Open and automatically analyze a binary file. This tool must be called before performing any decompilation, disassembly, or queries on the file.

[Ultra-fast Rizin Extractor Mode] Use the pre-analyzed Rizin Session from open_and_analyze to match capa-rules and identify malicious capabilities. open_and_analyze must be called first. It fully analyzes all functions until completion, automatically supports disk caching, and directly returns cached results if already analyzed.

List all functions identified in the current file. Supports filtering by function name or address using a keyword.

Use the Ghidra decompiler to decompile a specified memory address (e.g., 0x140001000) or function name (e.g., fcn.140001000, main) into C pseudocode.

Get the assembly disassembly output for a specified function/address.

Get detailed architectural information of the current binary file, including Headers, Sections, Imports, Exports, etc.

Search for readable strings present in the binary file. Supports filtering with a query keyword.

Find and analyze cross-references (Xrefs) and call dependencies for a specified function or address. Supports passing an address/name or global query, returning format includes [{'type': 'CALL', 'from': '0x401000', 'to': '0x402000'}].

[High Privilege Tool] Execute custom commands directly in Rizin (e.g., px 64 @ 0x140001000, afl, etc.).

Close the currently opened binary file and Rizin Session.