# Tools

41 tools, from the server's own `tools/list`.

## Load

- [load_binary](/docs/tools/load_binary.md): Load a PE, ELF or Mach-O file (a fat Mach-O: its x86-64 slice), or any other file as raw bytes, as the current program; returns its summary.
- [binary_info](/docs/tools/binary_info.md): Summary of the current program: format, arch, entry, sections with entropy, imports/exports.
- [fetch_pdb](/docs/tools/fetch_pdb.md): Fetch the loaded PE's missing companion PDB from a symbol server into the cache; guid+age must match; dry-run unless dry_run=false; the next load_binary applies it.
- [reload](/docs/tools/reload.md): Restart the server on the binary at its path, keeping the session, the loaded file and its names and comments: use after rebuilding borer, instead of restarting the client.

## Find

- [functions](/docs/tools/functions.md): Discovered functions as `entry size blocks instrs callers callees src name` rows; filter on name or entry hex, sort=size for the largest first.
- [function](/docs/tools/function.md): One function's detail: name, range, counts, callers/callees and its basic-block table (`start size term successors`, 300 a page by offset).
- [symbols](/docs/tools/symbols.md): Imports/exports/forwards/locals/data as `kind addr name` rows under `# module:` lines, demangled (a forward ends `-> MODULE.name`); xrefs(import) lists its call sites.
- [strings](/docs/tools/strings.md): Printable ASCII/UTF-16LE strings as `off va len enc "text"` rows.
- [search](/docs/tools/search.md): Search the whole file for bytes (AOB hex, ?? wildcards) or kind=text substring; hits as `function: va va ...` rows, `off=<n>` where unmapped; offset/limit (200, max 500).
- [find_function_by_string](/docs/tools/find_function_by_string.md): Functions referencing strings containing `filter`: a `# showing N of M` header, a numbered `# strings:` legend, then `entry name: 1 2 5` rows; offset/limit page rows and legend (50, max 300).
- [find_crypto_constants](/docs/tools/find_crypto_constants.md): Crypto tables and constants (AES, SHA-1/2, MD5, CRC-32, ChaCha, Blowfish, RC5/6, xxHash/FNV/SipHash, Base64) anywhere in the file: `va section algorithm` rows per algorithm (`off=<n>` if unmapped), offset/limit (200, max 500).
- [entropy](/docs/tools/entropy.md): High-entropy regions (packed/encrypted data) as `off va len entropy` rows at or above threshold bits/byte (default 7.2, window 1024) under a `# showing N of M` header; paging (200, max 200; the scan stops at 200 regions).

## Read code

- [function_summary](/docs/tools/function_summary.md): One-call triage of a function: shape, loops, jump tables, callers/callees by name, strings and data it references; `# next:` lines name what to read next.
- [function_strings](/docs/tools/function_strings.md): String literals a function references as `site string_va text` rows (max 100).
- [decompile](/docs/tools/decompile.md): Pseudo-C with locals local_N/arg_N, named calls and if/else/while/for/switch; /* asm */ marks unmodeled code, goto unproven flow.
- [decompile_batch](/docs/tools/decompile_batch.md): Pseudo-C for many functions: filter on name or entry hex, max_functions (10, max 50); 6000 chars per function, 40000 total.
- [disassemble](/docs/tools/disassemble.md): Disassemble `count` instructions (default 32, max 256) at an address or name as `va text` rows (bytes=true adds bytes); whole functions: disassemble_function.
- [disassemble_function](/docs/tools/disassemble_function.md): Disassemble a whole function block by block with `L_<addr>:` labels and named call/jmp targets (max_instrs default 400, max 2000).
- [cfg](/docs/tools/cfg.md): Control-flow graph of a function as mermaid: basic blocks (start, terminator) and successor edges, 300 blocks a page by offset; a trailing %% line says when blocks were cut.
- [callgraph](/docs/tools/callgraph.md): Callgraph from a function as mermaid: callees (callers=true: what reaches it), six per function before the rest is shared out, imports as leaves; a trailing %% line counts what was hidden (max_nodes 30, max 100).
- [reaches](/docs/tools/reaches.md): Shortest call chain from one function to another (or to an import, called through its slot or a thunk), or that there is none and how far it looked: answers "does this ever reach the send / this check" on a whole binary.
- [xrefs](/docs/tools/xrefs.md): References to an address or name, one `function: site kind, ...` row per referencing function (calls, data reads, pointers in data), same-code functions folded; an import lists calls through its slot; `Class+0x24` lists who touches that field; paged by function (60, max 500).
- [class_layout](/docs/tools/class_layout.md): Class layout from its methods: field offset, width, reads/writes, methods, vftable; takes a class name or a method address; apply=Name defines it as a struct typing each method's object (dry-run unless dry_run=false).

## Read data

- [read](/docs/tools/read.md): Read `count` typed values (kind u8..u64, i8..i64, f32, f64, ptr, cstr, wstr; default u64, count 1, max 256) as `va value` rows; pointers are named.
- [hexdump](/docs/tools/hexdump.md): Hexdump `length` bytes (default 64, max 4096) at `address`.

## Annotate

- [set_name](/docs/tools/set_name.md): Name a function (any address inside it) or a data global in the overlay, not the binary; dry-run unless dry_run=false.
- [set_comment](/docs/tools/set_comment.md): Comment an address in the overlay; dry-run unless dry_run=false.
- [set_type](/docs/tools/set_type.md): Define a user type and/or apply one: at a data global, `type` types it (a `Player *` names the fields read through it, an enum the constants compared with it); at a function, `type` is its C prototype, or with `var` (a1, local_58) names/types that variable; `type` alone defines C structs.
- [types](/docs/tools/types.md): List user-defined types and where they are applied; filter pages like every list.
- [annotations](/docs/tools/annotations.md): List the annotation overlay: names, findings and open questions (comments opening with ?); filter pages like every list.
- [save_project](/docs/tools/save_project.md): Save the annotation overlay (names, comments, types) to a JSON project file, keyed to the binary by its SHA-256.
- [load_project](/docs/tools/load_project.md): Load a JSON project file into the annotation overlay, replacing it.

## Live process

- [live_attach](/docs/tools/live_attach.md): Attach read-only to a running process (name or pid); maps the loaded binary onto it so live tools take static addresses and names.
- [live_detach](/docs/tools/live_detach.md): Detach from the attached process and drop its watches.
- [live_modules](/docs/tools/live_modules.md): List the attached process's modules.
- [live_read](/docs/tools/live_read.md): Read typed values from the attached process; pointers say what they point at.
- [live_object](/docs/tools/live_object.md): Read an object in the attached process as its class: each field's name, type, live value, and what pointers point at.
- [live_instances](/docs/tools/live_instances.md): Find a class's live objects by vtable in the attached process's data; live_object reads one.
- [live_watch](/docs/tools/live_watch.md): Watch attached-process memory: with an address, keep its bytes under the name; without, list what changed, naming fields when the class is known.

## Anything else

- [query](/docs/tools/query.md): Read a borer:// resource as resources/read does (same text, errors and memory), for hosts that cannot read resources, e.g.
- [script](/docs/tools/script.md): Run a sandboxed Rhai script over the loaded program, for what no single tool answers: what it printed, then the names and comments it proposed (dry-run unless dry_run=false).