jstrosch / learning-malware-analysis

This repository contains sample programs that mimick behavior found in real-world malware. The goal is to provide source code that can be compiled and used for learning purposes, without having to worry about handling live malware.

Hello World! 👋

I have a variety of projects here, many of which focus on helping to learn malware analysis and reverse engineering.

Educational projects

• Learning Reverse Engineering - Sample programs, primarily in C, to help learn key reverse engineering concepts
• Learning Malware Analysis - Sample programs to help learn key malware analysis skills
• Malware-Samples - A variety of resources from in-the-wild malware, includes analysis exercises

Tools

• Subcrawl - A framework to identify open directories and classify the content discovered there.
• Subparse - A framework for parsing files, enriching this data, and making searchable through Elastic
• SCLauncher - A utility to launch and debug shellcode, as well as produce PE files from the shellcode

Get in touch

• Discord: This is my own Discord server, come join the community - https://discord.gg/cs2yfe4fQj
• X: jstrosch
• LinkedIn: Josh Stroschein
• YouTube: jstrosch

learning-malware-analysis's Issues

Wrong `main` signature?

I was browsing through your repo and noticed this main signature:

int main(int argc, char argv[], char envp[])

https://github.com/jstrosch/learning-malware-analysis/blob/7d79f7cfff1f037a76955c6ae679d6f1c6a0ff69/Yara/ascii_wide_strings/demo.c#L9C20-L9C44

Isn't this wrong? My C is a little bit rusty, but shouldn't it be:

int main(int argc, char *argv[], char *envp[])