4

I'm trying to get the disassembly of a very small binary file available here. This file is cropped from part of another executable binary.

When I open it with r2 it automatically recognizes the architecture and can provide me with the diassembly:

enter image description here

With Ghidra however, it cannot find the architecture automatically and I have to manually specify the language:

enter image description here

Even then, I'm getting the following as the disassembly:

enter image description here

I'm very surprised by how poor NSA's Ghidra is performing in such scenario compared to the open source radare2. Can someone describe what's going on and how can I fix it?

0

2 Answers 2

6

When you have just raw bytes without proper headers tools might not know how to process as the code might not start from offset 0. They could try to analyze the bytes to detect if there's code, data or something else but you might also get some false-positives.

In your case, you instruct r2 to display those bytes as code (pd - print disassembly) and it does not recognize any architecture as it has x86 by default. You would get the same when you open no file (r2 - and then e asm.arch)

In Ghidra you selected the architecture manually and to "force" the tool to do the same as your pd in radare2 just press D.

4

Paweł Łukasik is correct.

Disassembling the code fragment using Ghidra can be done in 3 steps:

  1. Selecting the architecture (which you have already done)

  2. Highlighting the bytes to disassemble

Highlight and press D

  1. Press "D" as Paweł stated or right click and select "disassemble"

disassembled fragment

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.