NDISASM(1)

📦
version 3.02 · 6 versions
, in arch rolling, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0

💅 NDISASM(1) — the Netwide Disassembler, bestie edition 🦋

okay so you found a mystery binary and you want to know what it's saying? say less. this is ndisasm, the Netwide Disassembler, and it's an 80x86 binary file disassembler from the Netwide Assembler project. it takes raw bytes and turns them back into assembly, which is honestly iconic behaviour. ✨

🌸 SYNOPSIS 🌸

ndisasm [ -o origin ] [ -s sync-point [...]] [ -a | -i ] [ -b bits ] [
-u ] [ -e hdrlen ] [ -p vendor ] [ -k offset,length [...]] infile

yes queen, that's a lot of brackets, but every single one of them is optional except the poor little infile at the end who has no choice. 🫶

💖 DESCRIPTION 💖

the ndisasm command generates a disassembly listing of the binary file infile, and then it directs that listing straight to stdout. that's it, that's the whole job, and it does it flawlessly, no cap.

✨ OPTIONS ✨

every flag, every value, nothing skipped, we don't gatekeep here 💅

  • -h — makes ndisasm exit immediately, but only after it's given you a lil summary of its invocation options. so it's like "here's the menu, bye bestie 👋".
  • -r | -v — also makes ndisasm exit immediately, but this time after it flexes its version number at you. periodt.
  • -o origin — sets the notional load address for the file. this one is lowkey important: it makes ndisasm get the addresses it lists down the left hand margin right, and also the target addresses of PC-relative jumps and calls right. without it, everything's just vibing at the wrong address. 💀
  • -s sync-point — manually specifies a synchronisation address, so that ndisasm will not output any machine instruction that encompasses bytes on both sides of that address. the payoff? the instruction that starts at that address gets correctly disassembled. slay. 🎀
  • -e hdrlen — specifies a number of bytes to discard from the beginning of the file before disassembly starts. important caveat, don't miss this: this does not count towards the calculation of the disassembly offset — the first disassembled instruction will be shown starting at the given load address. ✨
  • -k offset,length — says: skip length bytes, starting from disassembly offset offset, without generating any output. but (and this is the sneaky part) the skipped bytes still count towards the calculation of the disassembly offset. 👑
  • -a | -i — enables automatic (or intelligent) sync mode, where ndisasm tries to guess where synchronisation should happen by examining the target addresses of the relative jumps and calls that it disassembles. it's giving detective energy 🔍.
  • -b bits — specifies 16-, 32- or 64-bit mode. the default is 16-bit mode. 🌈
  • -u — specifies 32-bit mode, but more compactly than writing out -b 32. lazy girl math and we respect it. 💅
  • -p vendor — prefers instructions as defined by vendor in case of a conflict. known vendor names include intel, amd, cyrix, and idt. the default is intel. 🧚

🙈 RESTRICTIONS 🙈

listen. ndisasm only disassembles binary files. it has no understanding of the header information present in object or executable files. so if you want to disassemble an object file, you should probably be using objdump(1) instead. i'm just the messenger bestie 😭

auto-sync mode won't necessarily cure all your synchronisation problems either, and here's why: a sync marker can only be placed automatically if a jump or call instruction is found to refer to it before ndisasm actually disassembles that part of the code. also, if spurious jumps or calls result from disassembling non-machine-code data, sync markers may get placed in strange places. 🍓

feel free to turn auto-sync off and go back to doing it manually if necessary. no shame in the manual grind. 🫶

🔥 SEE ALSO 🔥

💜 sign-off 💜

that's the whole page, bestie — this lil masterpiece is from NASM (The Netwide Assembler Project), dated 06/28/2026. go disassemble something iconic, you've got this. 💖✨🎀

📦 where this page comes from