Disassembly Basics

Disassembly converts a binary's machine code back into human-readable assembly instructions. It lets you read exactly what the CPU will execute.

This is essential when source code is unavailable, as is always the case with malware.

Disassembly produces assembly. Decompilation goes further, reconstructing approximate high-level C-like pseudocode.

Pseudocode is faster to read; assembly is precise. Analysts use both, switching as needed.

Ghidra is a free, open-source reverse engineering suite from the NSA. It disassembles many architectures and includes a strong decompiler.

Its price and capabilities make it the go-to starting tool for most analysts.

IDA Pro is the long-standing commercial standard, known for its powerful disassembler and (with the Hex-Rays plugin) decompiler.

IDA Free and other tools like Binary Ninja and radare2/Cutter are popular alternatives.

You import the sample into the tool, which auto-analyzes it: identifying functions, cross-references, and strings.

The tool builds a map of the program you can navigate, starting from the entry point or interesting imports.

Assembly instructions move and operate on data. A few common x86 ones:

• mov: copy data.
• push / pop: stack operations.
• call / ret: function call and return.
• cmp / jmp / je: comparison and branching.

Cross-references (xrefs) show where a function or string is used. Finding xrefs to a suspicious API like CreateRemoteThread jumps you straight to the relevant code.

This lets you navigate by behavior rather than reading top to bottom.

Imported Windows API calls reveal intent. Seeing VirtualAlloc then WriteProcessMemory then CreateRemoteThread is a classic process injection sequence.

Recognizing these patterns is the heart of malware reversing.

Disassemblers offer a graph view showing basic blocks and the branches between them. This visualizes a function's control flow, making loops and conditionals easy to follow.

It is far more readable than a linear instruction listing for complex logic.

Static disassembly pairs well with a debugger. When code is obfuscated or self-modifying, you can set breakpoints and step through it at runtime to see the real instructions.

This bridge to dynamic analysis is crucial for packed samples, which the next lesson covers.

As you understand functions and variables, rename them and add comments in the disassembler. Turning sub_401000 into decrypt_config makes the rest of the analysis far easier.

This incremental labeling is how analysts gradually reconstruct a malware sample's full logic.

Recall the difference between Ghidra's two main outputs.

You now understand disassembly basics:

• Disassembly yields assembly; decompilation yields pseudocode.
• Ghidra (free) and IDA Pro are the main tools.
• Use cross-references and API call patterns (like injection sequences) to navigate by behavior.
• Graph view visualizes control flow; pair with a debugger for obfuscated code.

Next you will defeat packers with unpacking.