How abhisek/reverse-engineering-and-malware-analysis works
1. Repository purpose
- This is a static course-content repository for “Reverse Engineering and Malware Analysis 101.”
- There is no application backend, database, or runtime service; the repo is organized around documentation and downloadable training materials.
2. Top-level structure
- The repository has two main content branches:
- gitbook/: the primary written course material.
- presentations/: slide decks distributed as PDFs, with a placeholder for source PPTs.
- The root README.md acts as the landing page and points readers to those two branches.
3. GitBook documentation subsystem
- gitbook/README.md and gitbook/SUMMARY.md define the documentation site structure.
- The markdown chapters under gitbook/chapters/ are the source content for a GitBook-generated static site.
- The repo expects local generation via gitbook serve, which builds the docs from markdown and navigation metadata.
4. Course content organization
- The GitBook content is grouped into topic areas:
- assembly/: x86 assembly fundamentals.
- debugging/: Windows debugging and WinDbg content.
- malware_analysis/: dynamic analysis, memory dump analysis, and self-modifying code analysis.
- pe/: Portable Executable file format.
- windows/: Windows platform overview and API hooking.
- solutions/: worked examples and case-study writeups.
- This creates a clear separation between instructional chapters and applied analysis exercises.
5. Solutions / case-study layer
- The solutions/ chapter set is a distinct pedagogical layer that shows how the techniques are applied.
- It includes analyses such as crash dumps, file identification, malware anti-analysis, process injection, memory images, and Win32 API counting.
- For an architecture diagram, this is best treated as a practical lab/case-study subsystem connected to the theory chapters.
6. Presentation subsystem
- presentations/pdf/ contains standalone lecture slides in PDF format.
- These are separate deliverables from the GitBook docs and likely serve as in-class or offline materials.
- presentations/ppt/EMPTY indicates there is no preserved editable slide source in this repo, only the exported PDFs.
7. Asset handling
- assets/ contains shared media used by the documentation, such as the README hero image.
- Within the docs, images also live under gitbook/images/.
- These are supporting static assets only; they do not contain executable logic.
8. Content generation and consumption flow
- The main flow is: markdown chapters + summary/navigation + images → GitBook static site.
- Readers can consume the material either through:
- the generated GitBook site locally via gitbook serve, or
- the raw repository files and PDF slide decks directly from source control.
9. Boundary between source and deliverables
- The repository keeps source content and final teaching artifacts side by side:
- Markdown files are the editable source.
- PDFs are the finalized presentation output.
- This matters for diagramming because the repo is not an app pipeline; it is a content repository with published outputs.
10. Operational/runtime footprint
- The only documented tooling requirement is Node.js with gitbook-cli for local documentation serving.
- There are no external APIs, services, or infrastructure dependencies visible in the repo.
- Architecturally, this is a self-contained static educational knowledge base.
Main entry points: SUMMARY.md Summary · crash_dump_analysis.md Solutions · dynamic_malware_analysis.md Malware analysis · README.md README
Components 17
Repository root
Landing and repository-level metadata.
GitBook docs
Markdown chapters and navigation for the course site.
- Docs README · GitBook-specific entry point and local usage notes.
gitbook/README.md - Summary · GitBook navigation tree for the course chapters.
gitbook/SUMMARY.md - Assembly · x86 assembly fundamentals.
gitbook/chapters/assembly/x86_assembly.md - Debugging · Windows debugging and WinDbg material.
gitbook/chapters/debugging/windows-debugging-internals.md - WinDbg · Practical WinDbg reference content.
gitbook/chapters/debugging/rb_windbg.md - Malware analysis · Dynamic analysis, memory dumps, and self-modifying code.
gitbook/chapters/malware_analysis/dynamic_malware_analysis.md - Memory dumps · Memory dump analysis techniques.
gitbook/chapters/malware_analysis/memory_dump_analysis.md - SMC analysis · Self-modifying code analysis.
gitbook/chapters/malware_analysis/smc_malware_analysis.md - PE format · Portable Executable file format.
gitbook/chapters/pe/pe_file_format.md - Windows · Platform overview and API hooking.
gitbook/chapters/windows/platform_overview.md - API hooking · Windows API hooking concepts and practice.
gitbook/chapters/windows/api_hooking.md - Solutions · Worked examples and applied analysis exercises.
gitbook/chapters/solutions/crash_dump_analysis.md
Slides
Standalone presentation deliverables.
- PDF slides · Exported lecture slides distributed as PDFs.
presentations/pdf/001_Intro_RE.pdf - PPT placeholder · Empty placeholder indicating no editable slide sources are preserved here.
presentations/ppt/EMPTY
Connections 21
- README → Docs README: points to · Root landing page directs readers into the GitBook docs.
- README → PDF slides: points to · Root landing page also highlights the slide decks.
- Docs README → Summary: uses · GitBook entry relies on the navigation summary.
- Summary → Assembly: navigates · Course navigation includes the assembly chapter.
- Summary → Debugging: navigates · Course navigation includes the debugging section.
- Summary → Malware analysis: navigates · Course navigation includes malware analysis chapters.
- Summary → PE format: navigates · Course navigation includes PE format content.
- Summary → Windows: navigates · Course navigation includes Windows platform content.
- Summary → Solutions: navigates · Course navigation includes the applied solutions section.
- Debugging → WinDbg: includes · Debugging material includes a dedicated WinDbg chapter.
- Malware analysis → Memory dumps: includes · Malware analysis includes memory dump analysis.
- Malware analysis → SMC analysis: includes · Malware analysis includes self-modifying code analysis.
- Windows → API hooking: includes · Windows content includes API hooking.
- Solutions → Assembly: applies · Solutions draw on assembly fundamentals.
- Solutions → Debugging: applies · Solutions use debugging techniques.
- Solutions → Malware analysis: applies · Solutions apply malware analysis methods.
- Solutions → PE format: applies · Solutions use PE format knowledge.
- Solutions → Windows: applies · Solutions rely on Windows platform concepts.
- PDF slides → PPT placeholder: source gap · PDF exports exist, but editable PPT sources are not preserved.
- Assets → README: supports · Shared media supports the repository landing page.
- Assets → Docs README: supports · Shared media also supports the documentation entry point.