Section 1: ndisasm



This page was been converted automatically, from Debian GNU/Linux man pages.




NDISASM(1)                                             NDISASM(1)


NAME

ndisasm - the Netwide Disassembler - 80x86 binary file disassembler

SYNOPSIS

ndisasm [ -o origin ] [ -s sync-point [...]] [ -a | -i ] [ -b bits ] [ -u ] [ -e hdrlen ] [ -k offset,length [...]] infile ndisasm -h ndisasm -r

DESCRIPTION

The ndisasm command generates a disassembly listing of the binary file infile and directs it to stdout. OPTIONS -h Causes ndisasm to exit immediately, after giving a summary of its invocation options. -r Causes ndisasm to exit immediately, after display- ing its version number. -o origin Specifies the notional load address for the file. This option causes ndisasm to get the addresses it lists down the left hand margin, and the target addresses of PC-relative jumps and calls, right. -s sync-point Manually specifies a synchronisation address, such that ndisasm will not output any machine instruc- tion which encompasses bytes on both sides of the address. Hence the instruction which starts at that address will be correctly disassembled. -e hdrlen Specifies a number of bytes to discard from the beginning of the file before starting disassembly. This does not count towards the calculation of the disassembly offset: the first disassembled instruc- tion will be shown starting at the given load address. -k offset,length Specifies that length bytes, starting from disas- sembly offset offset, should be skipped over with- out generating any output. The skipped bytes still count towards the calculation of the disassembly offset. -a or -i Enables automatic (or intelligent) sync mode, in which ndisasm will attempt to guess where synchro- nisation should be performed, by means of examining The Netwide Assembler Project 1 NDISASM(1) NDISASM(1) the target addresses of the relative jumps and calls it disassembles. -b bits Specifies either 16-bit or 32-bit mode. The default is 16-bit mode. -u Specifies 32-bit mode, more compactly than using `-b 32'. -p vendor Prefers instructions as defined by vendor in case of a conflict. Known vendor names include intel, amd, cyrix, and idt. The default is intel.

RESTRICTIONS

ndisasm only disassembles binary files: it has no under- standing of the header information present in object or executable files. If you want to disassemble an object file, you should probably be using objdump(1). Auto-sync mode won't necessarily cure all your synchroni- sation problems: a sync marker can only be placed automat- ically if a jump or call instruction is found to refer to it before ndisasm actually disassembles that part of the code. Also, if spurious jumps or calls result from disas- sembling non-machine-code data, sync markers may get placed in strange places. Feel free to turn auto-sync off and go back to doing it manually if necessary. ndisasm can only keep track of 8192 sync markers inter- nally at once: this is to do with portability, since DOS machines don't take kindly to more than 64K being allo- cated at a time. SEE ALSO objdump(1). The Netwide Assembler Project 2