Starting Disassembler

To start disassembler, execute the Tools » Run Disassembler… command.

If you have a document opened in the editor, the disassembler window automatically selects this document for disassembling. Both files and processes may be disassembled this way. Hex Editor Neo is capable of locating a proper image and loading its PE header.

If the current document has a selection, its start and size are used to fill the corresponding fields in the Disassembler window. Otherwise, the cursor's position is used as a starting offset.

Disassembler Window

File

Enter the full path to an executable file or press the browse ("..." button).

Instruction Set

Select a required instruction set. Disassembler automatically selects the valid instruction set, according to the fields in the image's PE header.

Section

If the file is in the PE or ELF format, a list of file sections is displayed in this field. A first code section (usually named “.text” or “CODE”) is automatically selected. You can select any other section, effectively changing the value of the Start and Size fields. As described above, if the current document is used for a disassembler, Start and Size fields are automatically filled using the cursor's position and/or current selection.

This field is disabled if MSIL instruction set is selected.

Symbols…

Click to display the Symbols Window for a selected file. Using this window you can select a specific symbol and instruct the disassembler to disassemble only this symbol (that is, to update the Start and Size fields appropriately).

Start

The starting offset for disassembling. This field is disabled if MSIL instruction set is selected.

Size

The size of the area for disassembling. This field is disabled if MSIL instruction set is selected.

Hexadecimal/Decimal switch

Set to specify whether offset and size are entered as hexadecimal or decimal numbers.

Little/Big Endian

For formats that support different endianness (like ELF), allows you to choose the correct data encoding in an executable file.

Dual view

If checked, both Disassembler View and usual editor window will be opened for a document. The views will be connected to each other, that is, highlighting an instruction in Disassembler View will select its bytes in a editor window provided “Synchronize cursor with Hex View” and “Synchronize selection with Hex View” options are enabled.

Synchronize cursor with Hex View

Paired editor window's cursor movement results in a disassembler's active row being changed.

Synchronize selection with Hex View

Disassembler automatically selects all bytes of the currently selected instruction in disassembler. This selection replaces the current selection of the paired editor window.

Reset

Click to reset the state of all fields to their default values.

Headers

This section displays the contents of the file's PE Header.