ndisasm - the Netwide Disassembler - 80x86 binary file disassembler
ndisasm [ -o origin ] [ -s sync-point [...]] [ -a | -i ] [ -b bits ] [ -u ] [ -e hdrlen ]
[ -k offset,length [...]] infile
The ndisasm command generates a disassembly listing of the binary file infile and directs
it to stdout.
-h Causes ndisasm to exit immediately, after giving a summary of its invocation
-r Causes ndisasm to exit immediately, after displaying its version number.
Specifies the notional load address for the file. This option causes ndisasm to get
the addresses it lists down the left hand margin, and the target addresses of PC-
relative jumps and calls, right.
Manually specifies a synchronisation address, such that ndisasm will not output any
machine instruction which encompasses bytes on both sides of the address. Hence the
instruction which starts at that address will be correctly disassembled.
Specifies a number of bytes to discard from the beginning of the file before start-
ing disassembly. This does not count towards the calculation of the disassembly
offset: the first disassembled instruction will be shown starting at the given load
Specifies that length bytes, starting from disassembly offset offset, should be
skipped over without generating any output. The skipped bytes still count towards
the calculation of the disassembly offset.
-a or -i
Enables automatic (or intelligent) sync mode, in which ndisasm will attempt to
guess where synchronisation should be performed, by means of examining the target
addresses of the relative jumps and calls it disassembles.
Specifies either 16-bit or 32-bit mode. The default is 16-bit mode.
-u Specifies 32-bit mode, more compactly than using `-b 32'.
Prefers instructions as defined by vendor in case of a conflict. Known vendor
names include intel, amd, cyrix, and idt. The default is intel.
ndisasm only disassembles binary files: it has no understanding of the header information
present in object or executable files. If you want to disassemble an object file, you
should probably be using objdump(1).
Auto-sync mode won't necessarily cure all your synchronisation problems: a sync marker can
only be placed automatically if a jump or call instruction is found to refer to it before
ndisasm actually disassembles that part of the code. Also, if spurious jumps or calls
result from disassembling non-machine-code data, sync markers may get placed in strange
places. Feel free to turn auto-sync off and go back to doing it manually if necessary.
ndisasm can only keep track of 8192 sync markers internally at once: this is to do with
portability, since DOS machines don't take kindly to more than 64K being allocated at a
The Netwide Assembler Project NDISASM(1)