Practical Malware Analysis

Identifying Structs

Structures (or structs, for short) are similar to arrays, but they comprise elements of different types. Structures are commonly used by malware authors to group information. It’s sometimes easier to use a structure than to maintain many different variables independently, especially if many functions need access to the same group of variables. (Windows API functions often use structures that must be created and maintained by the calling program.)

In Example 6-26, we define a structure at ❶ made up of an integer array, a character, and a double. In main, we allocate memory for the structure and pass the struct to the test function. The struct gms defined at ❷ is a global variable.

Example 6-26. C code for a struct example

struct ...