1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
|
NDISASM(1) NDISASM(1)
NNAAMMEE
ndisasm - the Netwide Disassembler - 80x86 binary file disassembler
SSYYNNOOPPSSIISS
nnddiissaassmm [ --oo origin ] [ --ss sync‐point [...]] [ --aa | --ii ] [ --bb bits ] [
‐‐uu ] [ --ee hdrlen ] [ --kk offset,length [...]] infile
nnddiissaassmm --hh
nnddiissaassmm --rr
DDEESSCCRRIIPPTTIIOONN
The nnddiissaassmm command generates a disassembly listing of the binary file
_i_n_f_i_l_e and directs it to stdout.
OOPPTTIIOONNSS
--hh Causes nnddiissaassmm to exit immediately, after giving a summary of
its invocation options.
--rr Causes nnddiissaassmm to exit immediately, after displaying its version
number.
--oo _o_r_i_g_i_n
Specifies the notional load address for the file. This option
causes nnddiissaassmm to get the addresses it lists down the left hand
margin, and the target addresses of PC‐relative jumps and calls,
right.
--ss _s_y_n_c_‐_p_o_i_n_t
Manually specifies a synchronisation address, such that nnddiissaassmm
will not output any machine instruction which encompasses bytes
on both sides of the address. Hence the instruction which _s_t_a_r_t_s
at that address will be correctly disassembled.
--ee _h_d_r_l_e_n
Specifies a number of bytes to discard from the beginning of the
file before starting disassembly. This does not count towards
the calculation of the disassembly offset: the first _d_i_s_a_s_s_e_m_‐
_b_l_e_d instruction will be shown starting at the given load
address.
--kk _o_f_f_s_e_t_,_l_e_n_g_t_h
Specifies that _l_e_n_g_t_h bytes, starting from disassembly offset
_o_f_f_s_e_t, should be skipped over without generating any output.
The skipped bytes still count towards the calculation of the
disassembly offset.
--aa or --ii
Enables automatic (or intelligent) sync mode, in which nnddiissaassmm
will attempt to guess where synchronisation should be performed,
by means of examining the target addresses of the relative jumps
and calls it disassembles.
--bb _b_i_t_s
Specifies either 16‐bit or 32‐bit mode. The default is 16‐bit
mode.
--uu Specifies 32‐bit mode, more compactly than using ‘‐b 32’.
--pp _v_e_n_d_o_r
Prefers instructions as defined by _v_e_n_d_o_r in case of a conflict.
Known _v_e_n_d_o_r names include iinntteell, aammdd, ccyyrriixx, and iiddtt. The
default is iinntteell.
RREESSTTRRIICCTTIIOONNSS
nnddiissaassmm only disassembles binary files: it has no understanding of the
header information present in object or executable files. If you want
to disassemble an object file, you should probably be using oobbjjdduummpp(11).
Auto‐sync mode won’t necessarily cure all your synchronisation prob‐
lems: a sync marker can only be placed automatically if a jump or call
instruction is found to refer to it _b_e_f_o_r_e nnddiissaassmm actually disassem‐
bles that part of the code. Also, if spurious jumps or calls result
from disassembling non‐machine‐code data, sync markers may get placed
in strange places. Feel free to turn auto‐sync off and go back to doing
it manually if necessary.
nnddiissaassmm can only keep track of 8192 sync markers internally at once:
this is to do with portability, since DOS machines don’t take kindly to
more than 64K being allocated at a time.
SSEEEE AALLSSOO
oobbjjdduummpp(11).
The Netwide Assembler Project NDISASM(1)
|
