Free 64-bit disassembler?

GNU binutils has objdump, which should work:

-d

--disassemble

Display the assembler mnemonics for the machine instructions from objfile. This option only disassembles those sections which are expected to contain instructions.

-D

--disassemble-all

Like -d, but disassemble the contents of all sections, not just those expected to contain instructions. If the target is an ARM architecture this switch also has the effect of forcing the disassembler to decode pieces of data found in code sections as if they were instructions.

It will already be installed on most Linux distributions that have GCC or other development tools installed, and Windows versions are available via e.g. Cygwin.


I use objdump -d. :-) Does that not work for you?


If you're working with Windows files and have Visual Studio, you can use the dumpbin tool.

dumpbin /disasm ntoskrnl.exe /out:ntoskrnl.asm

It won't display exports inline either, but you can see them separately with the /exports switch. Then you can make a little script to parse the exports and replace the addresses in the assembly listing with names.