2.2.1 Disassembly Window

After the executable has been loaded, you will be presented with the disassembly window (also known as the IDA-view window). This is the primary window, and it displays the disassembled code. You will mostly be using this window for analyzing binaries.

IDA can show the disassembled code in two display modes: Graph view and Text view. Graph view is the default view, and when the disassembly view (IDA-view) is active, you can switch between the graph and text views by pressing the spacebar button.

In the graph view mode, IDA displays only one function at a time, in a flowchart-style graph, and the function is broken down into basic blocks. This mode is useful to quickly recognize branching and looping statements. In ...

Get Learning Malware Analysis now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.