Learning Malware Analysis

3.5 Setting a Breakpoint in IDA

To set a software breakpoint in IDA, you can navigate to the location where you want the program to pause, and press the F2 key (or right-click and select Add breakpoint). After you set the breakpoint, the addresses where breakpoints are set are highlighted in a red color. You can remove the breakpoint by pressing F2 on the line containing the breakpoint.

In the following screenshot, the breakpoint was set at the address 0x00401013 (call sub_401000). To pause the execution at the breakpoint address, first, choose the debugger (such as Local Win32 Debugger), as mentioned previously, and then run the program by selecting Debugger | Start Process (or the F9 hotkey). This will execute all of the instructions before ...