petools icon indicating copy to clipboard operation
petools copied to clipboard

Section Editor - Disassembler decodes just 2 bytes

Open greenozon opened this issue 7 years ago • 3 comments

Info

It is not clear why the disassembler shows just 2 bytes decoded Expectation is to have all the section (or say 1K) to be disassembled

Details

Drop a file onto the tool, go to the Section Editor Locate .text section (this is a file compiled by MS VS) Right click - Disassemble Section just 2 bytes (CC) being disassembled: http://prntscr.com/jg8go0

is it a known limitation or... ?

At the same time other sections when asked are showing way much more asm lines

greenozon avatar May 10 '18 17:05 greenozon

Disasm is usually stopped in case of ret or many int 3 or nop instructions.

upiter avatar May 17 '18 17:05 upiter

why is that reasoning? .text section has code and disasm decodes just 2 bytes? thats terrible feature...

greenozon avatar May 17 '18 17:05 greenozon

  1. Reason is not to disasm garbage bytes.
  2. If you need to disasm code, disasm at entry point (Optional Header > Entry Point, press D button at the right side of EP value).

May be we'll add:

  • Option to set how many bytes to disasm regardless of presence of stop-bytes.
  • Start address in disasm dialog to disasm from any address within SizeOfImage

upiter avatar May 17 '18 18:05 upiter