Download links

Please revert your VM to a clean shapshot, then download and install the following programs

• CFF Explorer

• pe_unmapper

• Python 3 latest version, installation will be shown in video

• Speakeasy, installation will be shown in video

The following program is optional in case you want to pack a program yourself:

• WinUpack

Create a snapshot of your machine after installation

API documentation

Use the documentation of Microsoft to understand Windows APIs that you encounter during API logging or in PE imports. We will look at the following functions during the lab:

• RtlDecompressBuffer

• VirtualAlloc

• VirtualProtect

• FindResourceW

• LoadResource

• SizeOfResource

• LoadLibraryA

• GetProcAddress

And the following instructions:

• pushad

• popad