News for hackers. Stuff that matters.
Re:NSA Ghidra software reverse engineering framework by HelloNurse on Wednesday March 29, 2023 @05:17AM (#35354587)
You are supposed to annotate what every part of the file is and how you want to display it. It's usually easy to distinguish reasonable assembler code from nonsense instructions interspersed with undecodable islands.

Disassembling all sections just in case they contain code is a common conservative policy for disassemblers: even without malicious payload hiding tricks even definitely never executed sections could contain embedded executable code.

Re:NSA Ghidra software reverse engineering framework by youngtaff on Friday March 31, 2023 @05:23AM (#35384523)
Thanks, I'll try that approach

It's been a while since I've looked at asm in anger so it's taking me a while to get back into it (plus this is a side project ATM)