Skip to content

> guided learning path

Malware development: the learning path

A progressive course in malware internals: foundations, architecture, operating systems, configuration, communications, persistence, injection, evasion, capabilities, and engineering. Work through explanations, inert models, source studies, and exercises.

Start learning →
0 / 22 completed

Progress is saved in this browser.

  1. Module 01 · 3 lessons

    Foundations

    Follow program flow and learn to read real malware source.

    1. 1.1Program flow: from entry point to behaviorTrace execution through initialization, a decision, a handler, and cleanup before studying individual malware mechanisms.
    2. 1.2Reading Mirai source: a string comparison trapRead a real comparison helper and explain how its return convention affects a caller’s branch.
    3. 1.3Languages, platforms, and executable artifactsSeparate source language, executable format, processor architecture, and runtime dependencies when explaining a malware implementation.

  2. Module 02 · 2 lessons

    Program architecture

    Understand how internal handlers are selected and organized.

    1. 2.1Malware architecture: command dispatch tablesMap command identifiers to handlers and trace known and unknown inputs through a function-pointer table.
    2. 2.2Lifecycle: initialization, state, and failure pathsModel lifecycle transitions and explain why a selected operation, a completed operation, and a failed operation are different states.

  3. Module 03 · 4 lessons

    Memory and operating systems

    Connect processes, threads, memory, executable formats, and API boundaries.

    1. 3.1Processes, threads, and memory ownershipExplain address-space ownership, thread execution, and why an address alone is insufficient to describe a memory operation.
    2. 3.2APIs, libraries, and security contextDistinguish a library dependency, an API call, and a successful privileged operation when reading an implementation.
    3. 3.3Platform abstractions: shared logic and native backendsIdentify which behavior belongs to shared program logic and which depends on Windows, Linux, or macOS interfaces.
    4. 3.4User mode, kernel components, and rootkit claimsDistinguish execution privilege, component type, and concealment behavior when examining kernel-related malware claims.

  4. Module 04 · 1 Lesson

    Configuration and data

    Separate settings, serialized data, encoding, and cryptographic claims.

    1. 4.1Configuration, serialization, and encodingSeparate configuration from behavior and distinguish an encoding transformation from confidentiality or authenticity.

  5. Module 05 · 2 lessons

    Commands and communications

    Read protocol boundaries, message state, and data movement.

    1. 5.1Messages, protocols, and data movementSeparate transport, message structure, command selection, collection, and transfer when studying communications code.
    2. 5.2Botnet architecture: topology, roles, and coordinationSeparate communication topology, message authority, and endpoint behavior using a static graph model.

  6. Module 06 · 1 Lesson

    Persistence and execution

    Distinguish an execution trigger, a stored artifact, and its security context.

    1. 6.1Persistence: triggers, artifacts, and lifecycleExplain persistence as a relationship between a retained artifact, a future trigger, and execution context rather than a single installation action.

  7. Module 07 · 1 Lesson

    Process boundaries and injection

    Understand execution location and the evidence needed to identify injection.

    1. 7.1Process injection and execution contextDistinguish cross-process access from execution in another process and state what evidence supports an injection claim.

  8. Module 08 · 2 lessons

    Environment checks and obfuscation

    Understand conditional behavior, packing, and the limits of environment signals.

    1. 8.1Anti-Debugging: IsDebuggerPresent (Windows)Explain how a debugger-presence check influences control flow and distinguish that signal from evidence of malicious behavior.
    2. 8.2Environment signals, obfuscation, and packingSeparate an environment observation from a control-flow decision, and distinguish transformed bytes from the behavior they may represent.

  9. Module 09 · 3 lessons

    Collection, credentials, and impact

    Study capability boundaries, credential lifecycles, ransomware, and data loss.

    1. 9.1Credential access, discovery, and capability boundariesExplain credential-related capabilities by separating access, representation, use, and outcome, without confusing discovery with privilege gain.
    2. 9.2Privilege escalation and lateral movement boundariesDistinguish a change in permissions from a change in execution location and explain the evidence required for each.
    3. 9.3Ransomware: data lifecycle, keys, and impactExplain ransomware-related implementation boundaries and distinguish changed data, encryption claims, recoverability, and confirmed impact.

  10. Module 10 · 3 lessons

    Builds, testing, and source studies

    Connect build artifacts to source, test inert models, and complete a capstone.

    1. 10.1Builds, packaging, and component boundariesConnect source revisions, build choices, packaged components, and execution roles without treating a repository as a single executable.
    2. 10.2Testing inert models and interpreting observationsTest a local behavioral model and distinguish expected outcomes, observed outcomes, and untested assumptions.
    3. 10.3Capstone: explain a component from source to behaviorProduce an evidence-based component study connecting source, control flow, state, platform assumptions, and observed behavior.