[ConcernedCitizen]

+1 for Ghidra.
Although I'm pretty sure I don't use it at its full potential..
Any Ghidra tutorial/doc to recommend maybe?

You can watch tutorials that are easier to follow on YouTube than reading the documentation on the website.
https://youtu.be/d4Pgi5XML8E
https://youtu.be/fTGTnrgjuGA

[Bricker]

+1 for Ghidra.
Although I'm pretty sure I don't use it at its full potential..

That's kinda how I feel about Cutter. I initially went with it because it's basically a suite of suites and uses Ghidra. But there's so many tools included, the learning curve is pretty steep so I'm definitely not using it to it's fullest.

Hopefully Ghidra will be a little easier to pick up.

[fritz]

+1 for Ghidra.
Although I'm pretty sure I don't use it at its full potential..
Any Ghidra tutorial/doc to recommend maybe?

You can watch tutorials that are easier to follow on YouTube than reading the documentation on the website.
https://youtu.be/d4Pgi5XML8E
https://youtu.be/fTGTnrgjuGA

Those yt tutorials look pretty good, thanks for the recommendation!

[ConcernedCitizen]

+1 for Ghidra.
Although I'm pretty sure I don't use it at its full potential..
Any Ghidra tutorial/doc to recommend maybe?

You can watch tutorials that are easier to follow on YouTube than reading the documentation on the website.
https://youtu.be/d4Pgi5XML8E
https://youtu.be/fTGTnrgjuGA

Those yt tutorials look pretty good, thanks for the recommendation!

John Hammond has great videos on reversing actual malware and discovering new things.
https://youtu.be/tMN5N5oid2c
https://youtu.be/aCWI61QX1OU

[Bricker]

You can watch tutorials that are easier to follow on YouTube than reading the documentation on the website.
https://youtu.be/d4Pgi5XML8E
https://youtu.be/fTGTnrgjuGA

Those yt tutorials look pretty good, thanks for the recommendation!

John Hammond has great videos on reversing actual malware and discovering new things.
https://youtu.be/tMN5N5oid2c
https://youtu.be/aCWI61QX1OU

Love his stuff. Kinda sucks most of his malware analysis ones are pretty much the same procedure every time though. Deobfuscate initial js code, decode big long encoded string, reverse resulting string, find it's a PS script to download some other encoded string payload, so on. Still pretty interesting to watch regardless.

[ConcernedCitizen]

Love his stuff. Kinda sucks most of his malware analysis ones are pretty much the same procedure every time though. Deobfuscate initial js code, decode big long encoded string, reverse resulting string, find it's a PS script to download some other encoded string payload, so on. Still pretty interesting to watch regardless.

He does explain things very well. Quality over quantity. It's less about theory and more about results. If you want to talk about more technical and involved reversing refer to the guys & gals at Metasploit or people like Slava Moskvin.

Hammond does a lot of the same thing for sure, I agree. This kinda feels annoying at first:

Code:

import sys shell = bytearray(     [         0x00,         0x00,         0x00,     ] ) sys.stdout.buffer.write()

But it gets better and better. When I learned how to deobfuscate it was in a class setting not on a large monitor and not using easy techniques like this. It's nice to learn to love new things.