Discover gists

List of resources for malware analysts

Books

Monappa K.A., "Learning Malware Analysis: Explore the concepts, tools, and techniques to analyze and investigate Windows malware" amazon.
Sikorski M., Honig A., "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software" amazon.
Ferrie P., "The "Ultimate" Anti-Debugging Reference" [free](https://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf

Assembly Language / Reversing / Malware Analysis / Game Hacking -resources

⭐Assembly Language

Modern x64 Assembly

https://www.youtube.com/playlist?list=PLKK11Ligqitg9MOX3-0tFT1Rmh3uJp7kA

Proxmox Assign Bind Mount To Unprivileged Container

In order for the LXC container to have full access the proxmox host directory, a subgid is set as owner of a host directory, and an ACL is used to ensure permissions.

Bind Mount dataset to LXC

Add the following line to /etc/pve/lxc/<CT_ID>.conf

mp0:/mount/point/on/host,mp=/mount/point/on/lxc

OR

pct set 100 -mp0 /mnt/bindmounts/shared,mp=/shared

	{
	// =================
	// VIM CONFIGURATION
	// =================

	"editor.lineNumbers": "relative",
	"editor.cursorSurroundingLines": 8,
	"terminal.integrated.cursorBlinking": false,
	"editor.cursorBlinking": "solid",

	[{
	"id": 99,

	"account": {
	"first": "First",
	"middle": "",
	"last": "Last",
	"email": "email@addr.tld",
	"email_verified_at": {
	"$date": "2022-01-04T23:49:25"

	let widget = await createWidget();
	if (!config.runsInWidget) {
	await widget.presentSmall();
	}

	Script.setWidget(widget);
	Script.complete();

	async function createWidget(items) {

	{
	// Commented-out options have their default values.
	"include": ["src/*/"],
	"exclude": ["node_modules/*"],
	// "files": [], // A list of relative or absolute file paths to include.
	// "extends": "", // A string containing a path to another configuration file to inherit from.
	// "references": [], // An array of objects `{"path": "./to/dirOrConfig"}` that specifies projects to reference.
	// "compileOnSave": false, // Signals to the IDE to generate all files for a given tsconfig.json upon saving.

	"compilerOptions": {

	{#
	/**
	* @file
	* Theme override of a container used to wrap child elements.
	*
	* Used for grouped form items. Can also be used as a theme wrapper for any
	* renderable element, to surround it with a <div> and HTML attributes.
	* See \Drupal\Core\Render\Element\RenderElement for more
	* information on the #theme_wrappers render array property, and
	* \Drupal\Core\Render\Element\container for usage of the container render

	<#
	Correct the default UEFI partition layout created by ConfigMgr to save some disk space.

	https://docs.microsoft.com/de-de/windows-hardware/manufacture/desktop/configure-uefigpt-based-hard-drive-partitions

	## Notes:

	* The recovery partition size for Windows 10 1703 needs to be at least 900 MB or the partition will ignored.
	* Windows 10 1511 Winre.wim size: 313.009.179 Bytes
	* Windows 10 1607 Winre.wim size: 324.995.101 Bytes

	rem == CreatePartitions-UEFI.txt ==
	rem == These commands are used with DiskPart to
	rem create five partitions
	rem for a UEFI/GPT-based PC.
	rem Adjust the partition sizes to fill the drive
	rem as necessary. ==
	select disk 0
	clean
	convert gpt
	rem == 1. Windows RE tools partition ===============