Skip to main content
Tool Factory

Forensics & Binary

X86 Disassembler

Disassemble x86 into readable instructions. Add the content, choose the checks, and review the reported details.

Tool workspace

Your input stays in this browser.

Add the required input to continue.

Needs input

Run the tool when your input is ready.

Options

Hexadecimal, e.g. 16, 0xABC or ABCh

Hexadecimal, e.g. 0, 0x1000 or 1000h

Your result appears here

Disassemble x86 into readable instructions. Add the content, choose the checks, and review the reported details.

This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.

X86 Disassembler performs instruction disassembly on supplied binary or media data. The operation returns x86 instructions for the selected mode and starting address.

The operation returns x86 instructions for the selected mode and starting address. This result runs in the browser for this catalog category. Processing runs in the browser.

Disassembly interprets bytes under selected assumptions; it does not execute code or prove behavior.

Instructions

  1. Provide file or files for this tool.
  2. Use a public fixture or a binary you are authorized to inspect. This applies to X86 Disassembler.
  3. Confirm architecture, byte order, and start address before reading instructions. This applies to X86 Disassembler.
  4. Compare suspicious instructions with a trusted disassembler when evidence matters. This applies to X86 Disassembler.

Example

Input: x86 bytes "554889e5" with the x86-64 mode and starting address 0x0.

Settings: X86 Disassembler: Architecture: x86-64 mode exposed by the operation. Input: hexadecimal bytes; starting address: 0x0. Keep instruction hex and position display enabled for the fixture.

Result: The operation returns x86 instructions for the selected mode and starting address.

Limits

  • X86 Disassembler: Disassembly does not prove that bytes are executable code.
  • X86 Disassembler: Wrong architecture or offset produces misleading instructions.
  • X86 Disassembler: The output does not explain program intent or establish file provenance.

Questions

What input does X86 Disassembler accept?

X86 Disassembler accepts text. Disassembly is the process of translating machine language into assembly language. This operation supports 64-bit, 32-bit and 16-bit code written for Intel or AMD x86 processors. It is particularly useful for reverse engineering shellcode. Input should be in hexadecimal.

Which settings does X86 Disassembler provide?

X86 Disassembler provides controls for Bit mode, Compatibility, Code Segment (CS), Offset (IP), Show instruction hex, Show instruction position.

What does X86 Disassembler return?

X86 Disassembler returns text. Disassembly is the process of translating machine language into assembly language. This operation supports 64-bit, 32-bit and 16-bit code written for Intel or AMD x86 processors. It is particularly useful for reverse engineering shellcode. Input should be in hexadecimal.