Tools
Read from the server's own tools/list, grouped the way the README groups them.
Load
load_binaryLoad a PE, ELF or Mach-O file (a fat Mach-O: its x86-64 slice), or any other file as raw bytes, as the current program; returns its summary. pdb=false skips the companion PDB; entry_file_offset overrides the entry; arch maps raw code or a dump.binary_infoSummary of the current program: format, arch, entry, sections with entropy, imports/exports.fetch_pdbFetch the loaded PE's missing companion PDB from a symbol server into the cache; guid+age must match; dry-run unless dry_run=false; the next load_binary applies it.reloadRestart the server on the binary at its path, keeping the session, the loaded file and its names and comments: use after rebuilding borer, instead of restarting the client.
Find
functionsDiscovered functions as
entry size blocks instrs callers callees src name rows; filter on name or entry hex, sort=size for the largest first.functionOne function's detail: name, range, counts, callers/callees and its basic-block table (start size term successors, 300 a page by offset).symbolsImports/exports/forwards/locals/data as kind addr name rows under # module: lines, demangled (a forward ends -> MODULE.name); xrefs(import) lists its call sites.stringsPrintable ASCII/UTF-16LE strings as off va len enc "text" rows.searchSearch the whole file for bytes (AOB hex, ?? wildcards) or kind=text substring; hits as function: va va ... rows, off=<n> where unmapped; offset/limit (200, max 500).find_function_by_stringFunctions referencing strings containing filter: a # showing N of M header, a numbered # strings: legend, then entry name: 1 2 5 rows; offset/limit page rows and legend (50, max 300).find_crypto_constantsCrypto tables and constants (AES, SHA-1/2, MD5, CRC-32, ChaCha, Blowfish, RC5/6, xxHash/FNV/SipHash, Base64) anywhere in the file: va section algorithm rows per algorithm (off=<n> if unmapped), offset/limit (200, max 500).entropyHigh-entropy regions (packed/encrypted data) as off va len entropy rows at or above threshold bits/byte (default 7.2, window 1024) under a # showing N of M header; paging (200, max 200; the scan stops at 200 regions).Read code
function_summaryOne-call triage of a function: shape, loops, jump tables, callers/callees by name, strings and data it references;
# next: lines name what to read next.function_stringsString literals a function references as site string_va text rows (max 100).decompilePseudo-C with locals local_N/arg_N, named calls and if/else/while/for/switch; /* asm */ marks unmodeled code, goto unproven flow. Line 2 says what the binary checked, // next: lines what to read next.decompile_batchPseudo-C for many functions: filter on name or entry hex, max_functions (10, max 50); 6000 chars per function, 40000 total.disassembleDisassemble count instructions (default 32, max 256) at an address or name as va text rows (bytes=true adds bytes); whole functions: disassemble_function.disassemble_functionDisassemble a whole function block by block with L_<addr>: labels and named call/jmp targets (max_instrs default 400, max 2000).cfgControl-flow graph of a function as mermaid: basic blocks (start, terminator) and successor edges, 300 blocks a page by offset; a trailing %% line says when blocks were cut.callgraphCallgraph from a function as mermaid: callees (callers=true: what reaches it), six per function before the rest is shared out, imports as leaves; a trailing %% line counts what was hidden (max_nodes 30, max 100).reachesShortest call chain from one function to another (or to an import, called through its slot or a thunk), or that there is none and how far it looked: answers "does this ever reach the send / this check" on a whole binary.xrefsReferences to an address or name, one function: site kind, ... row per referencing function (calls, data reads, pointers in data), same-code functions folded; an import lists calls through its slot; Class+0x24 lists who touches that field; paged by function (60, max 500).class_layoutClass layout from its methods: field offset, width, reads/writes, methods, vftable; takes a class name or a method address; apply=Name defines it as a struct typing each method's object (dry-run unless dry_run=false).Read data
Annotate
set_nameName a function (any address inside it) or a data global in the overlay, not the binary; dry-run unless dry_run=false.set_commentComment an address in the overlay; dry-run unless dry_run=false.set_typeDefine a user type and/or apply one: at a data global,
type types it (a Player * names the fields read through it, an enum the constants compared with it); at a function, type is its C prototype, or with var (a1, local_58) names/types that variable; type alone defines C structs. Dry-run unless dry_run=false.typesList user-defined types and where they are applied; filter pages like every list.annotationsList the annotation overlay: names, findings and open questions (comments opening with ?); filter pages like every list.save_projectSave the annotation overlay (names, comments, types) to a JSON project file, keyed to the binary by its SHA-256.load_projectLoad a JSON project file into the annotation overlay, replacing it. A project saved for another binary (by SHA-256) is refused unless force=true; names, comments and types at addresses no section holds, or blank, are skipped and listed.Live process
live_attachAttach read-only to a running process (name or pid); maps the loaded binary onto it so live tools take static addresses and names.live_detachDetach from the attached process and drop its watches.live_modulesList the attached process's modules.live_readRead typed values from the attached process; pointers say what they point at.live_objectRead an object in the attached process as its class: each field's name, type, live value, and what pointers point at.live_instancesFind a class's live objects by vtable in the attached process's data; live_object reads one.live_watchWatch attached-process memory: with an address, keep its bytes under the name; without, list what changed, naming fields when the class is known.
Anything else
queryRead a borer:// resource as resources/read does (same text, errors and memory), for hosts that cannot read resources, e.g. borer://triage or borer://scenarios/0x401000/a1=0..8; a template read bare (borer://emulate) says its grammar; !offset=N!limit=N page a listing; borer://help lists all.scriptRun a sandboxed Rhai script over the loaded program, for what no single tool answers: what it printed, then the names and comments it proposed (dry-run unless dry_run=false). print(help()) lists every call; query(uri) reads any borer:// resource, rows(uri) its table.