Re:NSA Ghidra software reverse engineering framework
by HelloNurse on Wednesday March 29, 2023 @05:17AM
(#35354587)
You are supposed to annotate what every part of the file is and how you want to display it. It's usually easy to distinguish reasonable assembler code from nonsense instructions interspersed with undecodable islands.
Disassembling all sections just in case they contain code is a common conservative policy for disassemblers: even without malicious payload hiding tricks even definitely never executed sections could contain embedded executable code.
Tried Ghidra for the first time on the weekend to look at some 8051 firmware
Got stuck with disassembly as it seems to be misinterpreting some data sections as code - can see English strings in a hex editor but Ghidra is trying to convert them to asm