Learning Malware Analysis

3.1 Launching a New Process in IDA

There are different ways to launch a new process; one method is to directly launch the debugger, without initially loading the program. To do that, launch IDA (without loading the executable), then select Debugger | Run | Local Windows debugger; this will bring up a dialog where you can choose the file to debug. If the executable takes any parameters, you can specify them in the Parameters field. This method will start a new process, and the debugger will pause the execution at the program's entry point:

The second method of launching a process is to first load the executable in IDA (which performs the initial ...