Reply to thread

Message

<blockquote data-quote="hunter44" data-source="post: 977661" data-attributes="member: 94311">I decided to raise the topic, because I have few questions regarding RE of malware.1. I&#039;m using IDA (free) - what is best way to find main function in deassembled code? Is it even possible? I read about FLIRT signature, but I&#039;m not sure how to use it and even if it works as I want. With huge code it is very difficult to find main function of the program. I try to analyze function by function with all info (like strings, methods, etc.) I found during file static analyze. But in the end, I think I&#039;m a little bit stuck, because I can anlyze multiple functions but cannot find conclusion - where they are used, how the flow looks like?2. What is the best approach to analyze code statically? What are your tips and tricks to get as much information as you can?3. What should be the main goal when RE malware? Do we need only to find out what functionality malware has or there is always a specific goal (except how it works)? What should I look and what to search from start to the end to have a view on whole functionality?</blockquote>

[QUOTE="hunter44, post: 977661, member: 94311"] I decided to raise the topic, because I have few questions regarding RE of malware. 1. I'm using IDA (free) - what is best way to find main function in deassembled code? Is it even possible? I read about FLIRT signature, but I'm not sure how to use it and even if it works as I want. With huge code it is very difficult to find main function of the program. I try to analyze function by function with all info (like strings, methods, etc.) I found during file static analyze. But in the end, I think I'm a little bit stuck, because I can anlyze multiple functions but cannot find conclusion - where they are used, how the flow looks like? 2. What is the best approach to analyze code statically? What are your tips and tricks to get as much information as you can? 3. What should be the main goal when RE malware? Do we need only to find out what functionality malware has or there is always a specific goal (except how it works)? What should I look and what to search from start to the end to have a view on whole functionality? [/QUOTE]

Verification