NDISASM(1) NDISASM(1)

NAME
       ndisasm - the Netwide Disassembler, an 80x86 binary file disassembler

SYNOPSIS
       nnddiissaassmm [ -oo origin ] [ -ss sync-point [...]]  [ -aa | -ii ] [ -bb bits ] [
       -uu ] [ -ee hdrlen ] [ -kk offset,length [...]]  infile
       nnddiissaassmm -hh
       nnddiissaassmm -rr

DESCRIPTION
       The nnddiissaassmm command generates a disassembly listing of the binary  file
       infile and directs it to stdout.

   OOPPTTIIOONNSS
       -hh     Causes  nnddiissaassmm  to  exit immediately, after giving a summary of
              its invocation options.

       -rr     Causes nnddiissaassmm to exit immediately, after displaying its version
              number.

       -oo origin
              Specifies  the  notional  load address for the file. This option
              causes nnddiissaassmm to get the addresses it lists down the left  hand
              margin, and the target addresses of PC-relative jumps and calls,
              right.

       -ss sync-point
              Manually specifies a synchronisation address, such that  nnddiissaassmm
              will  not output any machine instruction which encompasses bytes
              on both sides of the address. Hence the instruction which starts
              at that address will be correctly disassembled.

       -ee hdrlen
              Specifies a number of bytes to discard from the beginning of the
              file before starting disassembly. This does  not  count  towards
              the  calculation  of the disassembly offset: the first disassem-
              bled instruction will  be  shown  starting  at  the  given  load
              address.

       -kk offset,length
              Specifies  that  length  bytes, starting from disassembly offset
              offset, should be skipped over without  generating  any  output.
              The  skipped  bytes  still  count towards the calculation of the
              disassembly offset.

       -aa or -ii
              Enables automatic (or intelligent) sync mode, in  which  nnddiissaassmm
              will attempt to guess where synchronisation should be performed,
              by means of examining the target addresses of the relative jumps
              and calls it disassembles.

       -bb bits
              Specifies  either  16-bit  or 32-bit mode. The default is 16-bit
              mode.

       -uu     Specifies 32-bit mode, more compactly than using `-b 32'.

       -pp vendor
              Prefers instructions as defined by vendor in case of a conflict.
              Known  vendor  names  include  iinntteell,  aammdd, ccyyrriixx, and iiddtt.  The
              default is iinntteell.


RREESSTTRRIICCTTIIOONNSS
       nnddiissaassmm only disassembles binary files: it has no understanding of  the
       header  information  present in object or executable files. If you want
       to disassemble an object file, you should probably be using oobbjjdduummpp(11).

       Auto-sync  mode  won't  necessarily cure all your synchronisation prob-
       lems: a sync marker can only be placed automatically if a jump or  call
       instruction  is  found to refer to it before nnddiissaassmm actually disassem-
       bles that part of the code. Also, if spurious  jumps  or  calls  result
       from  disassembling  non-machine-code data, sync markers may get placed
       in strange places. Feel free to turn auto-sync off and go back to doing
       it manually if necessary.

       nnddiissaassmm  can  only  keep track of 8192 sync markers internally at once:
       this is to do with portability, since DOS machines don't take kindly to
       more than 64K being allocated at a time.


SEE ALSO
       oobbjjdduummpp(11).



                         The Netwide Assembler Project              NDISASM(1)