Windows Malware Analysis Essentials

Sharpening the scalpel

The regular disassembler is a static analysis software tool that performs many different processes and extracts information out of a binary executable. It parses the binary executable, takes apart the individual sections, and presents a list of annotated assembly code from the binary string of opcodes embedded inside the executable.

Additional embellishments arrange relevant data such as symbolic function and variable names (if present), stack frames and variable lists, common data structures, strings, and import and export function jump lists. There are two primary algorithms that are implemented in a disassembler:

• Linear Sweep (Windbg, Win32Dasm, Sourcer)
• Recursive Traversal (OllyDbg, IDA Pro)

Linear sweep processes a binary ...