CREST Certified Malware Reverse Engineer
The technical syllabus identifies at a high level the technical skills and knowledge that CREST expects candidates to possess for the Certification examinations in the area of Intrusion Analysis. This is a specialist exam for this subject area which also includes a core skills exam covering network and host intrusion.
The CREST Certified Malware Reverse Engineer (CCMRE) examination tests candidate’s ability to reverse engineer malware, particularly remote access Trojans.
The candidate will be expected to possess not only the technical ability to find security weaknesses and vulnerabilities, but also the skills to ensure findings are presented in a clear, concise and understandable manner. The examination consists of three tasks:
- A multiple choice technical examination
- A long form essay style written paper, testing both technical ability and presentation ability
- A hands-on practical examination
To pass the exam, the candidate must pass all three sections.
You can download the following documents from the links below:
Syllabus for the Certified Malware Reverse Engineer examination
Notes for Candidates to aid examination preparation
The Certified Malware Reverse Engineering examination costs £1,600 + VAT
Recommended Preparation Material
The following material and media has been cited as helpful preparation for this examination by previous candidates:
Practical Malware Analysis
The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux and Mac Memory (by Michael Hale/Andrew Case/Jamie Levy/Aaron Walters)
Reversing: Secrets of Reverse Engineering (by Eldad Eilam)
Useful Information for Candidates
Details of the Logistics and Timings of CREST examinations can be found in the Examination Preparation pages for your country of choice
CREST’s Policy for Candidates requiring special arrangements including additional time to accommodate a medical condition (including examinations delivered via Pearson Vue)
Terms and Conditions for CREST Examinations (includes hard disk drive wiping policy)