Next Chapter | Previous Chapter | Contents | Index
The Netwide Disassembler, NDISASM
The Netwide Disassembler is a small companion program to the Netwide Assembler, NASM. It seemed a shame to have an x86 assembler, complete with a full instruction table, and not make as much use of it as possible, so here's a disassembler which shares the instruction table (and some other bits of code) with NASM.
The Netwide Disassembler does nothing except to produce disassemblies of
binary source files. NDISASM does not have any understanding of
object file formats, like 
See section 1.3 for installation
instructions. NDISASM, like NASM, has a 
To disassemble a file, you will typically use a command of the form
       ndisasm -b {16|32|64} filename
NDISASM can disassemble 16-, 32- or 64-bit code equally easily, provided
of course that you remember to specify which it is to work with. If no
Two more command line options are 
To disassemble a 
The 
Hence, to disassemble a 
       ndisasm -o100h filename.com
will do the trick.
Suppose you are disassembling a file which contains some data which
isn't machine code, and then contains some machine code. NDISASM
will faithfully plough through the data section, producing machine
instructions wherever it can (although most of them will look bizarre, and
some may have unusual prefixes, e.g.
`
Supposing NDISASM has just finished generating a strange machine instruction from part of the data section, and its file position is now one byte before the beginning of the code section. It's entirely possible that another spurious instruction will get generated, starting with the final byte of the data section, and then the correct first instruction in the code section will not be seen because the starting point skipped over it. This isn't really ideal.
To avoid this, you can specify a
`
Sync points are specified using the 
       ndisasm -o100h -s120h file.com
rather than
       ndisasm -o100h -s20h file.com
As stated above, you can specify multiple sync markers if you need to,
just by repeating the 
Suppose you are disassembling the boot sector of a
On the other hand, why should you have to specify the sync point
manually? What you'd do in order to find where the sync point would be,
surely, would be to read the 
The answer, of course, is yes: using either of the synonymous switches
Only PC-relative jumps are processed, since an absolute jump is either through a register (in which case NDISASM doesn't know what the register contains) or involves a segment address (in which case the target code isn't in the same segment that NDISASM is working in, and so the sync point can't be placed anywhere useful).
For some kinds of file, this mechanism will automatically put sync points in all the right places, and save you from having to place any sync points manually. However, it should be stressed that auto-sync mode is not guaranteed to catch all the sync points, and you may still have to place some manually.
Auto-sync mode doesn't prevent you from declaring manual sync points: it
just adds automatically generated ones to the ones you provide. It's
perfectly feasible to specify 
Another caveat with auto-sync mode is that if, by some unpleasant fluke,
something in your data section should disassemble to a PC-relative call or
jump instruction, NDISASM may obediently place a sync point in a totally
random place, for example in the middle of one of the instructions in your
code section. So you may end up with a wrong disassembly even if you use
auto-sync. Again, there isn't much I can do about this. If you have
problems, you'll have to use manual sync points, or use the
The 
The 
There are no known bugs. However, any you find, with patches if
possible, should be sent to