ndisasm(1) ========== :doctype: manpage :man source: NASM :man manual: The Netwide Assembler Project NAME ---- ndisasm - the Netwide Disassembler, an 80x86 binary file disassembler SYNOPSIS -------- *ndisasm* [ *-o* origin ] [ *-s* sync-point [...]] [ *-a* | *-i* ] [ *-b* bits ] [ *-u* ] [ *-e* hdrlen ] [ *-p* vendor ] [ *-k* offset,length [...]] infile DESCRIPTION ----------- The *ndisasm* command generates a disassembly listing of the binary file infile and directs it to stdout. OPTIONS ------- *-h*:: Causes *ndisasm* to exit immediately, after giving a summary of its invocation options. *-r*|*-v*:: Causes *ndisasm* to exit immediately, after displaying its version number. *-o* 'origin':: Specifies the notional load address for the file. This option causes *ndisasm* to get the addresses it lists down the left hand margin, and the target addresses of PC-relative jumps and calls, right. *-s* 'sync-point':: Manually specifies a synchronisation address, such that *ndisasm* will not output any machine instruction which encompasses bytes on both sides of the address. Hence the instruction which starts at that address will be correctly disassembled. *-e* 'hdrlen':: Specifies a number of bytes to discard from the beginning of the file before starting disassembly. This does not count towards the calculation of the disassembly offset: the first 'disassembled' instruction will be shown starting at the given load address. *-k* 'offset,length':: Specifies that 'length' bytes, starting from disassembly offset 'offset', should be skipped over without generating any output. The skipped bytes still count towards the calculation of the disassembly offset. *-a*|*-i*:: Enables automatic (or intelligent) sync mode, in which *ndisasm* will attempt to guess where synchronisation should be performed, by means of examining the target addresses of the relative jumps and calls it disassembles. *-b* 'bits':: Specifies 16-, 32- or 64-bit mode. The default is 16-bit mode. *-u*:: Specifies 32-bit mode, more compactly than using `-b 32'. *-p* 'vendor':: Prefers instructions as defined by 'vendor' in case of a conflict. Known 'vendor' names include *intel*, *amd*, *cyrix*, and *idt*. The default is *intel*. RESTRICTIONS ------------ *ndisasm* only disassembles binary files: it has no understanding of the header information present in object or executable files. If you want to disassemble an object file, you should probably be using *objdump*(1). Auto-sync mode won't necessarily cure all your synchronisation problems: a sync marker can only be placed automatically if a jump or call instruction is found to refer to it 'before' *ndisasm* actually disassembles that part of the code. Also, if spurious jumps or calls result from disassembling non-machine-code data, sync markers may get placed in strange places. Feel free to turn auto-sync off and go back to doing it manually if necessary. SEE ALSO -------- *objdump*(1)