analyze
Disassemble and inspect binary files: extract strings, analyze headers, search patterns, and compute entropy for reverse engineering tasks.
Instructions
Static binary analysis tool for reverse engineering and debugging. Operations: disassemble (x86/x64/ARM/ARM64 disassembly, stop_at_ret for function-scoped), pe_info (PE header/sections/imports/exports), elf_info (ELF header/sections/symbols), macho_info (Mach-O header/segments/symbols), strings (extract printable strings from binary), hexdump (hex+ASCII view), pattern_search (hex byte pattern with ?? wildcards, shows section names for PE), entropy (Shannon entropy per section), bin_diff (two-file byte comparison), resource_info (PE resources and version info), imphash (PE import hash for malware classification), rich_header (PE build tool fingerprint), overlay_detect (detect appended data after last section), dwarf_info (debug symbol info), xref (find all code references to a target address in PE/ELF/Mach-O; supports x86/x64/ARM64/ARM32), function_at (find function boundaries via PE .pdata or heuristic prologue/epilogue scan), call_graph (static call graph from a root function; PE/ELF/Mach-O, x86/x64/ARM64/ARM32), follow_ptr (follow pointer chain in PE with symbol annotation, circular reference detection), rtti_dump (parse MSVC RTTI from vtable: demangled class name + base classes, pSelf validation), struct_layout (dump memory region as structured layout with symbol/section annotation), vtable_scan (scan PE .rdata for all vtables with RTTI -- auto-discovers C++ classes). Pure Go implementation -- no external tools needed. Supports x86, x64, ARM, ARM64. For PE files: use 'va' parameter instead of 'offset' for auto VA display, symbol annotation, and function boundary detection. PE strings/pattern_search automatically show VA alongside file offsets. For runtime debugging, use the debug tool instead.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| operation | Yes | Operation: disassemble, pe_info, elf_info, macho_info, strings, hexdump, pattern_search, entropy, bin_diff, resource_info, imphash, rich_header, overlay_detect, dwarf_info, xref, function_at, call_graph, follow_ptr, rtti_dump, struct_layout, vtable_scan,required | |
| file_path | No | Absolute path to the binary file,required | |
| path | No | Alias for file_path | |
| offset | No | Byte offset to start from. Default: 0 | |
| va | No | Virtual address for PE files (hex, e.g. '0x140001000'). Auto-converts to file offset. For disassemble, function_at, follow_ptr, rtti_dump, struct_layout. Preferred over offset+base_addr for PE analysis. | |
| count | No | Number of instructions (disassemble) or depth (follow_ptr). Default: 50/4, Max: 600/10. | |
| stop_at_ret | No | Stop disassembly at function return (RET/RETF). Confirms boundary via INT3/NOP padding or new prologue. For disassemble only: true or false. Default: false | |
| mode | No | CPU mode: 32 or 64. Default: 64 | |
| base_addr | No | Base address for display (hex string, e.g. '0x140001000'). Default: 0x0. This maps to file offset 0, so displayed address = base_addr + offset + instruction_position. For PE files, prefer 'va' parameter instead -- it auto-calculates the correct base_addr. | |
| arch | No | CPU architecture: x86 (default) or arm. For disassemble | |
| min_length | No | Minimum string length for strings operation. Default: 4 | |
| max_results | No | Maximum number of results for strings. Default: 500, Max: 2000 | |
| encoding | No | String encoding to search for: ascii (default) or utf8 | |
| length | No | Number of bytes for hexdump. Default: 256, Max: 4096 | |
| section | No | Filter by section name (e.g. '.text', '.rdata'). Empty = show all | |
| rva | No | RVA to convert to file offset (hex string, e.g. '0x36A20'). For pe_info only | |
| pattern | No | Hex byte pattern with ?? wildcards (e.g. '4D 5A ?? ?? 50 45'). For pattern_search | |
| target_va | No | Target virtual address to find references to (hex). For xref operation. | |
| file_path_b | No | Absolute path to the second file for bin_diff comparison |