Disassembler Dump (disasmdump) v1.66 build 1701160 - 32-bit x86 disassembly dump tool
copyright (c) bytepointer.com 2017
freeware / GPL disassembler routines copyright (c) 2007-2013 Oleh Yuschuk
This program is free and open-source software. Please see the headers of the
bundled source code for licensing and other detailed information.
syntax:
disasmdump [options] [data_bytes]
[data_bytes]
data may be specified directly as zero-padded hex digits, where two hex
digits delineate each byte - spaces optional; e.g.: 90 33 C0 83 C4 04
[options]
**VISUAL**
-v - enable verbose output (PE info and ending totals summary)
-b - disassembler: show numeric constants as unprefixed base 10 values
-u - disassembler: uppercase output
-g - disassembler: show default segments
-1 - disable address column
-2 - disable opcode column
-3 - display character column (default=off)
-r - disable colors
-n <uint> - indent each disassembly line by this amount
-c <uint> - specify opcode column size (default=24)
-d <uint> - specify disassembly column size (default=32); affects position of
char column when specified
**INPUT SELECTION**
-f <file> - disassemble contents of specified file instead of on cmdline
-p - PE pointer mode; this mode requires an input file and alters the
the -a option behavior to take a pointer address instead of a
file offset; when -a is unspecified (or zero), disassembly begins
at the address of the module's code entry point. In this mode
the maximum amount of bytes that can be disassembled is to the
end of the PE section that contains the address.
-a <uint> - start disassembling at specified offset of data; when the -p option
is used, this option specifies a pointer address into PE image.
-i <uint> - initialize disassembly address (eip) numbering with specified
address for display purposes; when -p is present, the eip value is
automatically determined and this option is ignored.
-s <uint> - only disassemble complete instructions up to this size;
by default, the disassembler attempts to disassemble all data as
it is sequentially encountered, even if the
last instruction results in a partial instruction (disassembly
instruction results in "???"); by specifying a smaller size
with this option, the trailing data may be used by the
disassembler to complete the last instruction if it is a partial
one; in the case of a partial instruction, the data size
disassembled would be slightly more than amount specified here;
this value cannot exceed the size of the passed data.
-? - this help
NOTE: numbers given for the options above default to base-10; to specify hex,
binary or octal values, please prefix with "0x", "0b" or "0" respectively.
Special thanks to to Oleh Yuschuk for publicly releasing the source code
to the OllyDbg Disassembling Engine v2.01 from which this tool is based.