Are questions about the functionality or workings of malware on topic? This does not include questions about how to reverse engineer malware, but instead asks about specific API calls or functionality that malware may be using.
Note: the "covered" vs "not covered" sections below does not imply that either category should be covered. Instead, it says that if this subject (questions about the functionality of malware) is accepted, then questions similar to the "covered" section would be allowed, whereas questions not covered by this section may not be allowed, because this subject does not apply to them.
Covered by this subject would be these kinds of questions:
- "Why would malware make references to fs[30h]?"
- "What is DLL Load order hijacking?"
Not covered by this subject would be the questions:
- "What is a safe way to run malware for dynamic analysis?"
- "What anti debugging techniques should I look out for?"
- "I need to intercept traffic to a specific IP address, is this possible?"