analyze
Analyze binary files for reverse engineering and debugging by disassembling code, extracting metadata, scanning for patterns, and examining structures across multiple architectures and formats.
Instructions
Static binary analysis tool for reverse engineering and debugging. Operations: disassemble (x86/x64/ARM/ARM64 disassembly, stop_at_ret for function-scoped), pe_info (PE header/sections/imports/exports), elf_info (ELF header/sections/symbols), macho_info (Mach-O header/segments/symbols), strings (extract printable strings from binary), hexdump (hex+ASCII view), pattern_search (hex byte pattern with ?? wildcards, shows section names for PE), entropy (Shannon entropy per section), bin_diff (two-file byte comparison), resource_info (PE resources and version info), imphash (PE import hash for malware classification), rich_header (PE build tool fingerprint), overlay_detect (detect appended data after last section), dwarf_info (debug symbol info), xref (find all code references to a target address in PE/ELF/Mach-O; supports x86/x64/ARM64/ARM32), function_at (find function boundaries via PE .pdata or heuristic prologue/epilogue scan), call_graph (static call graph from a root function; PE/ELF/Mach-O, x86/x64/ARM64/ARM32), follow_ptr (follow pointer chain in PE with symbol annotation, circular reference detection), rtti_dump (parse MSVC RTTI from vtable: demangled class name + base classes, pSelf validation), struct_layout (dump memory region as structured layout with symbol/section annotation), vtable_scan (scan PE .rdata for all vtables with RTTI -- auto-discovers C++ classes). Pure Go implementation -- no external tools needed. Supports x86, x64, ARM, ARM64. For PE files: use 'va' parameter instead of 'offset' for auto VA display, symbol annotation, and function boundary detection. PE strings/pattern_search automatically show VA alongside file offsets. For runtime debugging, use the debug tool instead.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| operation | Yes | Operation: disassemble, pe_info, elf_info, macho_info, strings, hexdump, pattern_search, entropy, bin_diff, resource_info, imphash, rich_header, overlay_detect, dwarf_info, xref, function_at, call_graph, follow_ptr, rtti_dump, struct_layout, vtable_scan,required | |
| file_path | Yes | Absolute path to the binary file,required | |
| offset | No | Byte offset to start from. Default: 0 | |
| va | No | Virtual address for PE files (hex, e.g. '0x140001000'). Auto-converts to file offset. For disassemble, function_at, follow_ptr, rtti_dump, struct_layout. Preferred over offset+base_addr for PE analysis. | |
| count | No | Number of instructions (disassemble) or depth (follow_ptr). Default: 50/4, Max: 600/10. | |
| stop_at_ret | No | Stop disassembly at function return (RET/RETF). Confirms boundary via INT3/NOP padding or new prologue. For disassemble only. | |
| mode | No | CPU mode: 32 or 64. Default: 64 | |
| base_addr | No | Base address for display (hex string, e.g. '0x140001000'). Default: 0x0. This maps to file offset 0, so displayed address = base_addr + offset + instruction_position. For PE files, prefer 'va' parameter instead -- it auto-calculates the correct base_addr. | |
| arch | No | CPU architecture: x86 (default) or arm. For disassemble | |
| min_length | No | Minimum string length for strings operation. Default: 4 | |
| max_results | No | Maximum number of results for strings. Default: 500, Max: 2000 | |
| encoding | No | String encoding to search for: ascii (default) or utf8 | |
| length | No | Number of bytes for hexdump. Default: 256, Max: 4096 | |
| section | No | Filter by section name (e.g. '.text', '.rdata'). Empty = show all | |
| rva | No | RVA to convert to file offset (hex string, e.g. '0x36A20'). For pe_info only | |
| pattern | No | Hex byte pattern with ?? wildcards (e.g. '4D 5A ?? ?? 50 45'). For pattern_search | |
| target_va | No | Target virtual address to find references to (hex). For xref operation. | |
| file_path_b | No | Absolute path to the second file for bin_diff comparison |