0

I was trying to understand the IsDebuggerPresent() function exported by kernelbase.dll by importing the file on Ghidra. But Ghidra can't show me the proper disassembly or decompilation of function even though disassembly works fine in PE Bear? What could be the issue? I don't know if this is the proper place to post this so please guide me to a place if it isn't. Thanks!

Ghidra Disassembly/Decompilation Output

PE Bear Disassembly Output

3

Try to do ctrl + A - select all and then press D to disassemble. good chance it will solve your problem.

  • And I'm reminded again why I love the Internet! That solved the problem, thanks so much! I'll accept your answer. Any idea why Ghidra won't do the disassembly automatically? This problem doesn't arise when I import kernel32.dll for example. – Somik Roy Jan 5 at 17:31
  • Thanks :) I have no idea, but I know that most of the disassembler has similar problems. it happens in IDA too for example. – macro_controller Jan 6 at 8:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.