Section 1: ndisasm
This page was been converted automatically, from Debian GNU/Linux
man pages.
NDISASM(1) NDISASM(1)
NAME
ndisasm - the Netwide Disassembler - 80x86 binary file
disassembler
SYNOPSIS
ndisasm [ -o origin ] [ -s sync-point [...]] [ -a | -i ]
[ -b bits ] [ -u ] [ -e hdrlen ] [ -k offset,length [...]]
infile
ndisasm -h
ndisasm -r
DESCRIPTION
The ndisasm command generates a disassembly listing of the
binary file infile and directs it to stdout.
OPTIONS
-h Causes ndisasm to exit immediately, after giving a
summary of its invocation options.
-r Causes ndisasm to exit immediately, after display-
ing its version number.
-o origin
Specifies the notional load address for the file.
This option causes ndisasm to get the addresses it
lists down the left hand margin, and the target
addresses of PC-relative jumps and calls, right.
-s sync-point
Manually specifies a synchronisation address, such
that ndisasm will not output any machine instruc-
tion which encompasses bytes on both sides of the
address. Hence the instruction which starts at that
address will be correctly disassembled.
-e hdrlen
Specifies a number of bytes to discard from the
beginning of the file before starting disassembly.
This does not count towards the calculation of the
disassembly offset: the first disassembled instruc-
tion will be shown starting at the given load
address.
-k offset,length
Specifies that length bytes, starting from disas-
sembly offset offset, should be skipped over with-
out generating any output. The skipped bytes still
count towards the calculation of the disassembly
offset.
-a or -i
Enables automatic (or intelligent) sync mode, in
which ndisasm will attempt to guess where synchro-
nisation should be performed, by means of examining
The Netwide Assembler Project 1
NDISASM(1) NDISASM(1)
the target addresses of the relative jumps and
calls it disassembles.
-b bits
Specifies either 16-bit or 32-bit mode. The default
is 16-bit mode.
-u Specifies 32-bit mode, more compactly than using
`-b 32'.
-p vendor
Prefers instructions as defined by vendor in case
of a conflict. Known vendor names include intel,
amd, cyrix, and idt. The default is intel.
RESTRICTIONS
ndisasm only disassembles binary files: it has no under-
standing of the header information present in object or
executable files. If you want to disassemble an object
file, you should probably be using objdump(1).
Auto-sync mode won't necessarily cure all your synchroni-
sation problems: a sync marker can only be placed automat-
ically if a jump or call instruction is found to refer to
it before ndisasm actually disassembles that part of the
code. Also, if spurious jumps or calls result from disas-
sembling non-machine-code data, sync markers may get
placed in strange places. Feel free to turn auto-sync off
and go back to doing it manually if necessary.
ndisasm can only keep track of 8192 sync markers inter-
nally at once: this is to do with portability, since DOS
machines don't take kindly to more than 64K being allo-
cated at a time.
SEE ALSO
objdump(1).
The Netwide Assembler Project 2