Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Section Editor - Disassembler decodes just 2 bytes #5

Open
greenozon opened this issue May 10, 2018 · 3 comments
Open

Section Editor - Disassembler decodes just 2 bytes #5

greenozon opened this issue May 10, 2018 · 3 comments
Labels

Comments

@greenozon
Copy link

Info

It is not clear why the disassembler shows just 2 bytes decoded
Expectation is to have all the section (or say 1K) to be disassembled

Details

Drop a file onto the tool, go to the Section Editor
Locate .text section (this is a file compiled by MS VS)
Right click - Disassemble Section
just 2 bytes (CC) being disassembled:
http://prntscr.com/jg8go0

is it a known limitation or... ?

At the same time other sections when asked are showing way much more asm lines

@upiter
Copy link
Collaborator

upiter commented May 17, 2018

Disasm is usually stopped in case of ret or many int 3 or nop instructions.

@upiter upiter added the wontfix label May 17, 2018
@greenozon
Copy link
Author

why is that reasoning?
.text section has code
and disasm decodes just 2 bytes?
thats terrible feature...

@upiter
Copy link
Collaborator

upiter commented May 17, 2018

  1. Reason is not to disasm garbage bytes.
  2. If you need to disasm code, disasm at entry point (Optional Header > Entry Point, press D button at the right side of EP value).

May be we'll add:

  • Option to set how many bytes to disasm regardless of presence of stop-bytes.
  • Start address in disasm dialog to disasm from any address within SizeOfImage

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants