PEDIS(1)

📦
version 0.85.1 · 2 versions
, in alpine 3.24, debian trixie, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 PEDIS(1) 💖

okay bestie, welcome to the General Commands Manual entry for pedis — yes it's manual page one, and yes we're gonna make it cute. sit down, grab a boba, let's go 🧋✨

✨ NAME ✨

pedis — disassemble PE sections and functions 🦋

🌸 SYNOPSIS 🌸

pedis [OPTIONS]...  pefile

💅 DESCRIPTION 💅

So pedis is a PE disassembler that's relying on the udis86 library, no cap. It can disassemble entire sections, functions, or literally any file position you want. She's part of pev, the PE file analysis toolkit — the whole friend group 🫶

And pefile? That's a PE32/PE32+ executable or dynamic linked library file, periodt.

🎀 OPTIONS 🎀

  • --att — set AT&T assembly syntax (default: Intel). yes, you can switch up the dialect 💅
  • -e, --entrypoint — disassemble the entire entrypoint function. main character energy fr fr 👑
  • -f, --format <text|csv|xml|html> — change output format (default: text).
  • -m, --mode <16|32|64> — disassembly mode (default: auto). let her guess or just tell her bestie 🌈
  • -i <number> — number of instructions to disassemble.
  • -n <number> — number of bytes to disassemble.
  • -o, --offset <offset> — disassemble at specified offset, either in decimal or hexadecimal format (prefixed with 0x).
  • -r, --rva <rva> — disassemble at specified RVA, either in decimal or hexadecimal format (prefixed with 0x).
  • -s, --section <name> — disassemble en entire section given.
  • -V, --version — show version. she's iconic, obviously 💖
  • --help — show this help. hi bestie 👋

🌟 EXAMPLES 🌟

Disassemble RVA 0x4c4df from putty.exe:

$ pedis -r 0x4c4df putty.exe

Disassembly the entrypoint of a 64-bit PE32+ wordpad.exe:

$ pedis -m 64 --entrypoint putty.exe

Disassembly in 16-bits mode, starting from offset 0x40, 32 bytes of code from game.exe:

$ pedis -m 16 -o 0x40 -n 32 game.exe

😭 REPORTING BUGS 😭

Please, check the latest development code and report at https://github.com/mentebinaria/readpe/issues

not me filing a bug report at 3am 💀 but fr, do check the latest dev code first bestie

🦋 SEE ALSO 🦋

ofs2rva(1), pehash(1), peldd(1), pepack(1), peres(1), pescan(1), pesec(1), pestr(1), readpe(1), rva2ofs(1)

the whole squad, all linked up, iykyk 🌈

Copyright (C) 2012 - 2020 pev authors. License GPLv2+: GNU GPL version 2 or later <https://www.gnu.org/licenses/gpl-2.0.txt>. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.

NO WARRANTY is in all caps for a reason bestie — no promises, to the extent permitted by law 🙈

and that's the whole page!! this was PEDIS(1) from the General Commands Manual — mwah, slay, go disassemble something 💖✨🎀

📦 where this page comes from