Why Ghidra doesn't load the disassembly correctly while radare2 does?

Question

I'm trying to get the disassembly of a very small binary file available here. This file is cropped from part of another executable binary.

When I open it with r2 it automatically recognizes the architecture and can provide me with the diassembly:

With Ghidra however, it cannot find the architecture automatically and I have to manually specify the language:

Even then, I'm getting the following as the disassembly:

I'm very surprised by how poor NSA's Ghidra is performing in such scenario compared to the open source radare2. Can someone describe what's going on and how can I fix it?

Answer 1

When you have just raw bytes without proper headers tools might not know how to process as the code might not start from offset 0. They could try to analyze the bytes to detect if there's code, data or something else but you might also get some false-positives.

In your case, you instruct r2 to display those bytes as code (pd - print disassembly) and it does not recognize any architecture as it has x86 by default. You would get the same when you open no file (r2 - and then e asm.arch)

In Ghidra you selected the architecture manually and to "force" the tool to do the same as your pd in radare2 just press D.

Answer 2

Paweł Łukasik is correct.

Disassembling the code fragment using Ghidra can be done in 3 steps:

1. Selecting the architecture (which you have already done)

2. Highlighting the bytes to disassemble

3. Press "D" as Paweł stated or right click and select "disassemble"