INTERMEDIATE TO ADVANCED

⏱ 20+ WEEKS

100 MODULES

Windows Malware Development

Understand modern offensive tooling by building it

You cannot reliably detect or evade what you do not understand at the implementation level. This course builds Windows offensive tooling from first principles: PE format, memory management, injection, syscalls, and the anti-analysis techniques real samples use. It is aimed at red teamers who need tooling that survives contact with modern defences, and at analysts who want to understand samples from the author's side rather than only the disassembler's. All work is for authorised red team use and defensive research, in isolated lab environments.

📦

100

Modules

⏱

20+

weeks

📋

32

Units

🎯

128

Topics

👤Who this is for

→Red teamers whose off-the-shelf tooling keeps getting caught
→Malware analysts who want to understand samples from the build side
→Detection engineers who need to know what they are writing signatures against
→Offensive security researchers building custom capability

⚡Prerequisites

•Solid C or C++ programming ability

•Working knowledge of Windows internals

•Comfortable with a debugger

•An isolated lab environment you control

Curriculum

32 units · 128 topics · 20+ weeks

UNIT 01

Introduction to malware development

✦Course objectives and legal context

✦Lab environment setup (isolated VMs)

✦Development toolchain (Visual Studio, compilers)

✦Debugging fundamentals with x64dbg and WinDbg

UNIT 02

Windows internals: processes and threads

✦Process creation and the PEB

✦Thread architecture and TEB

✦Process and thread enumeration

✦Handle table internals

UNIT 03

Windows internals: memory management

✦Virtual memory and page tables

✦VirtualAlloc, VirtualProtect, and memory regions

✦Heap management and allocators

✦Memory-mapped files and sections

UNIT 04

Windows internals: kernel objects

✦Handles, tokens, and security descriptors

✦Access control and privilege model

✦Object manager internals

✦Interacting with the kernel from user mode

UNIT 05

The Windows API surface

✦Win32 API categories and documentation

✦NTAPI vs Win32 API

✦API resolution and GetProcAddress

✦Dynamic API loading patterns

UNIT 06

PE format fundamentals

✦DOS header and PE signature

✦COFF and optional header fields

✦Section table and section alignment

✦Rich header analysis

UNIT 07

PE format: imports and exports

✦Import Address Table (IAT)

✦Import Name Table and thunking

✦Export directory and ordinal resolution

✦Delayed imports and API sets

UNIT 08

PE format: relocations and resources

✦Base relocation table processing

✦Position-independent code principles

✦Resource directory structure

✦Embedding and extracting PE resources

UNIT 09

DLL internals

✦DLL loading with LoadLibrary

✦DllMain entry points and thread notifications

✦DLL search order and hijacking

✦DLL proxying and forwarding

UNIT 10

Shellcode fundamentals

✦Position-independent shellcode design

✦Avoiding null bytes and bad characters

✦Shellcode encoding techniques

✦Custom shellcode from scratch in assembly

UNIT 11

Payload encryption: XOR and RC4

✦XOR encryption and brute-force concerns

✦Multi-byte XOR key generation

✦RC4 stream cipher implementation

✦Encrypting and decrypting payloads at runtime

UNIT 12

Payload encryption: AES

✦AES-256 CBC implementation with CNG

✦Key derivation and IV management

✦Encrypting shellcode for staged delivery

✦Decryption stubs and in-memory execution

UNIT 13

String obfuscation and entropy

✦Compile-time string encryption

✦Stack string construction

✦API hashing (djb2, CRC32, custom)

✦Entropy analysis and management

UNIT 14

Payload staging and delivery

✦Staged vs stageless payloads

✦HTTP/S payload download and execution

✦UUID and MAC address shellcode smuggling

✦Payload retrieval from alternate sources

UNIT 15

Process injection: classic techniques

✦VirtualAllocEx + WriteProcessMemory + CreateRemoteThread

✦Target process selection and access rights

✦Shellcode injection walkthrough

✦Detection indicators of classic injection

UNIT 16

Process injection: thread hijacking

✦Suspending and modifying thread context

✦SetThreadContext for execution redirection

✦NtQueueApcThread and user APC injection

✦Early bird APC injection

UNIT 17

Process injection: advanced methods

✦Process hollowing (RunPE)

✦Process Doppelgänging with transacted files

✦Process herpaderping

✦Module stomping and phantom DLL loading

UNIT 18

DLL injection techniques

✦Classic DLL injection with LoadLibrary

✦Reflective DLL injection

✦Manual mapping from memory

✦sRDI (shellcode Reflective DLL Injection)

UNIT 19

Callback-based execution

✦EnumWindows and timer callbacks

✦Fiber-based execution

✦Thread pool callbacks (TpAllocWork)

✦Vectored exception handler abuse

UNIT 20

Direct syscalls

✦System call architecture on Windows

✦Syscall stub structure and SSN resolution

✦Implementing direct syscalls in C/ASM

✦SysWhispers and Hell's Gate techniques

UNIT 21

Indirect syscalls

✦Why indirect syscalls evade call-stack analysis

✦Implementing indirect syscall stubs

✦Combining with API hashing

✦Tartarus' Gate and Halo's Gate variants

UNIT 22

Unhooking ntdll

✦Understanding userland API hooking by EDRs

✦Reading clean ntdll from disk

✦Remapping ntdll from KnownDlls

✦Perun's Fart and fresh-copy techniques

UNIT 23

ETW and AMSI bypass

✦Event Tracing for Windows architecture

✦Patching ETW for evasion

✦AMSI scanning internals

✦AMSI bypass techniques and patch points

UNIT 24

Anti-debugging techniques

✦IsDebuggerPresent and PEB flags

✦NtQueryInformationProcess debug checks

✦Timing-based anti-debug (RDTSC, GetTickCount)

✦Hardware breakpoint detection

UNIT 25

Anti-VM and sandbox detection

✦Registry and file system VM indicators

✦CPUID and hypervisor detection

✦MAC address and hardware fingerprinting

✦User interaction checks (mouse movement, clicks)

UNIT 26

Timing-based evasion

✦Sleep obfuscation with Ekko and Foliage

✦Delayed execution to bypass sandboxes

✦Encrypting memory during sleep

✦Fluctuating thread stack spoofing

UNIT 27

Persistence mechanisms

✦Registry Run key persistence

✦Scheduled task persistence

✦COM object hijacking

✦WMI event subscription persistence

UNIT 28

Rootkit fundamentals

✦User-mode rootkit concepts

✦IAT and inline hooking

✦DKOM (Direct Kernel Object Manipulation) overview

✦Hiding processes and network connections

UNIT 29

Building a complete loader

✦Architecture of a production loader

✦Combining encryption, injection, and evasion

✦Staged loading with multiple layers

✦Error handling and operational security

UNIT 30

C2 communication basics

✦HTTP/S C2 communication channels

✦Domain fronting concepts

✦Named pipe and SMB channels

✦Sleep and jitter for traffic blending

UNIT 31

Detection engineering perspective

✦Understanding EDR telemetry sources

✦ETW providers relevant to malware

✦Writing YARA rules for your own tooling

✦Mapping techniques to MITRE ATT&CK

UNIT 32

Capstone: red team tooling project

✦Designing a custom implant from scratch

✦Integrating all course techniques

✦Testing against AV/EDR in an isolated lab

✦Code review, documentation, and OPSEC analysis

What you will be able to do

1Develop custom Windows shellcode loaders from scratch in C/C++

2Bypass common EDR and AV solutions using syscall-level techniques

3Understand Windows internals at the depth required for offensive tooling

4Build and test red team tooling in isolated lab environments

5Implement multiple process injection and evasion techniques

6Analyse the detection footprint of offensive techniques from a defender's perspective

🛠 Tools you will use

C/C++Visual StudioIDA ProGhidrax64dbgWinDbgPEViewProcess MonitorAPI Monitor

🏆 Certification pathways

This course builds directly toward:

CRTOCRTECRTL

Frequently asked questions

Is this course teaching me to write real malware?

It teaches the same techniques real malware uses, applied in isolated lab environments for authorised red team and defensive research purposes. Understanding how offensive tooling works at the implementation level is essential for both building red team capability and writing effective detections. All work stays in environments you control.

How strong does my C/C++ need to be?

You should be comfortable writing and debugging C programs that use pointers, structs, and the Windows API. The course does not teach C from scratch. If you can write a program that opens a file handle, reads memory, and handles errors, you are ready.

Will my payloads bypass current EDR products?

Some techniques will, some will not, and that changes over time. The course teaches the principles behind evasion so you can adapt, not a set of signatures that expire. Detection footprint is discussed alongside every technique so you understand both sides.

Why is this course 100 modules and 20+ weeks?

Because building offensive tooling from first principles requires covering Windows internals, PE format, multiple injection techniques, syscalls, anti-analysis, and operational considerations in genuine depth. Each module is practical, and cutting content would mean teaching surface-level awareness rather than implementation-ready skill. The length reflects the reality of the subject.

What lab setup do I need?

An isolated virtual lab with at least two VMs: a Windows development machine with Visual Studio and debugging tools, and a Windows target machine with optional AV/EDR for testing. 32 GB RAM recommended for running multiple VMs. All development and testing must stay in environments you control.

Is prior reverse engineering experience required?

Not required but helpful. The course covers PE format and debugging from the ground up. If you can read disassembly at a basic level and have used a debugger before, that helps. If not, the early units build that foundation before moving to injection and evasion techniques.

Can I use these skills defensively?

Absolutely. Every technique is taught alongside its detection footprint. The detection engineering unit covers ETW telemetry, YARA rules, and MITRE ATT&CK mapping. Many students take the course specifically to improve their blue team capability by understanding offensive tooling at the implementation level.

Interested in this training?

Reach out to discuss scheduling, format, and pricing. Corporate and group rates available.

Get in touch →View all courses

Other courses

Ethical Hacking

16 weeks · 40 modules

Learn to think like an attacker, then prove it in a report

Windows Privilege Escalation

4 weeks · 20 modules

Turn a low-privilege foothold into SYSTEM

Digital Forensics

12 weeks · 19 modules

Reconstruct what happened, in a way that holds up