The functions, window displays all the functions recognized by ID, and it also shows the virtual address
where each function can be found as well, and the size of each function and various other properties
of the function.
And you can double click any of these functions to jump to a selected function.
And each function is associated with various flags such as let's actually increase the size of play
a bit.
We have the RFL and so on and you can get more information about these flags and the help file by pressing
the F1 here.
Index.
We can search the terms.
Here.
And as you can see, you have a lot of contents to read and exercise on the.
Ida here.
Ida and.
Here.
For example, if you are searching for the R here, you can just write the keyword for your term.
And.
List the topics here.
And the library functions are compiled and compiler generated and are not written by a malware.
Rather and from a code analysis perspective, we will be interested in analyzing the malware code,
not the library code here.
And we also have the output window.
So this functions window will be useful for us and we will use that in next lectures here.
As you can see here, you can almost see anything with these functions here, functions, window, you
can see the diagrams of this and so on, but you can exercise by some malware.
And we also have.
Uh, the output window as well.
So the output window, um, displays the message generated by IDE and IDE plugins.
And these messages can give information about the analysis of the binary and various operations that
you perform.
And you can look at the contents of the output window to get an idea of various operations performed
by Ida when an executable is loaded.
And we also have the hex view window here as well.
So you can click the click, the hex view one two tab to display the hex window.
And the hex window displays a sequence of bytes in a hex dump and the Ascii format.
And by default, the hex window is synchronized with the Disassembler window means when you select any
item in the disassembly window, the corresponding bytes are highlighted in the hex window.
So the hex window is useful to inspect the contents of the memory address.
And we also have the structures window here and clicking on the structures tab will bring up the structures
window.
This structure window lists the layout of the standard data structures used in the program, and it
also allows you to create your own data structures here.
And we have the imports window here clicking on the structures tab.
After the clicking on the structure set, we can also click on imports exports here and in imports here.
Um, this imports window lists all of the functions imported by the binary.
So this here, you can see that the imported functions and the shared libraries, which are also called
the DLL from which these functions are imported and.
We have the exports window as well.
So this exports window lists all the exported functions.
So the exported functions are normally found in the DLLs.
So this window can be useful when you are analyzing malicious DLLs.
In this case, we don't have we don't really have any exports because this is just an Hello world application
and the executable file and not a DLL here.
And we have the also we have we also have the strings windows.
It does not shows the string window by default.
So you can bring it up the strings window by clicking on the view.
Um, here.
View and in view, we will click on the open open, open sub views.
Here.
And there's also a shortcut for this, which I will show you right now.
And as you can see here in view, we can click on the open sweeps here.
And after that, we will select the springs.
And as you can see, we also have the shortcut for it and shift and F 12 and that's it.
We have the strings window here.
So the string strings window displays the list of strings extracted from the binary and the address
where these strings can be found.
And by default, this string, the strings window displays only the null terminated Ascii strings of
at least five characters in length and in next lecture.
Actually, in previous lecture with Ghidra, we saw that a malicious binary can use Unicode strings
and you can configure Ida to display different types of strings.
And to do that while you are in the strings window, right click on the setup and you can select the.
String that you can hear.
We have the unique C-style 16 bits C-style 32 bits, Pascal style, Pascal style 64, 16 bits and so
on.
And we also have the segments window.
So the segments window is available at the will open Subviews And after that we will use select segments
or we can also use the shift F seven to bring it up and here.
And here we have the.
Open Savills and we will see the segments right now.
Uh, open Savills and segments and, uh, the segments window.
Uh, this section is like, uh, the text data and so on in this binary file.
And the displayed information contains the start address and the end address and the memory permissions
of each, uh, section.
And the start and end address specify the virtual address of each section that is mapped into memory
during runtime.