1NDISASM(1)               The Netwide Assembler Project              NDISASM(1)
2
3
4

NAME

6       ndisasm - the Netwide Disassembler, an 80x86 binary file disassembler
7

SYNOPSIS

9       ndisasm [ -o origin ] [ -s sync-point [...]] [ -a | -i ] [ -b bits ] [
10       -u ] [ -e hdrlen ] [ -p vendor ] [ -k offset,length [...]] infile
11

DESCRIPTION

13       The ndisasm command generates a disassembly listing of the binary file
14       infile and directs it to stdout.
15

OPTIONS

17       -h
18           Causes ndisasm to exit immediately, after giving a summary of its
19           invocation options.
20
21       -r|-v
22           Causes ndisasm to exit immediately, after displaying its version
23           number.
24
25       -o origin
26           Specifies the notional load address for the file. This option
27           causes ndisasm to get the addresses it lists down the left hand
28           margin, and the target addresses of PC-relative jumps and calls,
29           right.
30
31       -s sync-point
32           Manually specifies a synchronisation address, such that ndisasm
33           will not output any machine instruction which encompasses bytes on
34           both sides of the address. Hence the instruction which starts at
35           that address will be correctly disassembled.
36
37       -e hdrlen
38           Specifies a number of bytes to discard from the beginning of the
39           file before starting disassembly. This does not count towards the
40           calculation of the disassembly offset: the first disassembled
41           instruction will be shown starting at the given load address.
42
43       -k offset,length
44           Specifies that length bytes, starting from disassembly offset
45           offset, should be skipped over without generating any output. The
46           skipped bytes still count towards the calculation of the
47           disassembly offset.
48
49       -a|-i
50           Enables automatic (or intelligent) sync mode, in which ndisasm will
51           attempt to guess where synchronisation should be performed, by
52           means of examining the target addresses of the relative jumps and
53           calls it disassembles.
54
55       -b bits
56           Specifies 16-, 32- or 64-bit mode. The default is 16-bit mode.
57
58       -u
59           Specifies 32-bit mode, more compactly than using ‘-b 32’.
60
61       -p vendor
62           Prefers instructions as defined by vendor in case of a conflict.
63           Known vendor names include intel, amd, cyrix, and idt. The default
64           is intel.
65

RESTRICTIONS

67       ndisasm only disassembles binary files: it has no understanding of the
68       header information present in object or executable files. If you want
69       to disassemble an object file, you should probably be using objdump(1).
70
71       Auto-sync mode won’t necessarily cure all your synchronisation
72       problems: a sync marker can only be placed automatically if a jump or
73       call instruction is found to refer to it before ndisasm actually
74       disassembles that part of the code. Also, if spurious jumps or calls
75       result from disassembling non-machine-code data, sync markers may get
76       placed in strange places. Feel free to turn auto-sync off and go back
77       to doing it manually if necessary.
78

SEE ALSO

80       objdump(1)
81
82
83
84NASM                              08/28/2020                        NDISASM(1)
Impressum