Learning Malware Analysis

2.3.1 Renaming Locations

So far, we have seen how IDA performs analysis on our program and how it adds dummy names. The dummy names are useful, but these names do not tell the purpose of a variable. When analyzing malware, you should change the variable/function names to more meaningful names. To rename a variable or an argument, right-click on the variable name or argument and select rename (or press N); this will bring up the following dialog. After you rename it, IDA will propagate the new name to wherever that item is referenced. You can use the rename feature to give meaningful names to the functions, and variables:

Changing the name ...