December 2020
Beginner to intermediate
448 pages
7h 48m
Japanese
Content preview from 初めてのマルウェア解析 ―Windowsマルウェアを解析するための概念、ツール、テクニックを探る
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
6章マルウェアのデバッグ
デバッグ（Debugging）は、制御された環境で攻撃コードを実行する手法です。デバッガは、攻撃コードを、より詳細なレベルで検査する機能を提供します。マルウェア実行時の動作を完全に制御し、マルウェアのすべてのアクションを1つずつ調査しながら、単一もしくは複数の命令を実行したり、（プログラム全体を実行する代わりに）特定の関数のみを選択して実行することができます。
この章では、IDA Pro（市販の逆アセンブラ/デバッガ）、およびx64dbg（オープンソースのx32/x64デバッガ）が提供する機能について学びます。デバッガが提供する機能、そしてプログラム実行中の挙動を分析する手法を学習します。マルウェアを分析するため、予算に応じて複数のデバッガを組み合わせることもできます。マルウェアをデバッグする時は、システム上で攻撃コードを実行するため、適切な注意を払う必要があります。そのため、隔離された解析環境で、デバッグを実行することを強くお勧めします（詳しくは、1章を参照してください）。この章の最後では、.NET用のデコンパイラ兼デバッガであるdnSpy（https://github.com/0xd4d/dnSpy）を利用して、.NETアプリケーションをデバッグする手法についても説明します。
 |
その他、一般的な逆アセンブラ兼デバッガとして、以下が挙げられます。
|
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.