Learning Malware Analysis

3.3 IDA's Debugger Interface

After you launch the program in the IDA debugger, the process will pause, and the following debugger display will be presented to you:

When the process is under debugger control, the disassembly toolbar is replaced with the debugger toolbar. This toolbar consists of buttons related to the debugging functionality (such as process control and breakpoint):

• Disassembly Window: This window is synchronized with the current value of the instruction pointer register (eip or rip). The disassembly windows offer the same functionality that you learned in the previous chapter. You can also switch between the graph view