Learning Malware Analysis

2.3 Improving Disassembly Using IDA

In this section, we will explore various features of IDA, and you will learn how to combine the knowledge you gained in the previous chapter with the capabilities offered by IDA to enhance the disassembly process. Consider the following trivial program, which copies the content of one local variable to another:

int main(){  int x = 1;  int y;  y = x;  return 0;}

After compiling the preceding code and loading it in IDA, the program disassembles to the following:

.text:00401000 ; Attributes: bp-based frame ➊.text:00401000.text:00401000 ; ➋ int __cdecl main(int argc, const char **argv, const char **envp).text:00401000  ➐ _main proc near.text:00401000.text:00401000    var_8= dword ptr -8  ➌.text:00401000 var_4= dword ...