Pindemonium - A DBI-Based Generic Unpacker for Windows Executable

This course aims to teach learners how to utilize dynamic binary instrumentation (DBI) to unpack and analyze obfuscated Windows executable malware samples efficiently. By exploring the functionality of a DBI framework, students will learn how to extract and reconstruct the original program from a packed version, speeding up the analysis process. The course covers designing a generic unpacking algorithm to detect common behaviors of packers and defeat popular packing techniques, including Import Address Table (IAT) obfuscation. Through practical experiments, students will validate the effectiveness of the unpacking process against various packers and malware samples. The intended audience for this course includes cybersecurity professionals, malware analysts, and individuals interested in reverse engineering and cybersecurity research.