-
Book Overview & Buying
-
Table Of Contents
Ghidra Software Reverse-Engineering for Beginners - Second Edition
By :
In this chapter, we’ll introduce reverse-engineering malware using Ghidra. By using Ghidra, you’ll be able to analyze executable binary files containing malicious code.
This chapter is a great opportunity for you to put the knowledge you acquired during Chapter 1, Getting Started with Ghidra, and Chapter 2, Automating RE Tasks with Ghidra Scripts, about Ghidra’s features and capabilities into practice. To do so, we’ll analyze the Alina Point of Sale (PoS) malware. This malware scrapes the RAM of PoS systems to steal credit and debit card information.
We’ll start by setting up a safe analysis environment. Then, we’ll look for malware indicators in the malware sample. We’ll conclude by performing an in-depth malware analysis using Ghidra.
In this chapter, we’re going to cover the following main topics: