# Resources 57 URI templates for the heavier questions. Read one with `resources/read`, or pass the URI to the `query` tool from a client without resource support. `borer://help/{name}` explains any of them with an example. ## `borer://help/{name}` How to read one resource: its URI, what it answers and, for a template, an example built from the loaded binary ## `borer://session/evidence/{id}` The answer its `# evidence:` line names, kept as it was sent; every answer carries one as its last line (a mermaid graph: `%% evidence:`), the id -<8 hex digits>, and this returns the text behind it or says it was let go past the 256 the session keeps ## `borer://playbook/{name}` A prompt's text, for an agent whose host offers prompts only to its user: triage, protocol, find_check/ or explain_function/ ## `borer://stackstrings/{filter}` Stack strings whose text contains the filter ## `borer://flat/{address}` Cases of one flattening dispatcher, in table order, each with where it ends. The table order is not the order they run ## `borer://solve/{spec}` Find an argument value that makes a check answer differently: spec is
[,aN] (the decompiler's aN, a1 by default). Every constant the function compares against is tried and the answers grouped, so a value standing apart is the one it wants, with the comparison it came from ## `borer://partial/{address}` A counted loop comparing a few bits of a product to a byte table: the iterations, the bit window, the table and the loop-invariant multiplicand. That shape is a hidden-number problem, solved by lattice reduction and not by more samples ## `borer://why/{address}` What is at an address and how borer knows: where its name came from (the compiler's debug information, a symbol, inferred from code, or nothing), why the function was discovered, what refers to it, and any value recovered by running the code that builds it ## `borer://layout/{spec}` Propose a structure from what a function does through one pointer: spec is
[,] (default rcx, the first argument). Each row is a field with the width of the access and what it is passed to. Add ,apply= at a function's entry to define the fields as struct Name and type that parameter with it, so decompile names them (a dry run; add ,dry_run=false to apply) ## `borer://taint/{spec}` Follow a value forward through its function: spec is
[,] (default rax, where a call leaves its result). Reports the instructions that carry it, the calls it is passed to and as which argument, the memory it is stored into, and where it still is at the end ## `borer://emulate/{address}` Run code and read the result. The address carries an experiment: comma-separated reg=val, aN=val (the argument the decompiler names aN; a1 is the first), w= (set data or patch code), stop=, steps= (at most 20000000), trace= (what each of the last n instructions changed; a small steps= watches the start instead), origin= (the instruction that first put the value v in a register or in memory), profile= (the n most-run addresses and most-read pages, where the steps went; at most 64), dump=: (at most 4096 bytes, ?? where nothing is mapped). Reports final registers, the imported APIs and syscalls it serviced as api(args) -> ret with each argument decoded (a string as text, a flag or handle named, an unknown pointer as ptr 0x...), decoded text and each dump. ## `borer://devirt/{address}` Run a virtualized function and recover the program it executes: handlers summarized once, the trace cleaned of dead stores (writes nothing that runs after them reads) and cut into straight-line runs at every virtual branch, one line per step. The address carries comma-separated settings: budget= raises the step cap (2000000 by default, at most 200000000) for a protector whose dispatch starts after a long bootstrap; strict faults on the first read of an import or of memory the loader would fill, where by default it reads zero and goes on; reg= presets a register, such as the VM's context pointer the entry does not build ## `borer://unpack/{address}` Run a packer's bootstrap and report the code it decrypts into memory, with the original entry point. Append ,budget=N to raise the step cap toward a fuller unpack ## `borer://calls/{callee}` Every call site of a function or import (direct, through its slot or a thunk) with the arguments the decompiler resolves at each: a constant in hex, a string quoted, a global by name, else the expression, ? where the lifter saw none (an import is padded to its declared parameters). [,aN=]...: aN=0x40 keeps the calls whose argument aN is that number, aN=text the ones whose argument or string contains it, aN=? the unseen ones; aN!=, aN> and aN< too; offset= for the next page (200 rows a page, 500 callers decompiled at most) ## `borer://iocs/{filter}` Indicators of one type (url, domain, ip, ipv4, ipv6, email, registry, path, pipe, mutex, object, useragent) or whose value contains the text, comma-separated; offset= for the next page ## `borer://hidden/{filter}` Run-time generated strings whose text or generator matches {filter} ## `borer://decoded/{filter}` Decoder-recovered strings whose text contains {filter}; offset= for the next page ## `borer://oracle/{address}` Run the function at {address} over a probe string in every argument shape and report what it does with it ## `borer://run/{spec}` Call a function on inputs typed by its recovered signature and check its decompiled text on them: [,steps=N]/[;...], each input its arguments in order: 5, -1, "text", hex:0102 or out:16 (a zeroed buffer). A row per input: the return value, the stop, the steps, the bytes each buffer holds after, and whether the text run as C agrees, differs (at a line) or is unchecked (at most 64 inputs, 1000000 steps each by default); then the imported APIs and syscalls the runs serviced as api(args) -> ret with each argument decoded ## `borer://diverge/{spec}` Call a function on two inputs and report where the runs part ways: the first step that differs (the comparison that split them), the calls each side then makes, and the writes and serviced calls that differ: [,steps=N]/; ## `borer://vectors/{spec}` Test vectors for reimplementing a function: [,count=N][,steps=N]. Inputs from the constants it compares and generated from its recovered signature (16 by default, at most 64), each run in the emulator: a row per input with what it returned and left in its buffers, then a C harness asserting the vectors that returned ## `borer://diff/{path}` Compare the loaded binary against another version at {path} and report which functions changed, were added or removed ## `borer://difffn/{function}/{path}` Show how one function changed between the loaded binary and another version at {path}, as a diff of the decompilations ## `borer://carry/{path}` Carry this project's names to another build of the same program: each name with its new address and how the function was paired, by identical body or by shape. An update moves every address, and the fingerprints do not move ## `borer://migrate/{function}/{path}` Migrate the field offsets a function reads from the loaded build to the version at {path}: which offsets are unchanged, removed, added, or moved ## `borer://vm/{address}` The handlers of one dispatch loop, each with what it does ## `borer://asserts/{filter}` Asserted fields whose name or class contains the filter ## `borer://sources/{filter}` Source files whose path contains the filter, with their function counts ## `borer://classes/{filter}` Registered classes whose name or code contains the filter ## `borer://messages/{filter}` Classes with a registered wire id whose name contains the filter, each with its named fields and the handlers testing for the id (200 a page) ## `borer://map/{namespace}` One namespace's classes, each with its role, parent, methods and instance (5000 rows at most) ## `borer://ports/{filter}` The messages ports accept and their handlers, for the components or messages whose name contains the filter (5000 rows at most) ## `borer://attrs/{filter}` Registered attributes whose name or code contains the filter (200 a page); one exact match lists every function reading or writing it with the definition global ## `borer://exportpack/{spec}` The session's names as a pack that names the same functions in another build by their first bytes: , or ,all to add the names borer recovered ## `borer://scenario/{spec}` A function decompiled under assumptions, /: branches and switches on them fold, only the code that can run is written, and the first line counts the blocks cut ## `borer://scenarios/{spec}` A dispatcher exploded, / or /: a scenario per value, the values that behave alike grouped, each row with its blocks kept, calls and returns ## `borer://script/{path}` Runs a Rhai script file against the loaded program in borer's sandbox: what it printed, and the names and comments it proposes (set_name applies one) ## `borer://clr/{filter}` A .NET assembly's metadata rows of one kind (type, method, pinvoke, memberref, asmref, moduleref, string) or whose name or detail contains the text, comma-separated; offset= for the next page ## `borer://singletons/{filter}` Singletons whose class name contains the filter ## `borer://function/{address}` function_summary at an address or name ## `borer://decompile/{address}` Pseudo-C of the function at an address or name ## `borer://disasm/{address}` Disassembly of the function at an address or name ## `borer://fields/{address}` Field offsets the function at an address or name dereferences, by (base, offset) ## `borer://fieldrefs/{offset}` Every instruction program-wide that reads, writes or takes the address of [reg+offset], with its function; `offset[,name-filter]`, 500 rows at most ## `borer://vslot/{slot}` Every recovered class whose virtual at a zero-based vtable slot returns a constant (a wire id, a type tag), by value; `slot[,class-filter]` ## `borer://schema/{function}` The record a deserializer reads off its stream (fields, widths, nesting, repeats), for a function by address or name, or the reading virtual of a class ## `borer://schemas/{slot}` Every class with a constant at a zero-based vtable slot and the record its reading virtual decodes, one line each: a protocol as a table; `slot[,class-filter]` ## `borer://encode/{function}` What a serializer writes onto its stream (fields in wire order, widths, the object field each came from, helpers followed into the members they write), for a function by address or name, or the writing virtual of a class ## `borer://hooks/{slot}` Every class with a constant at a zero-based vtable slot with the addresses a binding hooks: its encoder, its decoder, its handler and each call site the client sends it from; `slot[,class-filter]` ## `borer://protocol/{slot}` Every class with a constant at a zero-based vtable slot on one row with who constructs it, the handler receiving it, what it writes onto the wire and what it reads back: the whole protocol as one table; `slot[,class-filter]` ## `borer://senders/{slot}` Every class with a constant at a zero-based vtable slot and the functions calling its factory or constructors: who sends each command, as a table; `slot[,class-filter]` ## `borer://encodes/{slot}` Every class with a constant at a zero-based vtable slot and what its writing virtual puts on the wire, one line each: the outbound protocol as a table; `slot[,class-filter]` ## `borer://shape/{function}` Every function running the same code as the one at an address or name over other operands, with the strings and data addresses that differ: a registration family as a table ## `borer://anchors/{path}` Every pinned fact in a manifest file (`field `, `vconst `, `function `, `encode `, `decode ` lines) derived again from the loaded binary and reported held, moved, changed or gone ## `borer://changes/{path}` What changed since a snapshot file of an earlier build (written by the CLI's `borer snapshot `): commands, packet layouts, attributes, message routes and ids added, removed or changed, by stable name ## `borer://about/{name}` Everything known about one name, from every table at once: the attribute (with each user reading or writing it), the class (role, parent, instance, virtuals, the messages it accepts or the components handling it, the wire for a command), and the function summary; start here with any name ## `borer://grep/{text}` Pseudo-C lines program-wide containing the text (percent-encoded), or matching it when written re:, with their function, its signature and the if/else/loop/switch/case lines enclosing them (numbered ^N); decompiles everything once into the index on first use; 200 matching lines at most