# abhisek/reverse-engineering-and-malware-analysis architecture

> Architecture diagram of the GitHub repository abhisek/reverse-engineering-and-malware-analysis, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/abhisek/reverse-engineering-and-malware-analysis
- Repository: https://github.com/abhisek/reverse-engineering-and-malware-analysis

## Overview

1. **Repository purpose**
   - This is a **static course-content repository** for “Reverse Engineering and Malware Analysis 101.”
   - There is **no application backend, database, or runtime service**; the repo is organized around documentation and downloadable training materials.

2. **Top-level structure**
   - The repository has two main content branches:
     - **`gitbook/`**: the primary written course material.
     - **`presentations/`**: slide decks distributed as PDFs, with a placeholder for source PPTs.
   - The root `README.md` acts as the landing page and points readers to those two branches.

3. **GitBook documentation subsystem**
   - `gitbook/README.md` and `gitbook/SUMMARY.md` define the documentation site structure.
   - The markdown chapters under `gitbook/chapters/` are the source content for a **GitBook-generated static site**.
   - The repo expects local generation via `gitbook serve`, which builds the docs from markdown and navigation metadata.

4. **Course content organization**
   - The GitBook content is grouped into topic areas:
     - **`assembly/`**: x86 assembly fundamentals.
     - **`debugging/`**: Windows debugging and WinDbg content.
     - **`malware_analysis/`**: dynamic analysis, memory dump analysis, and self-modifying code analysis.
     - **`pe/`**: Portable Executable file format.
     - **`windows/`**: Windows platform overview and API hooking.
     - **`solutions/`**: worked examples and case-study writeups.
   - This creates a clear separation between **instructional chapters** and **applied analysis exercises**.

5. **Solutions / case-study layer**
   - The `solutions/` chapter set is a distinct pedagogical layer that shows how the techniques are applied.
   - It includes analyses such as crash dumps, file identification, malware anti-analysis, process injection, memory images, and Win32 API counting.
   - For an architecture diagram, this is best treated as a **practical lab/case-study subsystem** connected to the theory chapters.

6. **Presentation subsystem**
   - `presentations/pdf/` contains standalone lecture slides in PDF format.
   - These are separate deliverables from the GitBook docs and likely serve as in-class or offline materials.
   - `presentations/ppt/EMPTY` indicates there is no preserved editable slide source in this repo, only the exported PDFs.

7. **Asset handling**
   - `assets/` contains shared media used by the documentation, such as the README hero image.
   - Within the docs, images also live under `gitbook/images/`.
   - These are supporting static assets only; they do not contain executable logic.

8. **Content generation and consumption flow**
   - The main flow is: **markdown chapters + summary/navigation + images → GitBook static site**.
   - Readers can consume the material either through:
     - the generated GitBook site locally via `gitbook serve`, or
     - the raw repository files and PDF slide decks directly from source control.

9. **Boundary between source and deliverables**
   - The repository keeps **source content** and **final teaching artifacts** side by side:
     - Markdown files are the editable source.
     - PDFs are the finalized presentation output.
   - This matters for diagramming because the repo is not an app pipeline; it is a **content repository with published outputs**.

10. **Operational/runtime footprint**
   - The only documented tooling requirement is **Node.js with `gitbook-cli`** for local documentation serving.
   - There are no external APIs, services, or infrastructure dependencies visible in the repo.
   - Architecturally, this is a **self-contained static educational knowledge base**.

Main entry points: [`gitbook/SUMMARY.md`](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/SUMMARY.md) (Summary), [`gitbook/chapters/solutions/crash_dump_analysis.md`](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/solutions/crash_dump_analysis.md) (Solutions), [`gitbook/chapters/malware_analysis/dynamic_malware_analysis.md`](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/malware_analysis/dynamic_malware_analysis.md) (Malware analysis), [`README.md`](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/README.md) (README)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_g_root["Repository root"]
  node_n_readme["README<br/>landing page<br/>[README.md]"]
  node_n_license["License<br/>legal"]
  node_n_assets["Assets<br/>media"]
end

subgraph group_g_gitbook["GitBook docs"]
  node_n_gitbook_readme["Docs README<br/>docs entry<br/>[README.md]"]
  node_n_summary["Summary<br/>nav index<br/>[SUMMARY.md]"]
  node_n_assembly["Assembly<br/>chapter set<br/>[x86_assembly.md]"]
  node_n_debugging["Debugging<br/>chapter set"]
  node_n_windbg["WinDbg<br/>chapter<br/>[rb_windbg.md]"]
  node_n_malware["Malware analysis<br/>chapter set"]
  node_n_memory_dump["Memory dumps<br/>chapter"]
  node_n_smc["SMC analysis<br/>chapter"]
  node_n_pe["PE format<br/>chapter<br/>[pe_file_format.md]"]
  node_n_windows["Windows<br/>chapter set"]
  node_n_api_hooking["API hooking<br/>chapter<br/>[api_hooking.md]"]
  node_n_solutions["Solutions<br/>case studies"]
end

subgraph group_g_presentations["Slides"]
  node_n_pdfs["PDF slides<br/>slide deck archive<br/>[001_Intro_RE.pdf]"]
  node_n_ppt_placeholder["PPT placeholder<br/>source placeholder"]
end

node_n_readme -->|"points to"| node_n_gitbook_readme
node_n_readme -->|"points to"| node_n_pdfs
node_n_gitbook_readme -->|"uses"| node_n_summary
node_n_summary -->|"navigates"| node_n_assembly
node_n_summary -->|"navigates"| node_n_debugging
node_n_summary -->|"navigates"| node_n_malware
node_n_summary -->|"navigates"| node_n_pe
node_n_summary -->|"navigates"| node_n_windows
node_n_summary -->|"navigates"| node_n_solutions
node_n_debugging -->|"includes"| node_n_windbg
node_n_malware -->|"includes"| node_n_memory_dump
node_n_malware -->|"includes"| node_n_smc
node_n_windows -->|"includes"| node_n_api_hooking
node_n_solutions -->|"applies"| node_n_assembly
node_n_solutions -->|"applies"| node_n_debugging
node_n_solutions -->|"applies"| node_n_malware
node_n_solutions -->|"applies"| node_n_pe
node_n_solutions -->|"applies"| node_n_windows
node_n_pdfs -.->|"source gap"| node_n_ppt_placeholder
node_n_assets -->|"supports"| node_n_readme
node_n_assets -->|"supports"| node_n_gitbook_readme

click node_n_readme "https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/README.md"
click node_n_license "https://github.com/abhisek/reverse-engineering-and-malware-analysis/tree/master/LICENSE"
click node_n_gitbook_readme "https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/README.md"
click node_n_summary "https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/SUMMARY.md"
click node_n_assembly "https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/assembly/x86_assembly.md"
click node_n_debugging "https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/debugging/windows-debugging-internals.md"
click node_n_windbg "https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/debugging/rb_windbg.md"
click node_n_malware "https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/malware_analysis/dynamic_malware_analysis.md"
click node_n_memory_dump "https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/malware_analysis/memory_dump_analysis.md"
click node_n_smc "https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/malware_analysis/smc_malware_analysis.md"
click node_n_pe "https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/pe/pe_file_format.md"
click node_n_windows "https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/windows/platform_overview.md"
click node_n_api_hooking "https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/windows/api_hooking.md"
click node_n_solutions "https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/solutions/crash_dump_analysis.md"
click node_n_pdfs "https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/presentations/pdf/001_Intro_RE.pdf"
click node_n_ppt_placeholder "https://github.com/abhisek/reverse-engineering-and-malware-analysis/tree/master/presentations/ppt/EMPTY"
click node_n_assets "https://github.com/abhisek/reverse-engineering-and-malware-analysis/tree/master/assets"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_n_readme,node_n_license,node_n_assets toneBlue
class node_n_gitbook_readme,node_n_summary,node_n_assembly,node_n_debugging,node_n_windbg,node_n_malware,node_n_memory_dump,node_n_smc,node_n_pe,node_n_windows,node_n_api_hooking,node_n_solutions toneAmber
class node_n_pdfs,node_n_ppt_placeholder toneMint
```

## Components

### Repository root

Landing and repository-level metadata.

- [README](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/README.md): landing page · Repository landing page that points to the docs and slide decks. · `README.md`
- [License](https://github.com/abhisek/reverse-engineering-and-malware-analysis/tree/master/LICENSE): legal · Repository license text. · `LICENSE`
- [Assets](https://github.com/abhisek/reverse-engineering-and-malware-analysis/tree/master/assets): media · Shared static media used by the repository content. · `assets`

### GitBook docs

Markdown chapters and navigation for the course site.

- [Docs README](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/README.md): docs entry · GitBook-specific entry point and local usage notes. · `gitbook/README.md`
- [Summary](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/SUMMARY.md): nav index · GitBook navigation tree for the course chapters. · `gitbook/SUMMARY.md`
- [Assembly](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/assembly/x86_assembly.md): chapter set · x86 assembly fundamentals. · `gitbook/chapters/assembly/x86_assembly.md`
- [Debugging](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/debugging/windows-debugging-internals.md): chapter set · Windows debugging and WinDbg material. · `gitbook/chapters/debugging/windows-debugging-internals.md`
- [WinDbg](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/debugging/rb_windbg.md): chapter · Practical WinDbg reference content. · `gitbook/chapters/debugging/rb_windbg.md`
- [Malware analysis](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/malware_analysis/dynamic_malware_analysis.md): chapter set · Dynamic analysis, memory dumps, and self-modifying code. · `gitbook/chapters/malware_analysis/dynamic_malware_analysis.md`
- [Memory dumps](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/malware_analysis/memory_dump_analysis.md): chapter · Memory dump analysis techniques. · `gitbook/chapters/malware_analysis/memory_dump_analysis.md`
- [SMC analysis](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/malware_analysis/smc_malware_analysis.md): chapter · Self-modifying code analysis. · `gitbook/chapters/malware_analysis/smc_malware_analysis.md`
- [PE format](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/pe/pe_file_format.md): chapter · Portable Executable file format. · `gitbook/chapters/pe/pe_file_format.md`
- [Windows](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/windows/platform_overview.md): chapter set · Platform overview and API hooking. · `gitbook/chapters/windows/platform_overview.md`
- [API hooking](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/windows/api_hooking.md): chapter · Windows API hooking concepts and practice. · `gitbook/chapters/windows/api_hooking.md`
- [Solutions](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/gitbook/chapters/solutions/crash_dump_analysis.md): case studies · Worked examples and applied analysis exercises. · `gitbook/chapters/solutions/crash_dump_analysis.md`

### Slides

Standalone presentation deliverables.

- [PDF slides](https://github.com/abhisek/reverse-engineering-and-malware-analysis/blob/master/presentations/pdf/001_Intro_RE.pdf): slide deck archive · Exported lecture slides distributed as PDFs. · `presentations/pdf/001_Intro_RE.pdf`
- [PPT placeholder](https://github.com/abhisek/reverse-engineering-and-malware-analysis/tree/master/presentations/ppt/EMPTY): source placeholder · Empty placeholder indicating no editable slide sources are preserved here. · `presentations/ppt/EMPTY`

## Connections

- README → Docs README: points to · Root landing page directs readers into the GitBook docs.
- README → PDF slides: points to · Root landing page also highlights the slide decks.
- Docs README → Summary: uses · GitBook entry relies on the navigation summary.
- Summary → Assembly: navigates · Course navigation includes the assembly chapter.
- Summary → Debugging: navigates · Course navigation includes the debugging section.
- Summary → Malware analysis: navigates · Course navigation includes malware analysis chapters.
- Summary → PE format: navigates · Course navigation includes PE format content.
- Summary → Windows: navigates · Course navigation includes Windows platform content.
- Summary → Solutions: navigates · Course navigation includes the applied solutions section.
- Debugging → WinDbg: includes · Debugging material includes a dedicated WinDbg chapter.
- Malware analysis → Memory dumps: includes · Malware analysis includes memory dump analysis.
- Malware analysis → SMC analysis: includes · Malware analysis includes self-modifying code analysis.
- Windows → API hooking: includes · Windows content includes API hooking.
- Solutions → Assembly: applies · Solutions draw on assembly fundamentals.
- Solutions → Debugging: applies · Solutions use debugging techniques.
- Solutions → Malware analysis: applies · Solutions apply malware analysis methods.
- Solutions → PE format: applies · Solutions use PE format knowledge.
- Solutions → Windows: applies · Solutions rely on Windows platform concepts.
- PDF slides → PPT placeholder: source gap · PDF exports exist, but editable PPT sources are not preserved.
- Assets → README: supports · Shared media supports the repository landing page.
- Assets → Docs README: supports · Shared media also supports the documentation entry point.