Assignment 5: Questions, challenges, and programs demonstrating the following (due in 1 week) Setup a VM to use for analyzing malware What features do you need to disable to ensure that the malware cannot Cause damage Propagate Detect it is running on a VM Set it up so you can quickly restore it to a pristine state after the analysis Write a simple virus that infects executables Example: Change the functionality of a binary to print “I am a virus” along with its normal output” The metasploit framework includes scripts that generate and encode shellcode http://downloads.metasploit.com/data/releases/framework-latest.tar.bz2 msfpayload generates payloads msfencode by default uses the x86/shikata_ga_na encodes More encoders in directory modules/encoders/ Can you embed and invoke shellcode from a program? Can you obtain the original shellcode by single-stepping through the encoder? Setup a challenge where you have to pack and unpack binaries Automatically, using a well-known packer and tools Manually, by using a debugger to step through the unpacking process and extract the actual code Feel free to google for programming and analysis challenges Don’t get infected