disassemble
Disassemble instructions at a given address or symbol in the loaded module. Returns raw bytes, mnemonic, operands, and metadata like call/jump targets. Useful for analyzing execution flow.
Instructions
Disassemble instructions starting at a given address in the loaded module. Returns address, raw bytes, mnemonic, operands, and metadata (is_call, is_jump, reference target) for each instruction. Safe to call while paused. Address may be a hex value ('0x401000') or a symbol name ('main', 'kernel32.CreateFileW'). Tip: after load_executable with breakOnEntry=true, disassemble the entry point returned in the load result to see where execution begins.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | Session ID | |
| address | Yes | Start address (hex) or symbol, e.g. '0x401000' or 'main' | |
| count | No | Number of instructions (default 30) |