Can someone recommend how I can get into malware research/reverse engineering?

This is bad advice. Most people who are really good at reversing are not coders. Can they code? Yes, but they hate it. As a coder, I can reverse, but it's much easier to spend long hours at a compiler instead of a debugger. It's analytical vs creative mindset - reversers are analysists, analysis is not creative.

Something else no one in this thread is saying, and I don't know why, is that 90% of good reversers has got their start in software piracy. Lena101's tutorials are the official place to start learning about reversing, google it. It's not oriented toward malware analysis, but the skills she'll teach you will be the same stuff you need to know for malware (Reading asm, patching, ID'ing API's, etc). Random's tutorials are good too. I seriously doubt any other tutorials out there come close to the quality of these.

Regarding the question of coding, if you can code, a career in RE (or infosec in general) is the last thing you'd want. Reversers don't make much money, and the work is difficult. The reason is a company can hire 10 million reversers to reverse every malware out there and it isn't going to increase their profits. This applies to most aspects of infosec, pentesters, reversers, code reviewers, etc - you can fill a building with them and they won't make anyone money (just make everyone paranoid hehe). Coders, sys/database admins, help desk, etc (more traditional IT roles) can and do help businesses. I'm not saying is not necessary, but I view information security like physical security, yes a successful company probably needs security guard, but is not something you want aspire to be.

Too long, don't read - I asked the same questions as you many years ago, people told me "learn to code", I learned to code, now a coder and would not consider being a reverser.

/r/AskNetsec Thread Parent