Advanced Reverse Engineering Malware


Way more than theories. Get into our reversing lab and experience the most in-depth,hands-on advanced-level malware reversing course in the industry!

Advanced Reverse Engineering Course Overview



Already have experience reverse engineering? Need to take your reversing skills to the next level? InfoSec Institute's Advanced Reverse Engineering Reverse Malware course is the most in-depth,hands-on advanced-level malware reversing course in the industry! 

In Advanced Reverse Engineering Malware, you will learn all of the latest techniques for reversing malware:

  • Learn to reverse malware that utilizes multiple overlapping obfuscation techniques in both user and kernel space.

  • Gain hands-on training for reversing binary and/or obfuscated Command and Control (C&C)communication protocols.

  • Train on the various specialized tools and IDA plugins that make reversing complex malware possible.

Because modern malware makes use of sophisticated obfuscation techniques, you need to havespecific reversing skills in the deconstruction of various x86 assembler obfuscation tricks used by malware in order to be an expert malware reverser. This four day course bridges the gap between reversing "vanilla" compiler generated code and the nontrivial, complex code created by expert malware authors.

Modern malware typically is developed with some measure of Command and Control (C&C) communication capabilities. The C&C protocol can used to maintain a botnet, deliver package updates, send commands, and steal data from compromised machines. Understanding and reversing the underlying C&C protocol is essential to understanding the intention, functionality, and potentially the identity of the malware author. In the Advanced Reverse Engineering Malware course, you will learn how to reverse these C&C protocols from live malware examples that are currently in circulation.

Reversing obfuscated malware in some cases must be done programmatically. This requires you to understand how to use specialized plugins for IDA as well as other malware-specific tools in order to de-obsfucate various portions of the code under analysis. In other cases, hours or days of manual work can be saved by learning the proper use of a specific reversing tool. InfoSec Institute will teach you how to use these important tools in a series of hands-on labs during this course.


  • Gain the in-demand career skills of a reverse engineer. Very few information security professionals, incident response analysts and vulnerability researchers have the ability to reverse malware efficiently. You will undoubtedly be at the top of your professional field.

  • Learn the methodologies, tools, and manual malware reversing techniques used real world situations in our reversing lab.

  • Move beyond automated "sandbox" testing of malware.

  • More than interesting theories and lecture, get your hands dirty in our dedicated reversing lab in this security training course.





Learn from Advanced Reversing Experts:
All of the instructors for InfoSec Institute's Advanced Reverse Engineering Malware course active work in the field of reverse engineering or security research.

Our instructors have spoken at high-profile conferences (such as the Black Hat Briefings, the RSA Security Conference, and the Pentagon Security Forum) and industry events.

Other Reverse Engineering Courses

Advanced Reverse Engineering

Reverse Engineering Android

  • 91% Pass Rate
  • Top Reversing Certification Course
  • On-site exam proctoring
  • FREE Custom Reverse Tools Suite(details)
"Great instructor - thoroughly covered all topics with expertise. He focused our attention to the pertinent information. ... a great experience"

Jeremy J. Pearson,
Joint Staff, Pentagon

What You'll LEARN & DO

Some of the reverse engineering concepts you will learn to master during this course...

  • IDA configuration for programmatic reversing and script writing
  • IDA Plugin architecture and setup
  • The Windows Kernel
  • Understanding the Kernel API used by malware authors
  • Overview of common rootkit technologies
  • Using WinDBG for kernel debugging
  • PE Anti-reversing techniques: De-obfuscating executables for IDA
  • Obfuscation: User-mode obfuscation methods
  • Anti-RE Techniques: Detecting debuggers, virtual machines, and other tricks
  • Kernel assisted obfuscation
  • Understanding rootkit process / DLL injection
  • Understanding rootkit process / DLL injection
  • Reversing kernel-mode botnet bots

  • Study of Metasploit's Shikata-ga-nai
  • Automated unpacking systems
  • Utilizing Saffron and Ether
  • Analyzing physical memory with memoryze
  • Identifying common algorithms inside worms
  • Virtual Machine based packers
  • Reversing Themida and other VM packers
  • Reversing mangled UPX and other compression types
  • Protocol Reversing (Reversing Storm's usermode code)
  • Reverse storm's C&C protocol
  • Reversing .NET byte code
  • CEREA Review

Dates & Locations

The best in the world come train with us

See what our students are saying

  • David P. Curly

    Senior Consultant

    Booz Allen Hamilton

    "a must for any true
    security professional"

    "This was a phenomenal class! The instructor was extremely knowledgeable and crafted the exercises so that we truly learned the material. I have a whole new appreciation for how vulnerabilities are exploited. I have gained very practical skills and knowledge in this class which will help me tremendously in my job. I will highly recommend this course to all of my co-workers. This class should be a must for any true security professional. There were several moments during the week when I was amazed at how vulnerable systems truly are. The practical labs and competition teams made the experience fun. I have learned some extremely valuable skills."

    Find out more
  • "hands on lab exercises was the most enjoyable part"

    "Instructor was very knowledgeable and was able to explain a huge amount of information in a very short period of time. The course was very informative; doing the hands on lab exercises was the most enjoyable part of the course, as I found it to be the best way to learn."

    Find out more
  • "nice to have a dedicated training laptop provided"

    "I got a lot out of the real world scenarios presented in class. Jeremy is very knowledgeable in the field of penetration testing. Would definitely take classes again if he is the instructor. The course books are a great reference, and it was nice to have a dedicated training laptop provided by Infosec and not have to bring my own and waste time installing programs during class"

    Find out more
  • Rummy Dabgotra

    MTS Allstream

    "invaluable to my career"

    "Dan is an excellent instructor and incredibly knowledgeable. Great presenter and very helpful. The course was very intense but well structured. The hours were long but it really allows you to get your head wrapped around it. Slide notes were very good as well as the lab pre-info. The labs tied well into the course. The content and knowledge gained will be invaluable to my career."

    Find out more

Certifications & Compliance

CEREA: Certified Expert Reverse Engineering Analyst

In any hands on reverse engineer training course, it is important to have the opportunity to prove to current or potential employers that you have the skills you say you do.

This course prepares you for the top reverse engineering certification in the industry, the CEREA. The exam is given on-site, InfoSec Institute has achieved a 91% pass rate for this certification.

Pricing for this Advanced Reverse Engineering Course


Call (866)-471-0059 or fill out this short form for current pricing


  • FREE tools and software!

    InfoSec Institute's Custom Reversing Tools Enterprise Suite, includes every program covered in the course for at home study. (119 Tools)

  • Course Materials, Test Fees and Class Guarantees!

    Small class size provides intimate learning setting not offered at any of our competitors.

    4 Days of Expert Reverse Engineering Malware Instruction from a senior instructor with real-world experience and deep knowledge of course content.

    All meals, snacks and refreshments included. Snacks not included in Las Vegas courses.

    Certified Expert Reverse Engineering Analyst (CEREA) exam fees.

    Lecture, Lab Exercise and Text book

Other Related Tools & Resources For Our Students

Be sure to check out our R&D site. We post tutorials, labs, white papers and articles to help you in your continued education. There are frequently forensics videos available. If you haven't taken a course with us yet, check out some of the types of thigns you'll be doing and learning about in class.

InfoSec Institute has an excellent instructor and this is the best IT security class I have ever taken. His knowledge and method of teaching are unsurpassed.