2.3 Improving Disassembly Using IDA

In this section, we will explore various features of IDA, and you will learn how to combine the knowledge you gained in the previous chapter with the capabilities offered by IDA to enhance the disassembly process. Consider the following trivial program, which copies the content of one local variable to another:

int main(){  int x = 1;  int y;  y = x;  return 0;}

After compiling the preceding code and loading it in IDA, the program disassembles to the following:

.text:00401000 ; Attributes: bp-based frame ➊.text:00401000.text:00401000 ; ➋ int __cdecl main(int argc, const char **argv, const char **envp).text:00401000  ➐ _main proc near.text:00401000.text:00401000    var_8= dword ptr -8  ➌.text:00401000 var_4= dword ...

Get Learning Malware Analysis now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.