2.1 Loading Binary in IDA

To load an executable, Launch IDA Pro (right-click and select Run as administrator). When you launch IDA, it will briefly display a screen showing your license information; immediately after that, you will be presented with the following screen. Choose New and select the file you wish to analyze. If you select Go, IDA will open the empty workspace. To load a file, you can either drag and drop or click on File | Open and select the file:

The file that you give to IDA will be loaded into the memory (IDA acts like a Windows loader). To load the file into the memory, IDA determines the best possible loaders, and from the file header, it determines the processor type that should be used during the disassembly process. After you select the file,  IDA shows the loading dialog (as shown in the following screenshot). From the screenshot, it can be seen that IDA determined the appropriate loaders (pe.ldw and dos.ldw) and the processor type. The Binary file option (if you are using the IDA demo version, you will not see this option) is used by the IDA to load the files that it does not recognize. You will normally use this option when you are dealing with a shellcode. By default, IDA does not load the PE headers and the resource section in the disassembly. By using the manual load checkbox option, you can manually specify the base address where the executable has to be loaded, and IDA will prompt you on whether you want to load each section, including the PE headers:

After you click OK, IDA loads the file into memory, and the disassembly engine disassembles the machine code. After the disassembly, IDA performs an initial analysis to identify the compiler, function arguments, local variables, library functions, and their parameters. Once the executable has been loaded, you will be taken to the IDA desktop, showing the disassembled output of the program. 

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.224.149.242