Learning Malware Analysis

2.3.8 Proximity View And Graphs

IDA's graphing options are a great way to visualize cross-references. Apart from the graph view shown previously, you can use the IDA's integrated graphing feature, called proximity view, to display the callgraph of a program. To view the callgraph of the function sub_4013CD from the previous example, while placing the cursor anywhere inside the function, click View | Open subviews | Proximity browser; this will change the view in the disassembly window to the proximity view, shown as follows. In proximity view, functions and data references are represented as nodes, and the cross-references between them are represented as edges (the lines that connect the nodes). The following graph displays Xrefs to and ...