Practical Malware Analysis AT DEF CON Trainings 2025
Scoreboard
·
Submit Flags
·
Details
Prepare a Windows VM
Recommended
PMA 41: Windows 10 or 11 with Analysis Tools
20
Alternative Local System
ED 32: Windows Virtual Machine
15 extra
Best Cloud System
PMA 60: Windows 10 on Azure Cloud
15 extra
Alternate Cloud System
PMA 30: Windows 2016 Server on Google Cloud
15 extra
Very Old, Not Recommended
H 2: Windows 2016 Server Virtual Machine
15 extra
Malware Analysis
PMA 101: Basic Static Techniques
20 + 30 extra
F 211: Memory Forensics of LastPass and Keeper
25 extra
PMA 110: capa
15 extra
PMA 221: Basic Dynamic Analysis
30 + 30 extra
PMA 222: Making a Windows Keylogger
10 extra
OT 130: MITRE ATT&CK Matrix for ICS
20 extra
PE Files and DLLs
PMA 105: Process Explorer
10
PMA 102: Unpacking
25
PMA 121: Unpacking with OllyDbg and pestudio
20 + 30 extra
PMA 122: PE Headers
10 + 40 extra
PMA 123: Importing DLLs
15 + 30 extra
PMA 124: DLL Hijacking
15
PMA 125: Installing Visual Studio
Not needed for Win 10 w Tools VM
10 extra
PMA 126: DLL Proxying
20
PMA 403: API Monitor
15 extra
Debugging
PMA 301: x86 Assembler with Jasmin
10 + 10 extra
PMA 340: Windows ARM Executable
15 extra
PMA 401. Simple EXE Hacking with Ollydbg
30 + 90 extra
PMA 402: Hacking Minesweeper with Ollydbg
15 + 30 extra
PMA 404: Adding Code to an EXE in a New Section
20 extra
Kernel Debugging
Not Recommended--Out of Date
PMA 410: Kernel Debugging with LiveKD
15
PMA 430: The New WinDbg
15
PMA 431: WinDbg: Source-Level Debugging
10
PMA 432: WinDbg Preview: Kernel Debugging
15 + 20 extra
PMA 433: Kernel Debugging with Breakpoints
30 extra
PMA 434: Debugging a Driver
30 extra
Bootkits
PMA 420: Bootkit Analysis with Bochs
15 extra
PMA 421: Understanding the MBR
70 extra
TPM 1: Trusted Platform Modules on Windows
15 extra
DOT NET
PMA 132: Reversing a .NET Executable
40 extra
ED 330: Using C# DOT NET
20 extra
ED 331: Dot Net Reflector
45 extra
PowerShell
U-Cen and U-Cyb: PowerShell
75 extra
Rust
R 10: Rust Basics, Overflows, & Injection
35 extra
R 20: Dangling Pointers & Memory Leaks in Rust
35 extra
Disassembly
PMA 303: IDA Pro
20 + 20 extra
PMA 304: C Constructs in Assembly
15
PMA 510: Starting with Ghidra
10 extra
PMA 511: Ghidra Data Displays
40 extra
Windows Memory Protections
ED 301: Windows Stack Protection I: Assembly Code
15 extra
ED 302: Windows Stack Protection II: Exploit Without ASLR
15 extra
ED 303: Windows Stack Protection III: Limitations of ASLR
15 extra
ED 310: Windows Mitigations
10 extra
H 540: RDP and Old Passwords
15 extra
Assembly Language
Don't submit these projects in Canvas; use the scoring system below
Enter Flags
·
Scoreboard
Prepare a Linux VM
ED 30: Linux Virtual Machine
15 extra
H 201: Google Cloud Linux Server
10 extra
ASM 100: Basics
69 extra
ASM 104: Bases & Printing
40 extra
ASM 105: ASCII
20 extra
ASM 110: Gdb
30 extra
ASM 120: Files
55 extra
ASM 200: Caesar Cipher
35 extra
ASM 210: XOR
20 extra
Scores archived 10-5-2021
Scores archived 10-11-2022
Scores archived 1-26-24
Scores archived 2-3-254
Virtual Machine Resources
Download Textbook Labs Here
Hypervisors
VMware Player (for Windows hosts, free)
VMware Fusion (for Mac hosts, 30-day trial)
VirtualBox (free for all platforms)
Updated 8-1-25