Learning Malware Analysis

9.3 Strings

A string is an array of characters. When you define a string, shown as follows, a null terminator (string terminator) is added at the end of every string. Each element occupies 1 byte of memory (in other words, each ASCII character is 1 byte in length):

char *str = "Let"

The string name str is a pointer variable that points to the first character in the string (in other words, it points to the base address of the character array). The following diagram shows how these characters reside in memory:

From the preceding example, you can access the elements of a character array (string), as shown here:

str[0] = [str+0] = [0x4000+0] = ...