing and Analysis ---
Joe Box - http://www.joebox.org/
Virus Total - http://www.virustotal.com/
Wepawet - http://wepawet.cs.ucsb.edu/
F-Secure -http://www.f-secure.com/en_US/security/security-lab/
Anubis - http://anubis.iseclab.org/
Jotti - http://virusscan.jotti.org/en
Sunbelt CWSandbox - http://www.sunbeltsecurity.com/Submit.aspx?type=cwsandbox&cs=A41CD150B37359889A553671CBFD2360
Misc ---
Code Breakers Journal - http://www.codebreakers-journal.com/
The Art of Assembly - http://webster.cs.ucr.edu/AoA/DOS/AoADosIndex.html
Intel Processor Instruction Set A-M/N-Z - http://www.intel.com/products/processor/manuals/
WASM.ru with translation - http://66.196.80.202/babelfish/translate_url_content?lp=ru_en&url=http://www.wasm.ru&.intl=us
Update on Sunday, October 11, 2009 at 2:25AM by
Rob Fuller
The Malware Distribution Project posted a comment a while back letting us know of their project so that it could be added to the list:
MD:Pro - http://frame4.net/
And their 'more up-to-date' Fravia archive: http://fravia.frame4.com/
Sorry it took so long getting around to adding it.
Rob Fuller |
7 Comments | 

Reader Comments (7)
[...] check out. This is the absolute best resource list we’ve seen for this topic, so be sure to bookmark it for future reference or add it to your RSS [...]
That's good.
Great list! One small detail: Debugging Toolbox is an individual :)
One more to add to the list - http://crackmes.de/archive/" rel="nofollow">http://crackmes.de/archive/ - they have a large extensive list of user created content of dummy and practice apps - each with a large community to help everyone get their feet wet. Check it out.
I really appreciate this, thank you.
you can add this project in "Sandboxing and Analysis"
http://sourceforge.net/projects/zerowine/" rel="nofollow">http://sourceforge.net/projects/zerowine/
Hi,
Seems you missed out our Malware Distribution Project, better known as MD:Pro, over at http://www.frame4.net" - we're a Dutch security company with world biggest private malware archive.
And we have a more up-to-date +Fravia (RIP) archive here : http://fravia.frame4.com/
Thanks,
Anthony