1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
|
From: Jordan Justen <jordan.l.justen@intel.com>
Date: Sun, 29 Jan 2017 17:39:54 -0800
Subject: [PATCH] debian: debian/patches/03-ndisasm.man.patch
Note: I (Jordan) did not author this patch. I'm just adding it to git.
Signed-off-by: Jordan Justen <jordan.l.justen@intel.com>
---
ndisasm.man | 91 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 91 insertions(+)
create mode 100644 ndisasm.man
diff --git a/ndisasm.man b/ndisasm.man
new file mode 100644
index 0000000..3228903
--- /dev/null
+++ b/ndisasm.man
@@ -0,0 +1,91 @@
+NDISASM(1) NDISASM(1)
+
+
+
+NNAAMMEE
+ ndisasm - the Netwide Disassembler - 80x86 binary file disassembler
+
+SSYYNNOOPPSSIISS
+ nnddiissaassmm [ --oo origin ] [ --ss sync‐point [...]] [ --aa | --ii ] [ --bb bits ] [
+ ‐‐uu ] [ --ee hdrlen ] [ --kk offset,length [...]] infile
+ nnddiissaassmm --hh
+ nnddiissaassmm --rr
+
+DDEESSCCRRIIPPTTIIOONN
+ The nnddiissaassmm command generates a disassembly listing of the binary file
+ _i_n_f_i_l_e and directs it to stdout.
+
+ OOPPTTIIOONNSS
+ --hh Causes nnddiissaassmm to exit immediately, after giving a summary of
+ its invocation options.
+
+ --rr Causes nnddiissaassmm to exit immediately, after displaying its version
+ number.
+
+ --oo _o_r_i_g_i_n
+ Specifies the notional load address for the file. This option
+ causes nnddiissaassmm to get the addresses it lists down the left hand
+ margin, and the target addresses of PC‐relative jumps and calls,
+ right.
+
+ --ss _s_y_n_c_‐_p_o_i_n_t
+ Manually specifies a synchronisation address, such that nnddiissaassmm
+ will not output any machine instruction which encompasses bytes
+ on both sides of the address. Hence the instruction which _s_t_a_r_t_s
+ at that address will be correctly disassembled.
+
+ --ee _h_d_r_l_e_n
+ Specifies a number of bytes to discard from the beginning of the
+ file before starting disassembly. This does not count towards
+ the calculation of the disassembly offset: the first _d_i_s_a_s_s_e_m_‐
+ _b_l_e_d instruction will be shown starting at the given load
+ address.
+
+ --kk _o_f_f_s_e_t_,_l_e_n_g_t_h
+ Specifies that _l_e_n_g_t_h bytes, starting from disassembly offset
+ _o_f_f_s_e_t, should be skipped over without generating any output.
+ The skipped bytes still count towards the calculation of the
+ disassembly offset.
+
+ --aa or --ii
+ Enables automatic (or intelligent) sync mode, in which nnddiissaassmm
+ will attempt to guess where synchronisation should be performed,
+ by means of examining the target addresses of the relative jumps
+ and calls it disassembles.
+
+ --bb _b_i_t_s
+ Specifies either 16‐bit or 32‐bit mode. The default is 16‐bit
+ mode.
+
+ --uu Specifies 32‐bit mode, more compactly than using ‘‐b 32’.
+
+ --pp _v_e_n_d_o_r
+ Prefers instructions as defined by _v_e_n_d_o_r in case of a conflict.
+ Known _v_e_n_d_o_r names include iinntteell, aammdd, ccyyrriixx, and iiddtt. The
+ default is iinntteell.
+
+
+RREESSTTRRIICCTTIIOONNSS
+ nnddiissaassmm only disassembles binary files: it has no understanding of the
+ header information present in object or executable files. If you want
+ to disassemble an object file, you should probably be using oobbjjdduummpp(11).
+
+ Auto‐sync mode won’t necessarily cure all your synchronisation prob‐
+ lems: a sync marker can only be placed automatically if a jump or call
+ instruction is found to refer to it _b_e_f_o_r_e nnddiissaassmm actually disassem‐
+ bles that part of the code. Also, if spurious jumps or calls result
+ from disassembling non‐machine‐code data, sync markers may get placed
+ in strange places. Feel free to turn auto‐sync off and go back to doing
+ it manually if necessary.
+
+ nnddiissaassmm can only keep track of 8192 sync markers internally at once:
+ this is to do with portability, since DOS machines don’t take kindly to
+ more than 64K being allocated at a time.
+
+
+SSEEEE AALLSSOO
+ oobbjjdduummpp(11).
+
+
+
+ The Netwide Assembler Project NDISASM(1)
|
