دوره Windows Malware Development

Course Overview and Objectives
Understanding Ethical Malware Development
Setting Up a Safe Development & Testing Environment (VMs, Debugging Tools)
Required Tools: MinGW, Visual Studio, OllyDbg, x64dbg, IDA Pro, PE-Bear, SysInternals Suite
Introduction to Windows Internals and PE Structure Basics

Windows Architecture Overview
User Mode vs. Kernel Mode
Processes, Threads, and Memory Management
Windows API Basics: Kernel32.dll, Ntdll.dll, Advapi32.dll
Interacting with System Resources (Files, Registry, Processes, Services)
Process Injection: Basics and API Familiarization

Introduction to C and Its Relevance in Malware Development
Memory Management & Pointer Manipulation
Working with Windows API in C
Assembly Fundamentals: x86/x64 Registers and Instructions
Understanding Stack Structure (Call Stack, Stack Frames, Stack Pointers)
Function Calls and Stack Frames
Local Variables and Stack Allocation
Introduction to Python and Its Relevance in Malware Development
Inline Assembly and Mixing C with ASM
Execute Assembly in Python Codes

Understanding Shellcode Structure and Execution Flow
Writing Position-Independent Shellcode in Assembly
Encoding and Encrypting Shellcode (XOR, AES, Base64, RC4)
Simple Process Injection with Shellcode

Introduction to Process Injection
CreateRemoteThread Injection
NtCreateThreadEx Injection
SetThreadContext & GetThreadContext Injection
QueueUserAPC Injection
Suspend & Hijack Thread Injection
DLL Injection (Manual Mapping, Reflective DLL Loading, PE Injection)
Process Hollowing & Doppelgänging
Atom Bombing
Heaven’s Gate (Switching between x86 & x64 execution)
Early Bird & Transacted Hollowing
InDirect & Direct Syscalls and Unhooking NTDLL

Registry-Based Persistence (Run Keys, Image File Execution Options Hijacking)
Windows Services and Scheduled Task Persistence
AppInit_DLLs, and DLL Search Order Hijacking
Process Injection into System Processes for Long-Term Persistence
Privilege Escalation Techniques:
Token Stealing
UAC Bypass Techniques
Abusing TrustedInstaller Privileges
Exploiting Misconfigured Services

AV & EDR Internals
Static Analysis Evasion
Dynamic Analysis Evasion
Bypassing Sandboxes
In-Memory Execution and Fileless Malware Techniques

Reverse Engineering Popular Malware Samples
Techniques Used in APT Attacks
Analyzing and Bypassing Advanced Threat Defense Mechanisms
Building Custom Evasion and Obfuscation Strategies