1

I was trying to understand the IsDebuggerPresent() function exported by kernelbase.dll by importing the file on Ghidra. But Ghidra can't show me the proper disassembly or decompilation of function even though disassembly works fine in PE Bear? What could be the issue? I don't know if this is the proper place to post this so please guide me to a place if it isn't. Thanks!

Ghidra Disassembly/Decompilation Output

PE Bear Disassembly Output

Improve this question

1 Answer 1

Reset to default
4

Try to do ctrl + A - select all and then press D to disassemble. good chance it will solve your problem.

Improve this answer
2
  • And I'm reminded again why I love the Internet! That solved the problem, thanks so much! I'll accept your answer. Any idea why Ghidra won't do the disassembly automatically? This problem doesn't arise when I import kernel32.dll for example.
    – EvilSapphire
    Commented Jan 5, 2020 at 17:31
  • Thanks :) I have no idea, but I know that most of the disassembler has similar problems. it happens in IDA too for example.
    – macro_controller
    Commented Jan 6, 2020 at 8:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.