Disassembly View

Work with disassembled code in the Ghidra listing view

Listing View Overview

The listing view is the primary window for examining disassembled code, displaying instructions, data, and program structure.

The listing is rendered using the ListingPanel component with a configurable FormatManager that controls how program information is displayed.

Understanding the Listing Display

Field Layout

The listing displays multiple fields for each code unit:

Address Field

Shows memory addresses where code and data reside:

• Hexadecimal format by default
• Supports multiple address spaces
• Physical and virtual addresses
• Overlay address spaces

Bytes Field

Raw bytes from memory:

• Hexadecimal byte values
• Configurable number of bytes displayed
• Shows instruction encoding
• Data representation

Mnemonic Field

Instruction mnemonics:

• Assembly instruction names (MOV, CALL, JMP, etc.)
• Processor-specific instructions
• Color-coded by instruction type
• Shows data type names for defined data

Operands Field

Instruction operands and parameters:

• Register names
• Immediate values
• Memory references
• Symbolic names when available

Navigation in Disassembly

1. Cursor Movement

   Navigate through code using keyboard shortcuts:

   • Arrow Keys: Move cursor up/down/left/right
   • Page Up/Down: Scroll by page
   • Ctrl + Home/End: Jump to program start/end
   • Home/End: Move to line start/end
2. Follow Flow

   Track program flow:

   • Enter on a call: Jump to called function
   • Enter on a jump: Follow jump target
   • Enter on data reference: Navigate to referenced data
   • View flow arrows showing branching
3. Return to Origin

   Use navigation history:

   • Alt + Left: Return to previous location
   • Alt + Right: Go forward in history
   • History maintained across all navigation

Disassembly Actions

Creating Instructions

1. Disassemble

   Convert undefined bytes to instructions:

   • Press D on undefined bytes
   • Right-click > Disassemble
   • Auto-analysis handles most disassembly
2. Clear Code

   Remove incorrect disassembly:

   • Press C to clear code units
   • Right-click > Clear Code Bytes
   • Reverts to undefined bytes
3. Re-disassemble

   Fix disassembly errors:

   • Clear incorrect instructions
   • Set correct processor context
   • Disassemble with proper settings

Use the RepairDisassemblyScript.java for automated fixing of common disassembly issues.

Working with Data

1. Define Data

   Convert bytes to data types:

   • Press B for byte
   • Press W for word (2 bytes)
   • Press D then W for dword (4 bytes)
   • Press T to choose data type
2. Create Arrays

   Define array structures:

   • Select bytes for array
   • Right-click > Data > Create Array
   • Specify element count and type
3. Define Strings

   Mark string data:

   • Right-click > Data > String
   • Auto-detection of string termination
   • Support for Unicode strings

Code Units

Ghidra organizes memory into code units:

• Instructions: Disassembled assembly code
• Defined Data: Typed data (integers, strings, structures)
• Undefined: Raw bytes not yet analyzed

Iterating Code Units

Programmatic access to code units:

// From IterateInstructionsScript.java
Listing listing = currentProgram.getListing();
InstructionIterator iter = listing.getInstructions(currentAddress, true);
while (iter.hasNext()) {
    Instruction inst = iter.next();
    // Process instruction
}

Selection and Highlighting

Creating Selections

1. Select Ranges

   Select address ranges:

   • Click and drag to select
   • Shift + Click to extend selection
   • Ctrl + A to select all
2. Select Functions

   Select entire functions:

   • Right-click in function > Select > Function
   • Ctrl + Shift + F for current function
   • Select by function name in Symbol Tree
3. Select by Pattern

   Use search to select:

   • Search for instructions or data
   • Results table allows selection
   • Select all matches at once

Highlighting

Highlight code for visual emphasis:

• Middle-mouse Highlight: Click middle mouse on tokens
• Search Highlights: Automatic highlighting of search results
• Cursor Highlights: Related instructions highlighted
• Custom Highlights: Apply via plugins

Highlighting is managed through the ProgramHighlightPluginEvent and FieldSelection mechanisms in the CodeBrowser.

Flow Arrows

Visualize program flow with arrows:

• Unconditional Jumps: Solid arrows
• Conditional Branches: Dashed arrows
• Calls: Different color/style
• Active Flow: Highlighted when cursor on branch

Enable flow arrows via the margin provider in the Code Browser options.

Comments and Annotations

Comment Types

EOL Comment

End-of-line comment:

• Press ; to add
• Appears at end of code line
• Brief annotations

Pre Comment

Comment before code:

• Press Shift + ; (pre)
• Multiple lines supported
• Function documentation

Post Comment

Comment after code:

• Detailed explanations
• Analysis notes
• Algorithm documentation

Plate Comment

Large separator comment:

• Visual section dividers
• Major functional blocks
• Module boundaries

Viewing Options

Format Configuration

1. Customize Display

   Configure listing appearance:

   • Edit > Tool Options > Listing Fields
   • Enable/disable fields
   • Adjust field order and width
2. Color Settings

   Customize syntax highlighting:

   • Edit > Tool Options > Listing Colors
   • Set colors for instructions, data, comments
   • Configure background colors
3. Font Settings

   Adjust text display:

   • Monospace font required
   • Configurable font size
   • Theme-based color schemes

Advanced Features

Context Register Tracking

For processors with mode changes (ARM/Thumb, etc.):

• Context registers determine disassembly mode
• Set via Set Register Values action
• Affects instruction interpretation
• Tracked by address range

Memory Blocks

View and navigate memory organization:

• Initialized vs uninitialized blocks
• Permissions (read, write, execute)
• Overlay blocks for multiple mappings
• Block viewer shows memory layout

Bookmarks

Mark important locations:

• Press Ctrl + D to add bookmark
• Categorize by type (analysis, note, warning)
• Bookmark window shows all marked locations
• Quick navigation to bookmarked addresses

Use bookmarks to mark areas requiring further analysis or to document important findings.