92  Disassembler

Disassembling is the inverse action of assembling. Rz-asm takes hexpair as an input (but can also take a file in binary form) and show the human readable form.

To do this we can use the -d option of rz-asm like this:

$ rz-asm -a x86 -b 32 -d '90'

Rz-asm also has the -D flag to show the disassembly like -d does, but includes offset and bytes.

In rizin there are many commands to perform a disassembly from a specific place in memory.

You might be interested in trying if you want different outputs for later parsing with your scripts, or just grep to find what you are looking for:

92.0.1 pd N

Disassemble N instructions

92.0.2 pD N

Disassemble N bytes

92.0.3 pda

Disassemble all instructions (seeking 1 byte, or the minimum alignment instruction size), which can be useful for ROP

92.1 pi, pI

Same as pd and pD, but using a simpler output.