Disassembler View

Disassembler view displays all decoded instructions in an instruction list. For each instruction, the following information is provided:

Raw Address

Instruction's raw address in a document.

Virtual Address

Instruction's virtual address, if available.

Relative Offset

A relative offset inside a method (applicable only in MSIL).

Bytecode

Bytes that comprise an instruction.

Mnemonic

Instruction's name.

Operands

All explicit instruction's operands, with appropriate modifiers. All referenced symbols and metadata tokens are decoded, if symbol information available.

Implicit Operands

Implicit operands, that is operands, which are not explicitly specified, but are still referenced or modified by an instruction. An example of instruction that implicitly modifies registers (esp and eip) is call.

CPU

CPU family in which this instruction appeared.

Flags Checked

All flags that this instruction reads.

Flags Modified

All flags this instruction modifies.

Right-click on the column bar to open the Select Columns Window where you can select columns for the list.

When symbols are available, all jumps and calls for which the Hex Editor Neo is able to locate a symbolic name show this name before the destination address. The destination address in this case follows the name in parenthesis.

Vertical lines in a view may be switched off, using the “Show grid lines” option in General Settings page.

View Refresh

When disassembled document is changed through one of the editor windows, disassembly may need to be refreshed. In some cases, where the size of the instruction remains the same, Disassembler View refreshes itself automatically and no additional refresh is required.

In other cases, manual refresh is required. To refresh, use the Refresh command from either the shortcut menu, or from the window's toolbar.

Positioning within a Document

Use the Edit » Go to Offset… command to go to a specific offset in the Disassembler View. In addition, you can use the window's toolbar to quickly jump to a given raw or virtual address.

Searching for a Text

You can search a Disassembler View for a given text. Use the Edit » Find… command to enter the search sequence and then press the Find button to find the next occurrence. Searching is performed only in selected columns (see above).

Exporting and Copying to Clipboard

You can export the whole Disassembler View or only selected part of it into a text file (.txt or .csv) or copy it into the Clipboard. Both commands are available in the shortcut menu. For the export command, you are provided with a choice of columns to export, for the Copy to Clipboard command, the currently selected data is exported.