Learning Malware Analysis

2.3.3 IDA Database

When an executable is loaded into IDA, it creates a database consisting of five files (whose extensions are .id0, .id1, .nam, .id2, and .til) in the working directory. Each of these files stores various information and has a base name that matches the selected executable. These files are archived and compressed into a database file with a .idb (for 32-bit binary) or .i64 (for 64-bit binary) extension. Upon loading the executable, the database is created and populated with the information from the executable files. The various displays that are presented to you are simply views into the database that gives information in a format that is useful for code analysis. Any modifications that you make (such as renaming, commenting ...