Learning Malware Analysis

2.3.5 Navigating Locations

Another great feature of IDA is that it makes navigating to anywhere within a program much easier. When a program is disassembled, IDA labels every location in the program, and double-clicking on the locations will jump the display to the selected location. In the preceding example, you can navigate to any of the named locations (such as dword_403374, byte_403370, and aTest) by double-clicking on them. For example, double-clicking on aTest at ➏ jumps the display to a virtual address in the .data section, shown as follows. Notice how IDA labeled the address 0x00403000, containing the string "test", as aTest:

.data:00403000    aTest db 'test',0  ➐; DATA XREF: _main+26o

Similarly, double-clicking on the address dword_403374 ...