Skip to content

Instantly share code, notes, and snippets.

@Cur10s1tyByt3

Cur10s1tyByt3/MalDev_RoadMap.md

Last active April 6, 2025 13:15
Show Gist options
  • Save Cur10s1tyByt3/dc588ed536b79301417fa34719db7400 to your computer and use it in GitHub Desktop.
Save Cur10s1tyByt3/dc588ed536b79301417fa34719db7400 to your computer and use it in GitHub Desktop.
Download ZIP
MalDev RoadMap
Raw
MalDev_RoadMap.md

Malware Development RoadMap:

First off all, read this.

I would then highly recommend to learn the following things:

Win32 API

Networking (Communication over HTTP/s, DNS, ICMP)

Encryption (Basic usage of AES, XOR, RC4, etc.)

Injection Techniques

Reverse Engineering and how to use Debuggers.

Also, read the source code of already existing open source C2s like Metasploit Meterpreter, Empire Framework, Havoc Framework, Sliver, SharpC2, Shadow. These projects contain so much information and code on how to: make malware modular using reflective loaders/code injection, communicate with the C2, and more.

Malware Development Resources: (All credits goes to the respective owners)

Recommended to Read / Watch:

Books:

  • Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for Software Protection: Obfuscation, Watermarking, and Tamperproofing for Software Protection

  • Windows Native API Programming
    https://leanpub.com/windowsnativeapiprogramming

Tutorial Series:

X-Bypassing:

CLR

CFG / CFI:

Code/Process Injection Techniques:

Stack Spoofing:

PP / PPL / LSASS / LSA:

Direct Syscalls:

Indirect Syscalls:

Kernel:

Kernel Callbacks:

ETW:

Anti-Analysis & Anti-Debugging:

Anti-Anti-debugging:

Entropy Reduction:

PIPE, COM, WMI:

Coding

Misc (Hooking, Debugging and Stuff):

C2:

ASM:

PE File Format:

Kernel Debugging:

Windows Internals:

Token / Impersonation Stuff:

Heap:

Mal API:

Tools:

Microsoft Documentations:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment