1. Assignment 5: Questions, challenges, and programs demonstrating the following (due in 1 week)
Setup a VM to use for analyzing malware
What features do you need to disable to ensure that the malware cannot
Cause damage
Propagate
Detect it is running on a VM
Set it up so you can quickly restore it to a pristine state after the analysis
Write a simple virus that infects executables
Example: Change the functionality of a binary to print “I am a virus” along with its normal output”
The metasploit framework includes scripts that generate and encode shellcode
msfpayload generates payloads
msfencode by default uses the x86/shikata_ga_na encodes
More encoders in directory modules/encoders/
Can you embed and invoke shellcode from a program?
Can you obtain the original shellcode by single-stepping through the encoder?
Setup a challenge where you have to pack and unpack binaries
Automatically, using a well-known packer and tools
Manually, by using a debugger to step through the unpacking process and extract the actual code
Feel free to google for programming and analysis challenges
Don’t get infected