Resources

The heavier questions, read by URI through resources/read, or through the query tool from a client without resource support. Read from the server's own resources/templates/list.

borer://help/{name}How to read one resource: its URI, what it answers and, for a template, an example built from the loaded binary

borer://session/evidence/{id}The answer its # evidence: line names, kept as it was sent; every answer carries one as its last line (a mermaid graph: %% evidence:), the id <n>-<8 hex digits>, and this returns the text behind it or says it was let go past the 256 the session keeps

borer://playbook/{name}A prompt's text, for an agent whose host offers prompts only to its user: triage, protocol, find_check/<what is validated> or explain_function/<function>

borer://stackstrings/{filter}Stack strings whose text contains the filter

borer://flat/{address}Cases of one flattening dispatcher, in table order, each with where it ends. The table order is not the order they run

borer://solve/{spec}Find an argument value that makes a check answer differently: spec is <address>[,aN] (the decompiler's aN, a1 by default). Every constant the function compares against is tried and the answers grouped, so a value standing apart is the one it wants, with the comparison it came from

borer://partial/{address}A counted loop comparing a few bits of a product to a byte table: the iterations, the bit window, the table and the loop-invariant multiplicand. That shape is a hidden-number problem, solved by lattice reduction and not by more samples

borer://why/{address}What is at an address and how borer knows: where its name came from (the compiler's debug information, a symbol, inferred from code, or nothing), why the function was discovered, what refers to it, and any value recovered by running the code that builds it

borer://layout/{spec}Propose a structure from what a function does through one pointer: spec is <address>[,<register>] (default rcx, the first argument). Each row is a field with the width of the access and what it is passed to. Add ,apply=<Name> at a function's entry to define the fields as struct Name and type that parameter with it, so decompile names them (a dry run; add ,dry_run=false to apply)

borer://taint/{spec}Follow a value forward through its function: spec is <address>[,<register>] (default rax, where a call leaves its result). Reports the instructions that carry it, the calls it is passed to and as which argument, the memory it is stored into, and where it still is at the end

borer://emulate/{address}Run code and read the result. The address carries an experiment: comma-separated reg=val, aN=val (the argument the decompiler names aN; a1 is the first), w<addr>=<hexbytes> (set data or patch code), stop=<addr>, steps=<n> (at most 20000000), trace=<n> (what each of the last n instructions changed; a small steps= watches the start instead), origin=<v> (the instruction that first put the value v in a register or in memory), profile=<n> (the n most-run addresses and most-read pages, where the steps went; at most 64), dump=<addr>:<len> (at most 4096 bytes, ?? where nothing is mapped). Reports final registers, the imported APIs and syscalls it serviced as api(args) -> ret with each argument decoded (a string as text, a flag or handle named, an unknown pointer as ptr 0x...), decoded text and each dump.

borer://devirt/{address}Run a virtualized function and recover the program it executes: handlers summarized once, the trace cleaned of dead stores (writes nothing that runs after them reads) and cut into straight-line runs at every virtual branch, one line per step. The address carries comma-separated settings: budget=<n> raises the step cap (2000000 by default, at most 200000000) for a protector whose dispatch starts after a long bootstrap; strict faults on the first read of an import or of memory the loader would fill, where by default it reads zero and goes on; reg=<value> presets a register, such as the VM's context pointer the entry does not build

borer://unpack/{address}Run a packer's bootstrap and report the code it decrypts into memory, with the original entry point. Append ,budget=N to raise the step cap toward a fuller unpack

borer://calls/{callee}Every call site of a function or import (direct, through its slot or a thunk) with the arguments the decompiler resolves at each: a constant in hex, a string quoted, a global by name, else the expression, ? where the lifter saw none (an import is padded to its declared parameters). <callee>[,aN=<value>]...: aN=0x40 keeps the calls whose argument aN is that number, aN=text the ones whose argument or string contains it, aN=? the unseen ones; aN!=, aN> and aN< too; offset=<n> for the next page (200 rows a page, 500 callers decompiled at most)

borer://iocs/{filter}Indicators of one type (url, domain, ip, ipv4, ipv6, email, registry, path, pipe, mutex, object, useragent) or whose value contains the text, comma-separated; offset=<n> for the next page

borer://hidden/{filter}Run-time generated strings whose text or generator matches {filter}

borer://decoded/{filter}Decoder-recovered strings whose text contains {filter}; offset=<n> for the next page

borer://oracle/{address}Run the function at {address} over a probe string in every argument shape and report what it does with it

borer://run/{spec}Call a function on inputs typed by its recovered signature and check its decompiled text on them: <function>[,steps=N]/<input>[;<input>...], each input its arguments in order: 5, -1, "text", hex:0102 or out:16 (a zeroed buffer). A row per input: the return value, the stop, the steps, the bytes each buffer holds after, and whether the text run as C agrees, differs (at a line) or is unchecked (at most 64 inputs, 1000000 steps each by default); then the imported APIs and syscalls the runs serviced as api(args) -> ret with each argument decoded

borer://diverge/{spec}Call a function on two inputs and report where the runs part ways: the first step that differs (the comparison that split them), the calls each side then makes, and the writes and serviced calls that differ: <function>[,steps=N]/<input>;<input>

borer://vectors/{spec}Test vectors for reimplementing a function: <function>[,count=N][,steps=N]. Inputs from the constants it compares and generated from its recovered signature (16 by default, at most 64), each run in the emulator: a row per input with what it returned and left in its buffers, then a C harness asserting the vectors that returned

borer://diff/{path}Compare the loaded binary against another version at {path} and report which functions changed, were added or removed

borer://difffn/{function}/{path}Show how one function changed between the loaded binary and another version at {path}, as a diff of the decompilations

borer://carry/{path}Carry this project's names to another build of the same program: each name with its new address and how the function was paired, by identical body or by shape. An update moves every address, and the fingerprints do not move

borer://migrate/{function}/{path}Migrate the field offsets a function reads from the loaded build to the version at {path}: which offsets are unchanged, removed, added, or moved

borer://vm/{address}The handlers of one dispatch loop, each with what it does

borer://asserts/{filter}Asserted fields whose name or class contains the filter

borer://sources/{filter}Source files whose path contains the filter, with their function counts

borer://classes/{filter}Registered classes whose name or code contains the filter

borer://messages/{filter}Classes with a registered wire id whose name contains the filter, each with its named fields and the handlers testing for the id (200 a page)

borer://map/{namespace}One namespace's classes, each with its role, parent, methods and instance (5000 rows at most)

borer://ports/{filter}The messages ports accept and their handlers, for the components or messages whose name contains the filter (5000 rows at most)

borer://attrs/{filter}Registered attributes whose name or code contains the filter (200 a page); one exact match lists every function reading or writing it with the definition global

borer://exportpack/{spec}The session's names as a pack that names the same functions in another build by their first bytes: <name>, or <name>,all to add the names borer recovered

borer://scenario/{spec}A function decompiled under assumptions, <function>/<a2=5,a3=0>: branches and switches on them fold, only the code that can run is written, and the first line counts the blocks cut

borer://scenarios/{spec}A dispatcher exploded, <function>/<a2=0..32> or <function>/<a2=1|5>: a scenario per value, the values that behave alike grouped, each row with its blocks kept, calls and returns

borer://script/{path}Runs a Rhai script file against the loaded program in borer's sandbox: what it printed, and the names and comments it proposes (set_name applies one)

borer://clr/{filter}A .NET assembly's metadata rows of one kind (type, method, pinvoke, memberref, asmref, moduleref, string) or whose name or detail contains the text, comma-separated; offset=<n> for the next page

borer://singletons/{filter}Singletons whose class name contains the filter

borer://function/{address}function_summary at an address or name

borer://decompile/{address}Pseudo-C of the function at an address or name

borer://disasm/{address}Disassembly of the function at an address or name

borer://fields/{address}Field offsets the function at an address or name dereferences, by (base, offset)

borer://fieldrefs/{offset}Every instruction program-wide that reads, writes or takes the address of [reg+offset], with its function; offset[,name-filter], 500 rows at most

borer://vslot/{slot}Every recovered class whose virtual at a zero-based vtable slot returns a constant (a wire id, a type tag), by value; slot[,class-filter]

borer://schema/{function}The record a deserializer reads off its stream (fields, widths, nesting, repeats), for a function by address or name, or the reading virtual of a class

borer://schemas/{slot}Every class with a constant at a zero-based vtable slot and the record its reading virtual decodes, one line each: a protocol as a table; slot[,class-filter]

borer://encode/{function}What a serializer writes onto its stream (fields in wire order, widths, the object field each came from, helpers followed into the members they write), for a function by address or name, or the writing virtual of a class

borer://hooks/{slot}Every class with a constant at a zero-based vtable slot with the addresses a binding hooks: its encoder, its decoder, its handler and each call site the client sends it from; slot[,class-filter]

borer://protocol/{slot}Every class with a constant at a zero-based vtable slot on one row with who constructs it, the handler receiving it, what it writes onto the wire and what it reads back: the whole protocol as one table; slot[,class-filter]

borer://senders/{slot}Every class with a constant at a zero-based vtable slot and the functions calling its factory or constructors: who sends each command, as a table; slot[,class-filter]

borer://encodes/{slot}Every class with a constant at a zero-based vtable slot and what its writing virtual puts on the wire, one line each: the outbound protocol as a table; slot[,class-filter]

borer://shape/{function}Every function running the same code as the one at an address or name over other operands, with the strings and data addresses that differ: a registration family as a table

borer://anchors/{path}Every pinned fact in a manifest file (field <class> <name> <offset>, vconst <slot> <class> <value>, function <name> <rva>, encode <class> <layout>, decode <class> <layout> lines) derived again from the loaded binary and reported held, moved, changed or gone

borer://changes/{path}What changed since a snapshot file of an earlier build (written by the CLI's borer snapshot <binary> <file>): commands, packet layouts, attributes, message routes and ids added, removed or changed, by stable name

borer://about/{name}Everything known about one name, from every table at once: the attribute (with each user reading or writing it), the class (role, parent, instance, virtuals, the messages it accepts or the components handling it, the wire for a command), and the function summary; start here with any name

borer://grep/{text}Pseudo-C lines program-wide containing the text (percent-encoded), or matching it when written re:<expression>, with their function, its signature and the if/else/loop/switch/case lines enclosing them (numbered ^N); decompiles everything once into the index on first use; 200 matching lines at most