omni_inspect_symbol
Inspect and recover symbols from binaries, disassemble or decompile code, and analyze crypto, Android, WASM, or web bundles to support reverse engineering and triage.
Instructions
Granular reverse engineering & cryptanalysis: inspect PE symbols, disassemble with Capstone, decompile Java with JADX, decompile C with Ghidra, recover Go/Rust/Flutter symbols, simplify MBA expressions with Z3, compute Hensel lifting / modular inverses, rebuild unpacked PEs, detect honeypot traps, read bytes/RVAs, search byte patterns, detect crypto constant tables, extract structured IoC indicators, disassemble WASM modules via WABT, unpack web sourcemaps, and extract Android XRef/resources.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| arch | No | Architecture for disassembly: 'x64', 'x86', 'arm64', 'arm'. Default 'x64'. | x64 |
| count | No | Number of instructions to disassemble (default 25). | |
| query | No | Address/offset (e.g. '0x140001000' or RVA) for disassembly/pseudo_c/rebuild_pe/read_bytes/read_rva, search pattern (hex '55 48 89 E5' or 'str:admin'), MBA expression, hex value for modular/Hensel inverse, or Java class name. | |
| action | Yes | Inspection action: 'pe_symbols', 'disassemble_address', 'android_class', 'pseudo_c', 'go_symbols', 'rust_metadata', 'flutter_dart', 'simplify_mba', 'hensel_inverse', 'modular_inverse', 'rebuild_pe', 'scan_honeypots', 'read_bytes', 'read_rva', 'search_bytes', 'crypto_signatures', 'indicators', 'capabilities', 'wasm_disasm', 'wasm_headers', 'unpack_sourcemap', 'analyze_web_bundle', 'android_xref', 'android_resources', 'pe_lea_xrefs', 'native_crypto_prologues'. | pe_symbols |
| target_path | Yes | Path to target binary (.exe, .dll, .apk, .so, .dex, .wasm, .js). |