MAN page from Trustix nasm-0.98-4tr.i586.rpm
Section: User Commands (1)
Updated: The Netwide Assembler ProjectIndex
ndisasm - the Netwide Disassembler - 80x86 binary file disassembler
offset,length [...]]infilendisasm -hndisasm -r
command generates a disassembly listing of the binary fileinfile
and directs it to stdout.
- Causesndisasmto exit immediately, after giving a summary of its invocationoptions.
- Causesndisasmto exit immediately, after displaying its version number.
- -o origin
- Specifies the notional load address for the file. This option causesndisasmto get the addresses it lists down the left hand margin, and thetarget addresses of PC-relative jumps and calls, right.
- -s sync-point
- Manually specifies a synchronisation address, such thatndisasmwill not output any machine instruction which encompasses bytes onboth sides of the address. Hence the instruction whichstartsat that address will be correctly disassembled.
- -e hdrlen
- Specifies a number of bytes to discard from the beginning of thefile before starting disassembly. This does not count towards thecalculation of the disassembly offset: the firstdisassembledinstruction will be shown starting at the given load address.
- -k offset,length
- Specifies thatlengthbytes, starting from disassembly offsetoffset,should be skipped over without generating any output. The skippedbytes still count towards the calculation of the disassembly offset.
- -a or -i
- Enables automatic (or intelligent) sync mode, in whichndisasmwill attempt to guess where synchronisation should be performed, bymeans of examining the target addresses of the relative jumps andcalls it disassembles.
- -b bits
- Specifies either 16-bit or 32-bit mode. The default is 16-bit mode.
- Specifies 32-bit mode, more compactly than using `-b 32'.
- -p vendor
- Prefers instructions as defined byvendorin case of a conflict. Knownvendornames includeintel,amd,cyrix,andidt.The default isintel.
only disassembles binary files: it has no understanding of theheader information present in object or executable files. If youwant to disassemble an object file, you should probably be usingobjdump
Auto-sync mode won't necessarily cure all your synchronisationproblems: a sync marker can only be placed automatically if a jumpor call instruction is found to refer to itbeforendisasmactually disassembles that part of the code. Also, if spurious jumpsor calls result from disassembling non-machine-code data, syncmarkers may get placed in strange places. Feel free to turnauto-sync off and go back to doing it manually if necessary.
ndisasmcan only keep track of 8192 sync markers internally at once: this isto do with portability, since DOS machines don't take kindly to morethan 64K being allocated at a time.
- SEE ALSO
This document was created byman2html,using the manual pages.