A lightweight Windows application that disassembles 32-bit PE files (.exe) and displays the assembly instructions from the .text section. Built with WPF and C#.
The Russian version is available here.
This tool allows you to explore the internal structure of executable files by extracting and decoding machine code into human-readable assembly instructions. It is designed for educational purposes and basic reverse engineering, demonstrating how PE files are structured and how x86 instructions are encoded.
- C# – core programming language
- WPF (Windows Presentation Foundation) – for the graphical user interface
- .NET Framework / .NET Core – application framework
- Select any file and check for valid MZ/PE signatures.
- Verify that the target is an x86 executable.
- Extract and decode a limited but common set of x86 instructions:
- Data movement:
MOV,PUSH,POP - Arithmetic:
ADD,SUB,AND - Control flow:
JMP,CALL,RET, conditional jumps - Other:
NOP,CBW,CWD,PUSHFD/POPFD
- Data movement:
- Save the disassembly listing to a text file.
- Windows OS with .NET Framework 4.7.2+ or .NET 5/6/7/8 (with WPF support)
- Visual Studio 2019/2022 (for building from source)
-
Clone the repository:
git clone https://github.com/ddeeduck/Pe-disassembler.git
-
Open the solution file (Disassembler.sln) in Visual Studio.
-
Build the solution (Ctrl+Shift+B).
-
Run the application (F5).
-
Launch the application.
-
Click "Browse" and select an .exe file.
-
Click "Check" to validate the PE structure.
-
If the file is valid, click "Disassemble" to generate the instruction list.
-
Save the result to a .txt file.
- Only supports x86 (32-bit) PE files.
- The instruction decoder covers only the opcodes implemented in the source; many instructions are not yet recognized.
- The disassembly is based on raw file offsets, not virtual addresses (no relocation handling).
Daria – GitHub, Telegram, LinkedIn, Email: dehterevich.daria@gmail.com
This project is licensed under the MIT License – see the LICENSE file for details.