This final course takes students into advanced and specialist topics surrounding rootkit analysis. Students will learn about the Windows kernel, automated and manual unpacking, live kernel debugging with IDA and WinDbg, and reverse engineering drivers. This is a heavily lab-intensive course that requires students to have a solid background in reverse engineering and malware analysis prior to attending. In addition, one of two optional modules can be included in this course: Document-Embedded Malware or IDA Scripting with IDAPython. Either one can be added to the week-long course while still dedicating sufficient time to cover rootkit analysis, though in less detail.