Igor’s Tip of the Week #121: Limiting search to an address range

When performing a search in IDA, it by default starts from the current position and continues up to the maximum address in the database (or to the minimal for searches “Up”). This works well enough for small to average files, but can get pretty slow for big ones, or especially in case of debugging where the database may include not just the input file but also multiple additional modules loaded at runtime.

To skip areas you’re not interested in and …

address malware analysis search