To start disassembler, execute the Tools » Run Disassembler… command.
If you have a document opened in the editor, the disassembler window automatically selects this document for disassembling. Both files and processes may be disassembled this way. Hex Editor Neo is capable of locating a proper image and loading its PE header.
If the current document has a selection, its start and size are used to fill the corresponding fields in the Disassembler window. Otherwise, the cursor's position is used as a starting offset.
Enter the full path to an executable file or press the browse ("..." button).
- Instruction Set
- Select a required instruction set. Disassembler automatically selects the valid instruction set, according to the fields in the image's PE header.
If the file has a valid PE Header, a list of file sections is displayed in this field. A first code section (usually named ".text" or "CODE") is automatically selected. You can select any other section, effectively changing the value of the Start and Size fields. As described above, if the current document is used for a disassembler, Start and Size fields are automatically filled using the cursor's position and/or current selection.
This field is disabled if MSIL instruction set is selected.
Click to display the Symbols Window for a selected file. Using this window you can select a specific symbol and instruct the disassembler to disassemble only this symbol (that is, to update the Start and Size fields appropriately).
- The starting offset for disassembling. This field is disabled if MSIL instruction set is selected.
- The size of the area for disassembling. This field is disabled if MSIL instruction set is selected.
- Hexadecimal/Decimal switch
- Set to specify whether offset and size are entered as hexadecimal or decimal numbers.
- Dual view
If checked, both Disassembler View and usual editor window will be opened for a document. The views will be connected to each other, that is, highlighting an instruction in Disassembler View will select its bytes in a editor window provided "Synchronize cursor with Hex View" and "Synchronize selection with Hex View" options are enabled.
- Synchronize cursor with Hex View
- Paired editor window's cursor movement results in a disassembler's active row being changed.
- Synchronize selection with Hex View
Disassembler automatically selects all bytes of the currently selected instruction in disassembler. This selection replaces the current selection of the paired editor window.
- Click to reset the state of all fields to their default values.
This section displays the contents of the file's PE Header.