3.1 Launching a New Process in IDA

There are different ways to launch a new process; one method is to directly launch the debugger, without initially loading the program. To do that, launch IDA (without loading the executable), then select Debugger | Run | Local Windows debugger; this will bring up a dialog where you can choose the file to debug. If the executable takes any parameters, you can specify them in the Parameters field. This method will start a new process, and the debugger will pause the execution at the program's entry point:

The second method of launching a process is to first load the executable in IDA (which performs the initial ...

Get Learning Malware Analysis now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.