Using EDB for dynamic analysis

While working through static analysis, we determined that this binary is indeed malicious, but we also saw how much mental work we needed to get to that point. Using a debugger, especially one with a GUI, can speed up that manual process a bit by giving us a visual indication of changes to the stack, the registers, and so on.

In this recipe, we'll work with EDB to analyze the polymorphed reverse shell binary, which should help us visualize and understand the impacts of polymorphism better.

Getting ready

To work on this recipe, make sure VirtualBox is started and that you're using the 64-bit Ubuntu virtual machine we configured in Chapter 1, Setting up the Lab. Once the virtual machine...