# Corvus (nuget · CorvusRE)

Reverse engineering and security analysis of .NET and native binaries: decompile, compare, patch.

- Trust score: 77/100 (medium)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- nuget · `CorvusRE`: 77/100 (this document), [markdown](https://verifymcp.io/servers/albasha0x0-corvus/corvusre.md), [page](https://verifymcp.io/servers/albasha0x0-corvus/corvusre)

## Channel facts

- Registry: `nuget`
- Package: `CorvusRE`
- Version: `2.11.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 88/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - Install-script risk not yet assessed.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Build provenance not yet verified.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 0 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 73/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 28245 tokens (~170/item across 166 items; 165 tools + 1 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 67/100
  - Stability check failed: the tool surface changed between 2.3.0 and 2.11.0: 4 tool removals, 0 breaking changes, 13 additions.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 167 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the Corvus MCP server?

Corvus runs locally as a NuGet package, launched with dnx CorvusRE@2.11.0 --yes. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add albasha0x0-corvus -- dnx CorvusRE@2.11.0 --yes
```

### Cursor

```json
{
  "mcpServers": {
    "albasha0x0-corvus": {
      "command": "dnx",
      "args": [
        "CorvusRE@2.11.0",
        "--yes"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "albasha0x0-corvus": {
      "command": "dnx",
      "args": [
        "CorvusRE@2.11.0",
        "--yes"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add albasha0x0-corvus -- dnx CorvusRE@2.11.0 --yes
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "albasha0x0-corvus": {
      "type": "local",
      "command": [
        "dnx",
        "CorvusRE@2.11.0",
        "--yes"
      ],
      "enabled": true
    }
  }
}
```

### Hermes

```yaml
mcp_servers:
  albasha0x0-corvus:
    command: "dnx"
    args: ["CorvusRE@2.11.0", "--yes"]
```

### Netclaw

```json
{
  "McpServers": {
    "albasha0x0-corvus": {
      "Transport": "stdio",
      "Command": "dnx",
      "Arguments": [
        "CorvusRE@2.11.0",
        "--yes"
      ]
    }
  }
}
```

### Other

```json
{
  "mcpServers": {
    "albasha0x0-corvus": {
      "command": "dnx",
      "args": [
        "CorvusRE@2.11.0",
        "--yes"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 77, +1)

- [security regression] Stability: fail → unverified
- [security regression] Tool safety: pass → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional improvement] Tool coverage: 81% → 100%
- [functional] Package version: 2.10.0 → 2.11.0

### 2026-11-04 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 61 to 64.

### 2026-11-03 (score 75, +1)

- [functional] Package version: 2.7.3 → 2.10.0

### 2026-10-31 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 47 to 51.

### 2026-10-29 (score 73, +1)

- [security regression] Stability: fail → unverified
- [security regression] Tool safety: pass → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional] Package version: 2.7.2 → 2.7.3

### 2026-10-28 (score 72, +15)

- [security regression] Stability: fail → unverified
- [security regression] Tool safety: pass → unverified
- [security improvement] Malware scan: unverified → pass
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional] Package version: 2.7.0 → 2.7.2
- [functional] Package version: 2.7.0 → 2.7.1

### 2026-10-27 (score 57, −14)

- [security regression] Malware scan: pass → unverified
- [security regression] Stability: 0.37 → fail
- [functional improvement] Schema quality: 182 → 163
- [functional] Package version: 2.6.0 → 2.7.0

### 2026-10-25 (score 71, 0)

- [security regression] Tool safety: pass → unverified
- [security regression] Stability: 0.30 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional] Licence: MIT → Apache-2.0
- [functional] Package version: 2.5.1 → 2.6.0

## MCP tools (165)

### `get_engine_status` (~122 tokens)

Engine status of a native image

IDA and Ghidra sessions of a native image: state, running job, engine view. Starts no engine.

Input parameters:

- `bookmarks` (boolean): Ghidra: all Error and Warning bookmarks (default 5).
- `cancel` (boolean): Cancel the running open or background run; reports cancelled.
- `engine` (string): Default auto: both.
- `image` (string, required): Image id, name, path.
- `waitSeconds` (integer): Seconds to wait, 0-600; returns at the first state change, at once if settled.

Output parameters:

- `engines` (array)
- `image` (string)

### `export_edits` (~71 tokens)

Export edits as a script

Save an assembly's edits as a JSON script bound to its build (SHA-256, MVID) for apply_edits.

Input parameters:

- `assembly` (string, required): Assembly id, name, path.
- `outputPath` (string, required): Output .json path.
- `overwrite` (boolean): Overwrite outputPath.

Output parameters:

- `edits` (integer)
- `identity` (string)
- `mvid` (string)
- `outputPath` (string)
- `sha256` (string)

### `list_types` (~144 tokens)

List types

List types, optionally by namespace, name filter and kind.

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `filter` (string): Name substring or wildcard (*, ?), regex with regex=true, or /pattern/.
- `kind` (string): Only this kind.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `namespace` (string): Exact namespace ("" or <global> for the global one).
- `offset` (integer): Rows to skip.
- `regex` (boolean): filter is a regex.
- `topLevelOnly` (boolean): Leave out nested types.

Output parameters:

- `items` (array)
- `notEvaluated` (integer)

### `resolve_call_targets` (~245 tokens)

Native call targets

Resolve targets of call and tail-jump sites, indirect ones too, with basis and confidence. An unresolved site names its reason and the trace_native_values call to follow. engine= merges that engine's targets. [Long-running.]

Input parameters:

- `address` (string): A call, or an address in a function (its sites): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `deep` (boolean): Trace pointer parameters back into the callers (slower).
- `engine` (string): auto (default): IDA or Ghidra if analyzed, else ours.
- `image` (string, required): Image id, name, path.
- `limit` (integer): Max sites (max 1000).
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `scope` (string): image: all indirect sites. Default: site at a call, else function.
- `status` (string): Default all; indirect: all but direct branches.
- `timeoutSeconds` (integer): Seconds per engine request (default CORVUS_ENGINE_REQUEST_TIMEOUT); scans answer partial.

Output parameters:

- `byMechanism` (object)
- `byStatus` (object)
- `engine` (string)
- `engineNote` (string)
- `image` (string)
- `items` (array)
- `notes` (array)
- `scope` (string)
- `topUnresolved` (array)

### `search_constants` (~103 tokens)

Search numeric constants

Find a number (magic, opcode id, flag, crypto constant) in IL literals, const and enum values, attribute arguments and static arrays.

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `value` (string, required): Decimal, 0x hex, negative or floating-point.

Output parameters:

- `items` (array)
- `value` (string)

### `trace_native_feature` (~219 tokens)

Trace a native feature

Find the native functions behind a behaviour: strings, names, imports, exports, classes and constants matching query lead to their references, ranked by function, with the callers that reach several. [Long-running.]

Input parameters:

- `callerDepth` (integer): Caller levels searched for hubs (0-3).
- `engine` (string): auto (default): IDA or Ghidra if analyzed, else ours.
- `image` (string, required): Image id, name, path.
- `kinds` (string): Comma-separated: strings, names, imports, exports, classes, constants (default all).
- `limit` (integer): Functions per page (max 500).
- `maxSeeds` (integer): Matches followed (1-500); the rest are counted.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `query` (string, required): Case-insensitive substring ("quoted": exact), or a regex with regex=true or written /pattern/.
- `regex` (boolean): query is a regex.

Output parameters:

- `functions` (array)
- `hubs` (array)
- `image` (string)
- `nextOffset` (integer)
- `notes` (array)
- `offset` (integer)
- `query` (string)
- `seeds` (array)
- `totalFunctions` (integer)
- `totalSeeds` (integer)

### `list_exports` (~94 tokens)

List native exports

Exported functions and data of a native image: ordinal, VA, demangled name, symbol version and forwarders.

Input parameters:

- `filter` (string): Name substring (case-insensitive; demangled form too).
- `image` (string, required): Image id, name, path.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.

Output parameters:

- `image` (string)
- `items` (array)

### `inspect_instruction` (~144 tokens)

Inspect native instructions

Instruction details at a native address: encoding, operands, registers and flags read and written, memory accesses, stack change, flow and references. Walks up to 64 positions. [Long-running.]

Input parameters:

- `address` (string, required): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `engine` (string): auto (default): IDA or Ghidra if analyzed, else ours.
- `image` (string, required): Image id, name, path.
- `limit` (integer): Positions (1-64).
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.

Output parameters:

- `engine` (string)
- `engineNote` (string)
- `image` (string)
- `items` (array)
- `notes` (array)

### `analyze_native_function` (~212 tokens)

Native function dossier

Everything known about one native function, in sections: identity, signature, frame, callers, callees, data, flow, annotations; constants, params and pseudocode on request. [Long-running.]

Input parameters:

- `address` (string, required): In the function; up to 16 comma-separated (a dossier each): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `component` (boolean): Several addresses: one component view (internal calls, shared data, interface).
- `engine` (string): Pseudocode engine (default auto).
- `image` (string, required): Image id, name, path.
- `maxItems` (integer): Facts per section (1-500).
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Character offset (nextOffset).
- `pseudocode` (boolean): Add the pseudocode section.
- `sections` (string): Comma-separated sections (default all but constants, params, pseudocode).

Output parameters:

- `address` (string)
- `batch` (array)
- `component` (object)
- `end` (string)
- `image` (string)
- `name` (string)
- `next` (array)
- `sections` (array)
- `size` (integer)

### `set_native_stack_var` (~227 tokens)

Rename, retype or delete a stack variable

Rename, retype or delete a stack frame member; a type at an empty offset creates one. Return address and saved registers are refused. Kept in annotations. [Long-running.]

Input parameters:

- `clear` (boolean): Drop the user edit, restoring the engine member.
- `delete` (boolean): Delete the member.
- `engine` (string): Default auto.
- `function` (string, required): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `image` (string, required): Image id, name, path.
- `items` (string): Instead: lines member = newName, or JSON [{variable, newName?, type?, delete?, clear?}].
- `newName` (string): New name (a C identifier).
- `showDecompile` (string): after: pseudocode after the edit; diff: its unified diff.
- `type` (string): New C type.
- `variable` (string): The member: get_native_frame name (var_28) or frame offset (hex, from the lowest address).

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)

### `search_decompiled` (~182 tokens)

Search native pseudocode

Search the IDA or Ghidra pseudocode of every function, line by line, in address order. Stops at maxFunctions, timeoutSeconds or limit hits; continue with nextOffset. [Long-running.]

Input parameters:

- `engine` (string): Default auto.
- `filter` (string): substring (case-insensitive), * ? glob, or /regex/ (flags i, m, s).
- `image` (string, required): Image id, name, path.
- `limit` (integer): Max hits (max 2000).
- `maxFunctions` (integer): Max 20000.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): First function (nextOffset).
- `pattern` (string, required): Regex, case-insensitive; (?-i) for exact case.
- `timeoutSeconds` (integer): Max 600.

Output parameters:

- `engine` (string)
- `engineNote` (string)
- `failed` (integer)
- `functionsSearched` (integer)
- `functionsTotal` (integer)
- `image` (string)
- `items` (array)
- `pattern` (string)
- `stoppedBy` (string)

### `convert_number` (~115 tokens)

Convert a number

Convert numbers exactly: signed and unsigned decimal, hex, binary, octal, LE and BE bytes with their ASCII, and the bits as float or double.

Input parameters:

- `numbers` (array, required): Decimal, 0x or h-suffixed hex, 0b, 0o, C suffixes, 'ABCD' (C char constant) or "text" (memory order).
- `size` (integer): Width in bytes: 1, 2, 4 or 8 (default: smallest that fits).

Output parameters:

- `items` (array)

### `get_android_resource` (~156 tokens)

Get Android resource

One entry or resource of an Android package: an entry path (binary XML decoded, else text or hex), or @type/name / 0x7f... for its value in every configuration.

Input parameters:

- `maxTokens` (integer): Page size in tokens.
- `name` (string, required): Entry path (res/xml/x.xml, assets/...), @type/name or resource id 0x7f...
- `offset` (integer): Character offset (nextOffset).
- `outputPath` (string): Write the entry bytes to this file.
- `overwrite` (boolean): Overwrite outputPath.
- `path` (string, required): An .apk, .aab or split set (.apks, .xapk, .apkm).

Output parameters:

- `bytes` (integer)
- `code` (string)
- `entry` (string)
- `nextOffset` (integer)
- `offset` (integer)
- `outputPath` (string)
- `sha256` (string)
- `totalChars` (integer)

### `get_method_addresses` (~150 tokens)

Method addresses and offsets

Native addresses, field offsets and tokens of an AOT method or type. script.json adds function bounds, shared code, generic instantiations and metadata slots; stringliteral.json adds the literals a method loads.

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `limit` (integer): Max entries of each long list.
- `offset` (integer): First entry of each long list.
- `slot` (string): With a type: a vtable slot number to resolve to its method, or all.
- `symbol` (string, required): Type or member (Ns.Type::M(int), name, token) or script.json name (List`1<int>::Add).

Output parameters:

- `items` (array)
- `members` (array)
- `symbol` (string)

### `list_cpp_classes` (~157 tokens)

C++ classes from RTTI

C++ classes from RTTI with bases and vftables; also Delphi / Free Pascal VMT classes and Mach-O ObjC and Swift types. engine=ida or ghidra lists that engine's classes.

Input parameters:

- `engine` (string): Class source (default auto: RTTI).
- `filter` (string): Name substring, any case.
- `image` (string, required): Image id, name, path.
- `limit` (integer): Max classes.
- `maxTokens` (integer): Page size in tokens.
- `namespaces` (boolean): engine=ghidra: plain namespaces and libraries too.
- `offset` (integer): Rows to skip.
- `slots` (boolean): Slot addresses (Pascal: methods, fields).

Output parameters:

- `image` (string)
- `items` (array)
- `notes` (array)
- `source` (string)

### `undo_edit` (~73 tokens)

Undo an edit

Undo the last edit or one by number: the others are replayed on the original image; a conflict changes nothing. [Long-running.]

Input parameters:

- `assembly` (string, required): Assembly id, name, path.
- `number` (integer): Edit number from list_edits (#n of its editId); omit for the last.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)

### `inspect_process` (~278 tokens)

Inspect a running process (read-only)

Inspect a running Windows process read-only: summary, modules, regions, threads, stacks or windows (needs --allow-window-capture), with addresses named as in dumps. Nothing is written or suspended.

Input parameters:

- `imageDirectories` (string): Program binary folders (';'-separated), for modules whose file is unreadable.
- `imagePath` (string): windows: PNG of the first window.
- `limit` (integer): Max rows.
- `maxFrames` (integer): view=stacks: max frames walked (up to 256).
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `process` (string, required): Process id (decimal or 0x hex), name (notepad[.exe]; a shared name is refused with the ids) or session id (live-1).
- `regionFilter` (string): view=regions filter; default committed.
- `thread` (string): threads: only this one; stacks: the thread walked (default first). Id or name.
- `timeoutSeconds` (integer): Time limit in seconds (up to 120).
- `view` (string): summary, modules, regions, threads, stacks or windows.
- `yara` (string): unbacked: YARA rules (text, file, folder, pack:name).

Output parameters:

- `access` (array)
- `architecture` (string)
- `counts` (object)
- `detached` (boolean)
- `handlesClosed` (integer)
- `handlesOpened` (integer)
- `items` (array)
- `largestRegions` (array)
- `mainModule` (object)
- `name` (string)
- `notes` (array)
- `path` (string)
- `processId` (integer)
- `runtime` (string)
- `stackStop` (string)
- `startTimeUtc` (string)
- `stillRunning` (boolean)
- `thread` (object)
- `view` (string)
- `wow64` (boolean)

### `search_strings` (~143 tokens)

Search string literals

Find string literals (ldstr, string constants) by substring, wildcard or regex, with each user's method and IL offset. Dummy assemblies: literals with slot RVAs and, with the binary, the functions loading them.

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `query` (string, required): Substring, wildcard, regex or /pattern/.
- `regex` (boolean): query is a regex.
- `usesPerLiteral` (integer): Dummy assemblies: max functions per literal.

Output parameters:

- `items` (array)
- `notEvaluated` (integer)

### `define_native` (~194 tokens)

Redefine code or data in the engine

Redefine an address in the engine as code, a function, data or undefined, up to end or along the flow. data and undefine drop a global's user type. Kept in annotations. [Long-running.]

Input parameters:

- `address` (string, required): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `end` (string): Exclusive end address (same forms as address).
- `engine` (string): Default auto.
- `image` (string, required): Image id, name, path.
- `kind` (string, required): function with end moves a function end; flow (Ghidra): type branch, call, call_return or return, else clears.
- `type` (string): kind=data: byte, word, dword, qword, float, double, string, string16 (UTF-16), a C type; dword[8] arrays.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)

### `server_status` (~71 tokens)

Server status

Version, program, client, catalog digest, loaded files, limits, capabilities with fixes and unusable tools. expectedCatalogDigest detects a stale server; expectedExecutable checks the registered copy.

Input parameters:

- `expectedCatalogDigest` (string): Catalog digest to compare.
- `expectedExecutable` (string): Registered server path to compare.

Output parameters:

- `actionNotes` (array)
- `backgroundIndexing` (string)
- `capabilities` (array)
- `catalogDifference` (string)
- `catalogDigest` (string)
- `catalogMatches` (boolean)
- `client` (object)
- `engineSessions` (array)
- `engineTimeLimits` (object)
- `executable` (string)
- `executableMatches` (boolean)
- `informationalVersion` (string)
- `installKind` (string)
- `loadedAssemblies` (integer)
- `longRunningTools` (array)
- `protocolVersion` (string)
- `sections` (array)
- `server` (string)
- `startedAt` (string)
- `tools` (integer)
- `toolsFileAndTrace` (object)
- `toolsets` (array)
- `unavailableTools` (array)
- `uptimeSeconds` (integer)
- `version` (string)
- `workingSetMB` (integer)

### `get_assembly_info` (~74 tokens)

Assembly overview

Assembly overview: identity, framework, entry point, counts, invalid IL, transformer, edits. view=references, metadata (tables, heaps), transforms (a dry run) or bindings (script names).

Input parameters:

- `assembly` (string, required): Assembly id, name, path.
- `view` (string): What to show.

Output parameters:

- `addressedMethods` (integer)
- `attributes` (array)
- `entryPoint` (string)
- `fields` (integer)
- `file` (string)
- `fullName` (string)
- `heaps` (array)
- `id` (string)
- `invalidBodies` (integer)
- `invalidExceptionClauses` (integer)
- `kind` (string)
- `machine` (string)
- `metadataIssueCount` (integer)
- `metadataIssues` (array)
- `methods` (integer)
- `mvid` (string)
- `namespaces` (integer)
- `nestedTypes` (integer)
- `referenceAssembly` (boolean)
- `referenceCount` (integer)
- `references` (array)
- `resources` (integer)
- `runtime` (string)
- `sha256` (string)
- `tables` (array)
- `targetFramework` (string)
- `transformers` (array)
- `types` (integer)
- `unresolvedReferences` (integer)
- `unsavedEdits` (array)

### `rename_namespace` (~99 tokens)

Rename namespace

Move every type of a namespace (optionally its sub-namespaces) to a new namespace, in memory.

Input parameters:

- `assembly` (string, required): Assembly id, name, path.
- `dryRun` (boolean): true previews; false applies.
- `includeSubNamespaces` (boolean): Also rewrite the namespaces under oldNamespace.
- `newNamespace` (string, required): New namespace.
- `oldNamespace` (string, required): Existing namespace ("" for the global one).

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)

### `load_session` (~164 tokens)

Load a session

Restore a save_session file: find each file (recorded path, relative path, else SHA-256 under searchRoots), reapply its work. A changed file is refused unless targetBuild=other. [Long-running.]

Input parameters:

- `dryRun` (boolean): Report only.
- `include` (string): Comma list: edits, patches, annotations, notes, all (default).
- `limit` (integer): Items to return (max 2000).
- `offset` (integer): Rows to skip.
- `path` (string, required): The session file.
- `searchRoots` (string): ;-separated folders searched recursively for moved files, by SHA-256.
- `targetBuild` (string): Default same; other: native work needs the old build under searchRoots.

Output parameters:

- `dryRun` (boolean)
- `items` (array)
- `notes` (array)
- `outcomes` (array)
- `path` (string)
- `targetBuild` (string)

### `map_java_dotnet` (~140 tokens)

Map Java and .NET

Pairs across a Java / .NET bridge, both ways: .NET for Android wrappers ([Register], crc64 names) and Mono C# calls through AndroidJavaClass / AndroidJNI. A * / ? pattern lists pairs.

Input parameters:

- `limit` (integer): Most pairs.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `path` (string): Package whose assemblies to read; optional when they are loaded.
- `symbol` (string, required): Java class (Lpkg/C;, pkg.C) or method (Lpkg/C;->m(I)V), .NET symbol, or pattern.

Output parameters:

- `direction` (string)
- `items` (array)
- `notes` (array)
- `query` (string)

### `find_call_paths` (~192 tokens)

Call paths to a method

Call chains that reach a method, from from= or entry points, shortest first. A native to= follows native callers and P/Invokes back to managed code.

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `directOnly` (boolean): No hops through virtual dispatch (native: RTTI virtual calls, pointers).
- `from` (string): Start method, same forms as to (native only when to is native).
- `limit` (integer): Max rows.
- `maxDepth` (integer): Max chain length (max 30).
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `to` (string, required): Type or member (Ns.Type::Method(int), name, token) or native export (kernel32.dll!CreateFileW, native:IMAGE!NAME|#ORD|ADDR).

Output parameters:

- `engine` (string)
- `from` (string)
- `items` (array)
- `target` (string)

### `find_references` (~177 tokens)

Find usages (xrefs to)

Every use of a symbol in loaded assemblies: method call sites (also via base or interface), field reads, writes, address uses and type uses. A native export gives P/Invoke callers and native call sites.

Input parameters:

- `assembly` (string): Assembly defining the symbol; default: all loaded.
- `directOnly` (boolean): Methods: no calls through base / interface declarations.
- `kind` (string): Symbol kind; overrides: overrides and implementations of the method.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `symbol` (string, required): Type or member (Ns.Type::Method(int), name, token) or native export (kernel32.dll!CreateFileW, native:IMAGE!NAME|#ORD|ADDR).

Output parameters:

- `items` (array)
- `target` (string)

### `live_break` (~121 tokens)

Stop points in a session

Set, list or clear stop points; continue resumes; wait returns the oldest held stop with its stack.

Input parameters:

- `action` (string): Action.
- `at` (string): set: name, module!export, address or file:line.
- `session` (string, required): Id from live_session.
- `stopPoint` (string): clear: stop point id.
- `thread` (string): continue: thread id; default all.
- `wait` (boolean): Wait for a stop.
- `waitSeconds` (integer): wait: seconds (1-300).

Output parameters:

- `namedAddresses` (array)
- `session` (string)
- `stop` (object)
- `stopPoints` (array)

### `export_project` (~91 tokens)

Export C# project

Decompile an assembly into a C# project on disk; an .apk or .aab gives a Gradle project. Written whole or not at all; a repeat joins a running export. [Long-running.]

Input parameters:

- `assembly` (string, required): Assembly id, name, path.
- `outputDirectory` (string, required): Empty or new output directory.
- `overwrite` (boolean): Replace a previous export in outputDirectory.

Output parameters:

- `applied` (boolean)
- `failedTypes` (array)
- `files` (integer)
- `outputDirectory` (string)
- `projectFile` (string)
- `renamedFiles` (array)
- `replaced` (boolean)
- `source` (string)

### `get_exception_info` (~116 tokens)

Native exception handling

Exception handling of a native function: handlers, try blocks or call sites, landing pads, caught types. Without address: the image's counts and rejected metadata. [Long-running.]

Input parameters:

- `address` (string): Hex VA/RVA (rva:/va:/off:), export, module!import, function. Omit for an image summary.
- `image` (string, required): Image id, name, path.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Character offset (nextOffset).

Output parameters:

- `address` (string)
- `counts` (object)
- `format` (string)
- `function` (string)
- `handlers` (array)
- `image` (string)
- `parent` (string)
- `ranges` (array)
- `scheme` (string)

### `bucket_minidumps` (~257 tokens)

Group crash dumps

Group a folder of minidumps by crash signature (exception code, faulting function, top frames), by name so rebases do not split a bucket. [Long-running.]

Input parameters:

- `budgetSeconds` (integer): Seconds parsing new dumps (1-3000).
- `folder` (string, required): Folder of .dmp or core files.
- `imageDirectories` (string): Program binary folders, ;-separated.
- `limit` (integer): Max rows.
- `managed` (string): auto: managed signatures through a local DAC; off: native only.
- `maxDumps` (integer): Most dumps bucketed, newest first.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `pattern` (string): File patterns, ;-separated (default *.dmp;*.mdmp;*.core;core.*).
- `recursive` (boolean): Search subfolders.
- `skipModules` (string): More frames to skip, ;-separated: module or module!function, * wildcards.
- `splitByVersion` (boolean): Add the faulting module version to the signature.
- `topFrames` (integer): Signature frames after the faulting one.

Output parameters:

- `dumps` (object)
- `failed` (array)
- `folder` (string)
- `items` (array)
- `notes` (array)

### `unpack_container` (~263 tokens)

Extract container

Extract a container, load its .NET assemblies: single-file bundles, Costura, .nupkg, .apk, .aab, zips, .asar, captures (HAR, pcap), JS bundles with source maps, single compressed streams. Nothing runs; runnable and shell-parsed names get .bin. algorithm: cipher dry run. A repeat call pages the kept report. [Long-running.]

Input parameters:

- `algorithm` (string): aes-128 or blowfish.
- `extractOnly` (boolean): Extract without loading; ids are in loadedAs.
- `keyLog` (string): TLS key log (SSLKEYLOGFILE) to decrypt a pcap.
- `limit` (integer): Max rows.
- `mode` (string): ecb (default) or cbc.
- `offset` (integer): Rows to skip.
- `outputDirectory` (string): Empty directory or earlier extract; default: temp.
- `parameterFile` (string): JSON: key, iv, expected (hex), direction, padding, offset, length.
- `password` (string): Password of encrypted zip, 7z, RAR, PDF, Office document; only it is tried.
- `path` (string, required): Container file, Blazor or ClickOnce folder.

Output parameters:

- `container` (string)
- `items` (array)
- `next` (object)
- `outputDirectory` (string)
- `source` (string)
- `transform` (object)

### `emulate_native` (~387 tokens)

Emulate native code

Emulate native code from an address: return value, registers and written strings. resume= continues a run a budget stopped, saved best-effort under the data folder. [Long-running.]

Input parameters:

- `address` (string, required): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `args` (string): Per calling convention: integer, address or pointer to 'text', u'text', buf:N (zeros) or hex:41A0.
- `candidates` (string): Argument sets, ;-separated, each as args; one timeoutSeconds covers all.
- `engine` (string): auto: Ghidra, else ours; ours: x86/x64/ARM64 integer code; speakeasy: a whole program.
- `image` (string, required): Image id, name, path.
- `maxInstructions` (integer): Instruction budget (1-50000000).
- `memory` (string): ADDR=VALUE: 'text', u'text', hex:.., zero:N, u32:5, ptr:..; outside the image va:0x10000000.
- `read` (string): Shown after the run: ADDR or register, space or :, length (rcx 64).
- `registers` (string): rcx=0x10, rdx='key' (values as args).
- `resume` (string): Run id from Next, also after a restart; address is ignored.
- `stopAt` (string): Addresses to stop at.
- `stubs` (string): Calls not run: name=value (GetTickCount=5, kernel32!Sleep=0; *=0 calls outside the image).
- `timeoutSeconds` (integer): Time budget, s (1-300).
- `trace` (integer): Last instructions listed (0-2000).

Output parameters:

- `apiCalls` (array)
- `callCount` (integer)
- `calls` (array)
- `candidates` (array)
- `engine` (string)
- `filesWritten` (array)
- `image` (string)
- `instructions` (integer)
- `nullPageWrites` (object)
- `reads` (array)
- `regionSet` (string)
- `registers` (array)
- `returnRegister` (string)
- `returnValue` (string)
- `stop` (string)
- `stoppedAt` (string)
- `trace` (array)
- `written` (array)

### `make_code_pattern` (~248 tokens)

Make a code pattern

Make a byte pattern for an address that survives a rebuild: displacements and relocated addresses as ??, unique in the executable sections. search_code_pattern finds it. [Long-running.]

Input parameters:

- `address` (string): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `addresses` (array): Instead of address; up to 50.
- `anchor` (string): auto: at the address, else at a referencing instruction; xrefs: one per reference; range: [address, end).
- `end` (string): anchor=range: exclusive end, an address or +length.
- `engine` (string): anchor=xrefs: ida or ghidra add engine references.
- `format` (string): ida, x64dbg, mask (\x48\x00 x?), bitmask (0x48, 0x00 0b01) or yara (rule, compiled).
- `image` (string, required): Image id, name, path.
- `maxBytes` (integer): Longest pattern in bytes (8-512).
- `maxPatterns` (integer): anchor=xrefs: most signatures (1-32).

Output parameters:

- `failed` (integer)
- `format` (string)
- `image` (string)
- `results` (array)

### `export_method_symbols` (~122 tokens)

Export IDA/Ghidra scripts

Export dummy-assembly metadata as IDA Python and Ghidra scripts that create, name and comment every function, a C header of struct layouts and a script.json. [Long-running.]

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `baseName` (string): Base name of the generated files.
- `formats` (string): Comma-separated: ida, ghidra, header, json or all.
- `outputDirectory` (string, required): Output directory.
- `overwrite` (boolean): Replace same-named files.

Output parameters:

- `files` (array)
- `functions` (integer)
- `structs` (integer)

### `list_native_edits` (~122 tokens)

List native edits

Native edits of an image in order, each with its editId, then the name layers with counts. search lists matching names and comments instead. [Long-running.]

Input parameters:

- `image` (string, required): Image id, name, path.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `search` (string): Instead: matching names and comments: substring (case-insensitive), * ? glob, or /regex/ (flags i, m, s).

Output parameters:

- `image` (string)
- `items` (array)
- `layers` (array)

### `find_r2r_method` (~78 tokens)

Managed method at a ReadyToRun address

Managed method whose ReadyToRun code holds a native address: name, token, range, offset and instruction, or what an import cell resolves to.

Input parameters:

- `address` (string, required): A VA or RVA in the code image (rva:/va:/off: prefix).
- `assembly` (string, required): Assembly id, name, path.

Output parameters:

- `address` (string)
- `begin` (string)
- `end` (string)
- `file` (string)
- `importCell` (string)
- `instruction` (string)
- `kind` (string)
- `methods` (array)
- `offset` (string)

### `unload_assembly` (~38 tokens)

Unload assembly

Remove an assembly, discarding unsaved edits, or close a dump id.

Input parameters:

- `assembly` (string, required): Assembly id, name, path.

Output parameters:

- `discardedEdits` (integer)
- `ids` (array)

### `search_instructions` (~292 tokens)

Search native instructions

Find instructions by mnemonic, operand or line regex (case-insensitive), or by operand value, in all functions, one function or an address range. A page the scan budget stopped continues at nextOffset. [Long-running.]

Input parameters:

- `engine` (string): auto (default): IDA or Ghidra if analyzed, else ours.
- `from` (string): Range start (with to, or alone: to the end of its section).
- `function` (string): Only this function: Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `image` (string, required): Image id, name, path.
- `limit` (integer): Max matches (max 2000).
- `maxInstructions` (integer): Instructions scanned per page (max 5000000).
- `maxTokens` (integer): Page size in tokens.
- `mnemonic` (string): Mnemonic regex, e.g. ^(call|jmp)$
- `offset` (integer): Rows to skip.
- `operands` (string): Operand text regex, e.g. rsp\+|fs:
- `text` (string): Regex over the whole instruction text.
- `to` (string): Range end (exclusive).
- `value` (string): Operand value: 0x10B, 267, an address, or range 0x100..0x1FF.

Output parameters:

- `engine` (string)
- `engineNote` (string)
- `image` (string)
- `items` (array)
- `scanned` (integer)

### `patch_bytes` (~337 tokens)

Patch native bytes

Replace bytes at a native address in memory as an undoable edit. Unsafe sites need allowUnsafe; encrypted bytes are refused; signatures become invalid. Warnings (writable_executable_section, high_entropy_section, signature_invalidated) name the site and the file. [Long-running.]

Input parameters:

- `address` (string, required): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `allowUnsafe` (boolean): Allow mid-instruction, past-function-end, header or loader-written bytes.
- `dryRun` (boolean): true previews; false applies.
- `extend` (boolean): Put code larger than the site in a stub (placement) it jumps to and back. Refused when unsafe.
- `hex` (string): Replacement bytes as hex (90 90, 9090 or 0x90,0x90).
- `image` (string, required): Image id, name, path.
- `placement` (string): With extend: auto (default): cave, else section (a new PE section or ELF/Mach-O segment).
- `relocations` (string): PE relocations: auto (default) keeps valid, clears stale, adds new; neutralize clears all.
- `stubMode` (string): With extend: replace (default; the displaced instructions), before or after them.
- `type` (string): With value: i8-i64, u8-u64, f32, f64 or ptr; be suffix: big-endian.
- `value` (string): Instead of hex: a number of type (range-checked); ptr: or a name.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)
- `items` (array)
- `pushedTo` (array)

### `find_dex_references` (~189 tokens)

Find DEX references

Cross-references in DEX code with method and code offset. direction=to: who calls, reads, writes or uses target; from: what a method or class calls, reads, writes and loads. Methods match by exact id. [Long-running.]

Input parameters:

- `direction` (string): Default to: who refers to target.
- `kind` (string): How to read target (default auto; string: taken literally).
- `limit` (integer): Most references.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `path` (string, required): An Android package, .dex or jar with classes*.dex.
- `target` (string, required): Class, method (Lpkg/C;->m(I)V, pkg.C::m(int)), field (Lpkg/C;->f:I, pkg.C::f), "string".

Output parameters:

- `direction` (string)
- `items` (array)
- `notes` (array)
- `target` (string)
- `targetKind` (string)

### `simplify_methods` (~189 tokens)

Simplify method bodies

Clean transformed method bodies: fold (string decoders run in a safe IL interpreter), cfg (constant branches, flattened control flow), inline (forwarders, call proxies). What is left has a reason code (docs/simplify.md). [Long-running.]

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all. Required without symbol.
- `budget` (integer): Max IL instructions per evaluated call, nested calls included.
- `deterministicEnvironment` (boolean): Fold machine reads (paths, environment, names) against fixed stand-ins.
- `dryRun` (boolean): true previews; false applies.
- `maxDepth` (integer): Max evaluation call depth.
- `passes` (array): Passes to run; omit for all three.
- `symbol` (string): Method or type (nested included): Ns.Type::M(int), name or token; omit: whole assembly.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)

### `get_dex_class` (~154 tokens)

DEX class

One DEX class: superclass, interfaces, signature, inner classes, Kotlin @Metadata, annotations, fields and methods, paged.

Input parameters:

- `class` (string, required): Class: Lpkg/Name;, pkg.Name, or pkg.Outer.Inner / pkg.Outer$Inner.
- `limit` (integer): Most members.
- `mapping` (string): R8/ProGuard mapping.txt: shows and accepts original names; kept per package.
- `members` (string): all (default), fields or methods.
- `offset` (integer): Rows to skip.
- `path` (string, required): An Android package, .dex or jar with classes*.dex.
- `query` (string): Only members whose name contains this.

Output parameters:

- `access` (string)
- `annotations` (array)
- `descriptor` (string)
- `dexFile` (string)
- `enclosingClass` (string)
- `enclosingMethod` (string)
- `fields` (integer)
- `genericSignature` (string)
- `innerClasses` (array)
- `interfaces` (array)
- `items` (array)
- `javaName` (string)
- `kotlin` (string)
- `methods` (integer)
- `original` (string)
- `sourceFile` (string)
- `super` (string)

### `apply_edits` (~133 tokens)

Apply an edit script

Replay an export_edits script, with each edit's outcome. Another build needs targetBuild=other. [Long-running.]

Input parameters:

- `assembly` (string): Target assembly; omit for the one named in the script.
- `continueOnError` (boolean): Apply the edits that succeed; default: roll all back on the first failure.
- `dryRun` (boolean): true: apply every edit, report, roll back; false keeps them.
- `path` (string, required): The .json edit script.
- `targetBuild` (string): same: the script build only; other: another build, symbols by name.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)
- `items` (array)
- `pushedTo` (array)

### `set_native_local` (~271 tokens)

Rename or retype a decompiler local

Rename or retype a native pseudocode local or argument as decompile_native names it (v3, a1) or stack:0x28. The first name or clear drops the edit; a type that does not fit is refused. Kept in annotations. [Long-running.]

Input parameters:

- `clear` (boolean): Drop the user name and type.
- `engine` (string): Default auto.
- `function` (string, required): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `image` (string, required): Image id, name, path.
- `inferStruct` (string): Ghidra: declare this struct from the local's accesses; the local points to it.
- `items` (string): Instead: lines local = newName, or JSON [{local, newName?, type?, clear?}].
- `local` (string): The variable: its pseudocode name, or stack:OFFSET (hex).
- `newName` (string): New name (a C identifier).
- `showDecompile` (string): after: pseudocode after the edit; diff: its unified diff.
- `storage` (string): Move an argument to this register; auto: where the convention puts it.
- `type` (string): New C type.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)

### `summarize_file` (~237 tokens)

Summarize file

Summarize a file, folder or assembly, never run: type, hashes, signature, containers, assemblies, entry points. view= opens one aspect.

Input parameters:

- `assembly` (string): A loaded assembly; this or path.
- `columns` (array): With table=: these columns and rowid.
- `limit` (integer): Max rows.
- `offset` (integer): Rows to skip.
- `overwrite` (boolean): Overwrite either file.
- `password` (string): Password to decrypt with; only it is tried.
- `path` (string): A file or folder.
- `sbomPath` (string): Write dependencies here, CycloneDX 1.6.
- `script` (string): assets: assets of this script class.
- `stixPath` (string): Write findings here, STIX 2.1.
- `table` (string): Table; lmdb, berkeleydb: database; evtx: provider/id; procmon: process/PID/operation/result; registry: key; pri: name; esp32: namespace.
- `view` (string): A view the overview lists.

Output parameters:

- `assemblies` (array)
- `capa` (object)
- `container` (string)
- `detail` (object)
- `entropy` (number)
- `entryPoints` (array)
- `findingTotal` (integer)
- `findings` (array)
- `highlightTotal` (integer)
- `highlights` (array)
- `level` (string)
- `md5` (string)
- `path` (string)
- `ruleTable` (string)
- `sha1` (string)
- `sha256` (string)
- `signature` (string)
- `size` (integer)
- `type` (string)
- `values` (object)
- `view` (string)
- `views` (array)

### `export_engine_database` (~130 tokens)

Export the engine database

Write the engine database of a native image, with the names, comments and types made here, to open in IDA (.i64) or Ghidra (.gzf); written whole or not at all. [Long-running.]

Input parameters:

- `engine` (string): Default: the engine of the extension, else IDA.
- `image` (string, required): Image id, name, path.
- `outputPath` (string, required): The .i64 (IDA), .gzf, or Ghidra types alone as .h or .gdt.
- `overwrite` (boolean): Overwrite outputPath.

Output parameters:

- `bytes` (integer)
- `engine` (string)
- `image` (string)
- `note` (string)
- `path` (string)

### `load_assembly` (~437 tokens)

Load assembly

Load a .NET assembly, a folder, or a native image (PE, ELF, Mach-O, wasm). An AOT build (global-metadata.dat v24-39) loads from its folder, global-metadata.dat or package as dummy assemblies with addresses and its binary. A repeat load is a no-op. [Long-running.]

Input parameters:

- `arch` (string): raw: x86, x64, arm, thumb, arm64; mips, ppc, riscv64, 6502 etc. via IDA or Ghidra.
- `base` (string): raw: load address (default 0).
- `compilerSpec` (string): Ghidra compiler spec (also the IDA compiler): windows, gcc, borlandcpp, borlanddelphi...
- `disableAnalyzers` (array): Analyzers off at import (AF_FLIRT, "Decompiler Switch Analysis").
- `entry` (string): raw: entry address or file offset (default start).
- `format` (string): auto, or raw (headerless code).
- `language` (string): Ghidra language id: x86:LE:32:default...
- `loadProviders` (boolean): Also load the DLLs the imports bind to (one level, at most 16).
- `path` (string, required): Absolute path: a file, a folder (native files skipped), an AOT build, package or memory dump, or a Ghidra .gzf / .gpr (copied).
- `processor` (string): IDA processor (-p): metapc, arm, mipsl...
- `program` (string): Program path in a .gpr, e.g. /app.exe (default: its only one).
- `recursive` (boolean): Also load assemblies in subdirectories.
- `seeds` (array): Starts before analysis: [function|code|label:]address[=name].
- `slice` (string): Mach-O slice or index (default arm64e, arm64, x86_64), or the APK ABI (default arm64-v8a).

Output parameters:

- `discardedEdits` (integer)
- `entries` (array)
- `ids` (array)
- `skipped` (integer)

### `extract_embedded` (~202 tokens)

Extract embedded content

Embedded content of an assembly, container or native PE (resources, byte arrays, literals, inner PEs), decoded (hex, base64, compression, XOR) to an image, archive or text with its encoding chain; save=true writes them.

Input parameters:

- `assembly` (string): A loaded assembly; this or path.
- `includeMedia` (boolean): Also list and save images (else counted).
- `limit` (integer): Max rows.
- `load` (boolean): Load .NET assemblies found (implies save).
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `outputDirectory` (string): Empty directory or an earlier extraction; default: temp.
- `path` (string): An assembly or container file, read without loading.
- `save` (boolean): Write the items to disk.
- `xorText` (boolean): Also try 1-16 byte XOR keys (slower).

Output parameters:

- `assembly` (string)
- `items` (array)
- `outputDirectory` (string)

### `rename_native` (~220 tokens)

Name a native address

Name a native address for every native tool and the engines; kept per file and undoable. Letters, digits, _ $ @, up to 255 chars; empty clears. items: many in one push. [Long-running.]

Input parameters:

- `address` (string): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `allowDuplicate` (boolean): Allow a name already used at another address.
- `dryRun` (boolean): true previews; false applies.
- `engine` (string): Engine to push to now (default: the one with this image open, else next use).
- `image` (string, required): Image id, name, path.
- `items` (string): Lines address = name, or JSON [{address, name}].
- `name` (string): New name; empty clears the name here.
- `showDecompile` (string): after: pseudocode after the edit; diff: its unified diff.
- `stopOnError` (boolean): Stop at the first failing item.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)
- `items` (array)
- `pushedTo` (array)

### `get_android_manifest` (~105 tokens)

Android manifest

AndroidManifest.xml decoded. view=summary: package, SDKs, permissions, exported components and why, highlights; components: each with intent filters, deep links and meta-data.

Input parameters:

- `limit` (integer): Most components.
- `offset` (integer): Rows to skip.
- `path` (string, required): An .apk, .aab or split set (.apks, .xapk, .apkm).
- `view` (string): summary (default) or components.

Output parameters:

- `application` (object)
- `compileSdk` (integer)
- `componentCounts` (object)
- `declaredPermissions` (array)
- `exported` (array)
- `exportedTotal` (integer)
- `features` (array)
- `highlights` (array)
- `issues` (array)
- `items` (array)
- `libraries` (array)
- `maxSdk` (integer)
- `metaData` (array)
- `minSdk` (integer)
- `package` (string)
- `permissions` (array)
- `queries` (array)
- `split` (string)
- `targetSdk` (integer)
- `versionCode` (string)
- `versionName` (string)

### `compare_assemblies` (~268 tokens)

Compare two builds

Compare two builds of an assembly: renamed, moved, changed, added and removed types and members, and capabilities added or removed. oldResult / newResult compare two kept results instead. [Long-running.]

Input parameters:

- `changes` (array): Kinds to list (unknown: unpaired for lack of evidence); default all but address.
- `includeCompilerGenerated` (boolean): Also compiler-generated types and members (closures, state machines).
- `limit` (integer): Changes per page.
- `maxTokens` (integer): Page size in tokens.
- `namespace` (string): Only types whose old or new full name starts with this.
- `newAssembly` (string): New build: id, name or path.
- `newResult` (string): The new side, from the same tool.
- `offset` (integer): Rows to skip.
- `oldAssembly` (string): Old build: id, name or path.
- `oldResult` (string): Instead: a kept result (r-...), last:N (recent call) or bundle entry (file.json#r-...).
- `tokenMap` (boolean): Keep the whole old-to-new token map as a result (tokenMapResultId).
- `typeCountsOnly` (boolean): Count added and removed types, not listed.

Output parameters:

- `ambiguousMembers` (integer)
- `changes` (array)
- `evidence` (object)
- `hiddenCompilerGenerated` (integer)
- `items` (array)
- `matchedTypes` (integer)
- `memberChanges` (array)
- `memberMatches` (array)
- `new` (object)
- `newSkippedBodies` (integer)
- `old` (object)
- `oldSkippedBodies` (integer)
- `oldTypes` (integer)
- `tokenMapEntries` (integer)
- `tokenMapResultId` (string)
- `typeChanges` (array)

### `uninstall_android_package` (~70 tokens)

Uninstall package from device

Remove an app (and its data unless keepData) from a device; needs --allow-device-changes.

Input parameters:

- `keepData` (boolean): Keep app data and cache.
- `package` (string, required): Package (com.example.app).
- `serial` (string): Device serial; omit if one device.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)
- `items` (array)
- `pushedTo` (array)

### `get_nativeaot_info` (~151 tokens)

NativeAOT metadata

Metadata of a NativeAOT image (.NET 7-10; PE, ELF, Mach-O): MethodTables, method names, frozen strings and statics. Recovered names apply as the nativeaot layer. [Long-running.]

Input parameters:

- `image` (string, required): Image id, name, path.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `query` (string): view=type: a type name or MethodTable address; list views: substring.
- `view` (string): What to show (default summary); type: one MethodTable's bases, interfaces and slots.

Output parameters:

- `image` (string)
- `items` (array)
- `summary` (object)
- `view` (string)

### `ida_python` (~199 tokens)

Run IDAPython on a native image

Run IDAPython on the image database; returns the last expression's value, stdout and stderr. Off unless --ida-scripting (CORVUS_IDA_SCRIPTING=1); runs with server rights, not undoable. [Long-running.]

Input parameters:

- `allowError` (boolean): Return the exception as the result.
- `background` (boolean): Return at once; a notice reports the end.
- `code` (string): Python source (or scriptPath); base is the image base.
- `engine` (string): Default auto.
- `image` (string, required): Image id, name, path.
- `maxTokens` (integer): Page size in tokens.
- `persist` (boolean): Save the database afterwards.
- `reset` (boolean): Clear globals kept from earlier calls.
- `scriptPath` (string): A .py file to run instead of code.
- `timeoutSeconds` (integer): Seconds before it is cancelled; default 120.

Output parameters:

- `engine` (string)
- `error` (string)
- `image` (string)
- `result` (string)
- `saved` (boolean)
- `stderr` (string)
- `stdout` (string)

### `patch_asm` (~255 tokens)

Assemble and patch native code

Assemble x86/x64 instructions and write them at a native address in memory. Safety rules and undo as patch_bytes; PE absolute addresses get relocations. Warnings as patch_bytes. [Long-running.]

Input parameters:

- `address` (string, required): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `allowUnsafe` (boolean): Allow mid-instruction, past-function-end, header or loader-written bytes.
- `assembly` (string, required): Instructions, one per line; labels and db <hex> allowed.
- `dryRun` (boolean): true previews; false applies.
- `extend` (boolean): Put code larger than the site in a stub (placement) it jumps to and back. Refused when unsafe.
- `image` (string, required): Image id, name, path.
- `placement` (string): With extend: auto (default): cave, else section (a new PE section or ELF/Mach-O segment).
- `relocations` (string): PE relocations: auto (default) keeps valid, clears stale, adds new; neutralize clears all.
- `stubMode` (string): With extend: replace (default; the displaced instructions), before or after them.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)
- `items` (array)
- `pushedTo` (array)

### `symbolize_stack_text` (~216 tokens)

Symbolize crash text

Resolve crash text (logs, .NET exceptions, WER reports, Event Log entries, debugger stacks, Android tombstones) against the loaded builds. Each frame gets a name, a build check and the C# statement at an IL offset. [Long-running.]

Input parameters:

- `allFrames` (boolean): One row per frame; default folds 3+ matching native frames of an image.
- `format` (string): Text format (auto detects it).
- `images` (string): Image ids or paths, ;-separated; default all loaded.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `moduleBases` (string): Module load addresses (name=0xBASE;...) when the text has no module list.
- `offset` (integer): Rows to skip.
- `path` (string): A log or report file; its last 8 MiB are read.
- `text` (string): Crash text (up to 1 MiB); this or path.

Output parameters:

- `exception` (object)
- `format` (string)
- `frames` (integer)
- `items` (array)
- `modulesMissing` (array)
- `notes` (array)
- `unrecognizedLines` (integer)
- `unrecognizedSample` (array)

### `search_code_pattern` (~125 tokens)

Search a code pattern

Find a byte pattern with ?? wildcards (make_code_pattern's format except yara) in the executable sections of loaded native images, with each hit's function and offset. [Long-running.]

Input parameters:

- `allSections` (boolean): Search every section, not only executable ones.
- `images` (array): Image ids or paths; omit for every loaded native image.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `pattern` (string, required): Hex bytes with ?? wildcards.

Output parameters:

- `failed` (array)
- `items` (array)
- `notes` (array)
- `pattern` (string)

### `rename_symbol` (~120 tokens)

Rename symbol

Rename a type, method, field, property (and accessors) or event in memory; other assemblies keep the old name.

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `dryRun` (boolean): true previews; false applies.
- `kind` (string): Only resolve symbols of this kind.
- `newName` (string, required): New name (a type: simple name without namespace).
- `symbol` (string, required): Ns.Type, Ns.Outer+Inner, Ns.Type::Method(int), name or token.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)

### `list_native_types` (~214 tokens)

Browse the engine's types

Named types of the engine database with size and member count; name= shows one as a C declaration with member offsets. [Long-running.]

Input parameters:

- `descending` (boolean): Reverse the order.
- `engine` (string): Default auto.
- `filter` (string): substring (case-insensitive), * ? glob, or /regex/ (flags i, m, s).
- `image` (string, required): Image id, name, path.
- `kind` (string): udt: struct or union.
- `limit` (integer): Max rows (max 5000).
- `maxTokens` (integer): Page size in tokens.
- `members` (boolean): List the first 32 members of each (enums: name = value).
- `name` (string): Show this one type in full instead of a list.
- `offset` (integer): Rows to skip.
- `related` (boolean): Add the types each refers to.
- `sort` (string): Default name; ordinal: the engine's order.

Output parameters:

- `engine` (string)
- `items` (array)

### `read_dump_memory` (~156 tokens)

Read crash dump memory

Hex dump of a dump's memory at an address, with its module, captured range and protection. Bytes the dump lacks come from the module image (writable data: initial values) unless dumpOnly.

Input parameters:

- `address` (string, required): Hex address, module+0x1234 or module name (its base).
- `dump` (string, required): A .dmp path or open_minidump's id.
- `dumpOnly` (boolean): Only the bytes the dump holds, none from the image.
- `length` (integer): Bytes to read (up to 65536).
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Byte offset into the read (a page's nextOffset).

Output parameters:

- `address` (string)
- `code` (string)
- `dump` (string)
- `length` (integer)
- `location` (string)
- `nextAddress` (string)
- `nextOffset` (integer)
- `note` (string)
- `offset` (integer)
- `protection` (string)
- `region` (string)
- `requested` (integer)
- `source` (string)
- `totalChars` (integer)

### `trace_native_values` (~364 tokens)

Native value trace

Trace a value through native code across functions and images: backward to the constants, strings, pointers and API results that reach it, or forward to its uses. [Long-running.]

Input parameters:

- `address` (string, required): An instruction, call, function start (with argument) or writable global: Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `argument` (string): Argument of the call or parameter of the function at address: 1-based or API name.
- `direction` (string): backward (default): values reaching it; forward: its uses.
- `engine` (string): Slice engine (default auto: an engine that analyzed the image, else ours).
- `image` (string, required): Image id, name, path.
- `limit` (integer): Nodes per page (max 1000).
- `location` (string): Value at address: register (rdx, xmm1, x1), stack slot ([rsp+28h], [x29-8]), op1 / op2 (operand) or result (call return).
- `maxCallers` (integer): Call sites bound per parameter or return (1-256).
- `maxDepth` (integer): Function boundaries to cross (0-8).
- `maxFunctions` (integer): Functions to slice (1-256).
- `maxNodes` (integer): Nodes in the graph (1-5000).
- `maxTokens` (integer): Page size in tokens.
- `maxWriters` (integer): Writers (backward) or readers (forward) per global (1-256).
- `offset` (integer): Rows to skip.
- `stopAtGlobals` (boolean): Stop at writable globals instead of following writers / readers.

Output parameters:

- `direction` (string)
- `edges` (array)
- `engine` (string)
- `frontier` (array)
- `functions` (integer)
- `image` (string)
- `nodes` (array)
- `notes` (array)
- `offset` (integer)
- `pendingEdges` (array)
- `seed` (object)
- `totalEdges` (integer)
- `totalNodes` (integer)
- `truncated` (boolean)
- `values` (array)

### `extract_strings` (~180 tokens)

Extract typed strings

Typed values (URLs, IPs, paths, registry keys, crypto keys, base64) from literals, constants, resources and serialized asset fields, or native image strings (section, address), with count, locations and receiving APIs. read_result outputPath exports all (text: CSV).

Input parameters:

- `assembly` (string): A loaded assembly; this or path.
- `limit` (integer): Max rows.
- `maxAssetBytes` (integer): Asset bytes to read; at most 4 GiB (default).
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `path` (string): An assembly, container, build folder, package, or serialized asset file or bundle.
- `timeLimit` (number): Seconds until the asset read stops.
- `types` (array): Only these types.

Output parameters:

- `assembly` (string)
- `byType` (object)
- `items` (array)
- `valuesResultId` (string)

### `set_native_type` (~200 tokens)

Set a native prototype or global type

Set a native function prototype or a global's C type in the engine; named types must exist there. __noreturn ends caller flow at the call. Kept in annotations. [Long-running.]

Input parameters:

- `address` (string): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `engine` (string): Default auto.
- `guess` (boolean): Report the engine guess at address, not applied.
- `image` (string, required): Image id, name, path.
- `items` (string): Instead of address and type: lines address = type.
- `rename` (boolean): Name the function as its prototype does.
- `showDecompile` (string): after: pseudocode after the edit; diff: its unified diff.
- `type` (string): C prototype (int __fastcall Parse(Packet *p, int len)) or global type (Handler *[8]); empty clears.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)

### `disassemble` (~200 tokens)

Disassemble native code

MASM disassembly of the function at an address, with references named and call arguments recovered; outside a function, maxInstructions from the address. Names the method behind slot-indexed virtual calls on x64 and AArch64 images. [Long-running.]

Input parameters:

- `address` (string, required): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `collapse` (string): runtime: fold lazy-init, write-barrier and static-base code to one comment line. Default none.
- `engine` (string): auto (default): IDA or Ghidra if analyzed, else ours.
- `fromAddress` (boolean): maxInstructions from the address, not the containing function.
- `image` (string, required): Image id, name, path.
- `maxInstructions` (integer): Max instructions.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Character offset (nextOffset).

Output parameters:

- `address` (string)
- `code` (string)
- `engine` (string)
- `function` (string)
- `image` (string)
- `nextOffset` (integer)
- `offset` (integer)
- `totalChars` (integer)

### `get_call_tree` (~178 tokens)

Call tree (callers / callees)

Callers or callees of a method across loaded assemblies, several levels deep, one row per node. Continues through P/Invokes into native code; takes a native export.

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `depth` (integer): Levels (1-8).
- `direction` (string): callers or callees.
- `includeExternal` (boolean): Callees: also calls into unloaded assemblies (framework).
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `method` (string, required): Type or member (Ns.Type::Method(int), name, token) or native export (kernel32.dll!CreateFileW, native:IMAGE!NAME|#ORD|ADDR).
- `offset` (integer): Rows to skip.

Output parameters:

- `depth` (integer)
- `direction` (string)
- `items` (array)
- `partial` (string)
- `root` (string)

### `export_native_patches` (~102 tokens)

Export native patches

Write the image's byte patches as an IDAPython script, an IDA .dif, IPS or a JSON set for migrate_native_patches. Relocation edits and the PE checksum are included.

Input parameters:

- `format` (string): Default json; ips takes offsets below 16 MB.
- `image` (string, required): Image id, name, path.
- `outputPath` (string, required): Output file path.
- `overwrite` (boolean): Overwrite outputPath.

Output parameters:

- `bytes` (integer)
- `changedBytes` (integer)
- `checksumUpdated` (boolean)
- `format` (string)
- `image` (string)
- `notes` (array)
- `originalSha256` (string)
- `outputPath` (string)
- `patches` (integer)
- `records` (integer)
- `relocationEdits` (integer)

### `apply_metadata_names` (~106 tokens)

Name native code from its metadata

Name the functions and data of an AOT binary as Ns_Type__Method from its dummy assemblies, script.json and stringliteral.json. User and PDB names win; names are saved per file hash and reapplied on load. [Long-running.]

Input parameters:

- `assembly` (string): Dummy assemblies to use; omit for every loaded one with metadata.
- `clear` (boolean): Remove the metadata names and saved copy instead.
- `image` (string, required): Image id, name, path.

Output parameters:

- `applied` (boolean)
- `assemblies` (string)
- `functions` (integer)
- `image` (string)
- `labels` (integer)
- `metadataSlots` (integer)
- `methodInfoSlots` (integer)
- `misses` (integer)
- `removed` (integer)
- `saved` (boolean)
- `sharedFunctions` (integer)
- `strings` (integer)
- `suffixed` (integer)
- `userNamesKept` (integer)

### `comment_native` (~242 tokens)

Comment a native address

Comment a native address; undoable and pushed to the engines. append adds a line; empty clears. items: many in one push. [Long-running.]

Input parameters:

- `address` (string): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `append` (boolean): Add text as a new line of the comment; a line it has is skipped.
- `dryRun` (boolean): true previews; false applies.
- `engine` (string): Engine to push to now (default: the one with this image open, else next use).
- `image` (string, required): Image id, name, path.
- `items` (string): Lines address = text, or JSON [{address, text, scope?, append?}].
- `repeatLine` (boolean): With append: add the line even if the comment has it.
- `scope` (string): line: repeatable, shown where referenced; auto (default): function at its start, else line and pseudocode.
- `stopOnError` (boolean): Stop at the first failing item.
- `text` (string): Comment text; empty clears.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)
- `items` (array)
- `pushedTo` (array)

### `get_android_package_info` (~63 tokens)

Installed package info

One installed package (dumpsys package): versions, SDKs, paths, flags, installer, uid, permissions with grant state.

Input parameters:

- `package` (string, required): Package (com.example.app).
- `serial` (string): Device serial; omit if one device.

Output parameters:

- `codePath` (string)
- `dataDir` (string)
- `firstInstallTime` (string)
- `flags` (array)
- `installer` (string)
- `lastUpdateTime` (string)
- `minSdk` (integer)
- `package` (string)
- `permissions` (array)
- `primaryCpuAbi` (string)
- `serial` (string)
- `targetSdk` (integer)
- `uid` (integer)
- `users` (array)
- `versionCode` (string)
- `versionName` (string)

### `list_dex_classes` (~147 tokens)

List DEX classes

Classes defined in the DEX code of an Android package: descriptor, DEX file, access, superclass, member counts. Unfiltered: the largest packages.

Input parameters:

- `limit` (integer): Most classes.
- `mapping` (string): R8/ProGuard mapping.txt: shows and accepts original names; kept per package.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `package` (string): Only this package and its subpackages.
- `path` (string, required): An Android package, .dex or jar with classes*.dex.
- `query` (string): Only classes whose name contains or matches (* ?) this.

Output parameters:

- `items` (array)
- `notes` (array)
- `packages` (array)

### `compare_native_images` (~266 tokens)

Compare native builds

Match functions of two native builds (x86, x64, ARM64): pairs, changed, unmatched, ambiguous, capabilities. [Long-running.]

Input parameters:

- `codeOnly` (boolean): Match by code, not names.
- `engine` (string): ida or ghidra: compare oldImage's file with that engine's memory.
- `limit` (integer): Max rows.
- `maxComparisons` (integer): Fuzzy comparison cap, 1-1e9.
- `maxTokens` (integer): Page size in tokens.
- `minScore` (number): Least fuzzy score (0-1).
- `newImage` (string): New build: image id or path.
- `newResult` (string): The new side, from the same tool.
- `offset` (integer): Rows to skip.
- `oldImage` (string): Old build: image id or path.
- `oldResult` (string): Instead: a kept result (r-...), last:N (recent call) or bundle entry (file.json#r-...).
- `tier` (integer): Only tier 1 (name, bytes) .. 5 (fuzzy); 0 all.
- `view` (string): changed: code differs; ambiguous: candidates; wasm: interface.

Output parameters:

- `ambiguous` (integer)
- `changed` (integer)
- `changes` (array)
- `evidence` (object)
- `identical` (integer)
- `items` (array)
- `matched` (integer)
- `newFunctions` (integer)
- `newImage` (string)
- `newVersion` (string)
- `notes` (array)
- `oldFunctions` (integer)
- `oldImage` (string)
- `oldVersion` (string)
- `tiers` (array)
- `unmatchedNew` (integer)
- `unmatchedOld` (integer)
- `view` (string)

### `get_cfg` (~130 tokens)

Native control-flow graph

Basic blocks of the native function at an address, paged: range, successors, switch tables and unresolved indirect jumps. [Long-running.]

Input parameters:

- `address` (string, required): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `engine` (string): auto (default): IDA or Ghidra if analyzed, else ours.
- `image` (string, required): Image id, name, path.
- `limit` (integer): Blocks per page.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.

Output parameters:

- `address` (string)
- `cut` (boolean)
- `engine` (string)
- `function` (string)
- `image` (string)
- `items` (array)
- `pendingEdges` (array)
- `summary` (object)
- `switches` (array)
- `tailCalls` (array)
- `unresolvedJumps` (array)

### `compare_folders` (~216 tokens)

Compare two folders or packages

Compare two folders, zip-family archives or files: modified, added, removed and moved entries, binary versions, text diffs and package findings. oldResult / newResult compare two kept results instead. [Long-running.]

Input parameters:

- `caseSensitive` (boolean): Default: false on Windows and macOS.
- `change` (string): Entries listed.
- `exclude` (array): Path globs to skip.
- `limit` (integer): Entries per page.
- `maxEntries` (integer): Per side; past it, incomplete.
- `newPath` (string): New folder, archive or file.
- `newResult` (string): The new side, from the same tool.
- `noDiffs` (boolean): Leave out text diffs.
- `offset` (integer): Rows to skip.
- `oldPath` (string): Old folder, archive or file.
- `oldResult` (string): Instead: a kept result (r-...), last:N (recent call) or bundle entry (file.json#r-...).

Output parameters:

- `caseSensitive` (boolean)
- `changes` (array)
- `counts` (object)
- `entries` (array)
- `evidence` (object)
- `hashBasis` (string)
- `new` (object)
- `notes` (array)
- `old` (object)
- `view` (string)

### `search_container` (~196 tokens)

Search inside a container

Find managed types and members by name in a container or assembly, without extracting. Other kinds: paths, pcap packets, endpoints, capture requests, JS features, YARA rules, locked packages, incident lists.

Input parameters:

- `capture` (string): kind=endpoint: a HAR, mitmproxy, .saz or pcap capture to join, or compare if path is one.
- `kind` (string): Kind to restrict to; omit: all members.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `path` (string, required): Container or assembly file (absolute).
- `query` (string, required): Name, substring or * ? wildcards; packet: display filter; feature: JS text; yara: rule file, folder or text.
- `values` (boolean): kind=request: show header, cookie and query values.

Output parameters:

- `container` (string)
- `items` (array)
- `notes` (array)
- `searched` (integer)
- `source` (string)

### `get_call_arguments` (~168 tokens)

Native call arguments

Call sites with recovered argument values: constants, strings, addresses, earlier call results. Known Win32, CRT and libc APIs name parameters and decode flags. Pass address, callee or both. [Long-running.]

Input parameters:

- `address` (string): A call, or an address in a function (all its calls): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `callee` (string): Only calls to this API, module!name or function; without address, image-wide.
- `image` (string, required): Image id, name, path.
- `limit` (integer): Max call sites (max 1000).
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.

Output parameters:

- `image` (string)
- `items` (array)
- `notes` (array)
- `scope` (string)

### `find_counterpart` (~197 tokens)

Find symbol in another build

Find where a type or member of the old build went in the new one: new name, token, confidence and body change, or the tied candidates. diff and il add C# and normalized IL diffs. [Long-running.]

Input parameters:

- `diff` (boolean): C# diff of each pair (cut at 300 lines).
- `il` (boolean): Normalized IL diff of each method pair.
- `limit` (integer): Symbols per page.
- `maxTokens` (integer): Page size in tokens.
- `newAssembly` (string, required): New build: id, name or path.
- `offset` (integer): Rows to skip.
- `oldAssembly` (string, required): Old build: id, name or path.
- `symbol` (string, required): Old build: Ns.Type, Ns.Outer+Inner, Ns.Type::Method(int), name or token.
- `symbols` (array): Instead of symbol: up to 100.

Output parameters:

- `items` (array)
- `new` (string)
- `old` (string)

### `list_jni_bindings` (~163 tokens)

List JNI bindings

Java native methods of an Android package paired with their code in lib/<abi>/*.so, by Java_ exports and RegisterNatives tables; also unbound methods and stray exports. [Long-running.]

Input parameters:

- `abi` (string): ABI to read, or all; default arm64-v8a, else the first.
- `class` (string): Only rows naming this class (pkg.C or pkg/C).
- `kind` (string): Only this kind.
- `limit` (integer): Most rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `path` (string, required): An .apk, .aab or split set (.apks, .xapk, .apkm).

Output parameters:

- `items` (array)
- `libraries` (array)
- `notes` (array)

### `patch_method_csharp` (~113 tokens)

Replace method body with C#

Replace a method, constructor or accessor body with C# compiled against the assembly; private members are accessible. Errors name your lines. [Long-running.]

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `code` (string, required): Statements of the new body only.
- `dryRun` (boolean): true previews the IL to be written; false applies.
- `method` (string, required): Ns.Type, Ns.Outer+Inner, Ns.Type::Method(int), name or token.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)

### `list_functions` (~253 tokens)

List native functions

Functions of a native image: address, size, name, flags, how found and caller count. An exact name filter adds the engine's function record. [Long-running.]

Input parameters:

- `descending` (boolean): Reverse the default direction of sort.
- `engine` (string): auto (default): IDA or Ghidra if analyzed, else ours.
- `filter` (string): Name filter: substring (case-insensitive), * ? glob, or /regex/ (flags i, m, s).
- `from` (string): Lowest start address.
- `hasType` (boolean): Engines: true keeps functions with a prototype, false those without.
- `image` (string, required): Image id, name, path.
- `limit` (integer): Max rows.
- `maxSize` (integer): Largest size in bytes.
- `maxTokens` (integer): Page size in tokens.
- `minSize` (integer): Smallest size in bytes.
- `offset` (integer): Rows to skip.
- `sort` (string): Default address; size and callers: largest first.
- `to` (string): Start addresses below this one.
- `view` (string): candidates: engine code in no function, by references.

Output parameters:

- `engine` (string)
- `engineNote` (string)
- `functions` (integer)
- `image` (string)
- `items` (array)

### `get_native_type` (~337 tokens)

Native type layout

Layout of a native type (fields, bases, enum values) from PDB, RTTI, metadata, ObjC, Swift or an engine. Look up by name, id or typed address; read=true adds the values at address. [Long-running.]

Input parameters:

- `address` (string): A typed address: Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `at` (string): Hex field offset to name (all union members); 0x48.0x10 goes through the pointer at 0x48.
- `depth` (integer): Levels of by-value members inlined (0-4).
- `engine` (string): auto (default): IDA or Ghidra if analyzed, else ours.
- `format` (string): c: a C declaration (default table).
- `id` (string): Type id from a result (pdb:0x1A2B, rtti:0x140012000, metadata:Ns.Type).
- `image` (string, required): Image id, name, path.
- `limit` (integer): Max rows (max 5000).
- `maxTokens` (integer): Page size in tokens.
- `name` (string): Type name (ns::Widget, Ns.Type), case-insensitive; a glob (*Widget*) lists matches.
- `offset` (integer): First row (field, enumerator, slot, candidate).
- `read` (boolean): Add the field values at address (with name or id: that type read there).
- `source` (string): Type source (default auto).

Output parameters:

- `candidates` (array)
- `image` (string)
- `offset` (integer)
- `owner` (string)
- `ownerAddress` (string)
- `paths` (array)
- `query` (string)
- `readAddress` (string)
- `totalCandidates` (integer)
- `truncated` (boolean)
- `type` (object)
- `value` (string)

### `patch_method_il` (~129 tokens)

Rewrite method body in IL

Rewrite a method body from IL text, stack-validated: edit the get_il lines and pass them back (syntax: guide edits).

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `dryRun` (boolean): true previews; false applies.
- `il` (string, required): IL instructions, one per line.
- `method` (string, required): Ns.Type, Ns.Outer+Inner, Ns.Type::Method(int), name or token.
- `mode` (string): replace swaps the body; prepend runs before it and can branch to its IL_xxxx labels.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)

### `survey_features` (~162 tokens)

Survey features

Capabilities by rules over calls, imports and strings; category= adds evidence. Apps add MASVS findings; category=capa adds labels (CORVUS_CAPA): waitSeconds waits, cancel stops it.

Input parameters:

- `assembly` (string): A loaded assembly; this or path.
- `cancel` (boolean): Stop the capa run.
- `category` (string): Category or MASVS prefix; all: everything.
- `image` (string): A native image or path (instead of assembly).
- `locations` (integer): Locations per entry, 1-100; default 5.
- `path` (string): A .NET, native or app file, not loaded.
- `waitSeconds` (integer): Seconds to wait for capa, 0-600.

Output parameters:

- `assembly` (string)
- `category` (string)
- `features` (array)
- `methodsScanned` (integer)

### `get_pe_info` (~108 tokens)

Native image overview

Overview of a native image: headers, sections, mitigations, imports and exports, PDB, version, signature and anomalies; the ELF and Mach-O equivalents. view=code adds code index statistics.

Input parameters:

- `image` (string, required): Image id, name, path.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Character offset (nextOffset).
- `view` (string): code: code index statistics and late-bound imports; waits for the index.

Output parameters:

- `capabilities` (array)
- `checksumMatches` (boolean)
- `code` (object)
- `delayImportModules` (integer)
- `dotNet` (boolean)
- `entryPoint` (string)
- `exports` (integer)
- `fileSize` (integer)
- `format` (string)
- `image` (string)
- `imageBase` (string)
- `importFunctions` (integer)
- `importModules` (integer)
- `issueList` (array)
- `issues` (integer)
- `kind` (string)
- `machine` (string)
- `mitigationsOff` (array)
- `mitigationsOn` (array)
- `overlaySize` (integer)
- `path` (string)
- `pdbAge` (integer)
- `pdbGuid` (string)
- `pdbPath` (string)
- `sectionNotes` (array)
- `sections` (array)
- `sha256` (string)
- `signer` (string)
- `subsystem` (string)
- `timestamp` (string)
- `tlsCallbacks` (integer)

### `get_android_device_info` (~150 tokens)

Android device info

Device properties (getprop) with a summary: SDK, model, ABIs, patch level, debug flags. view= reads processes, files, screenshots, bug reports. Read-only. [Long-running.]

Input parameters:

- `limit` (integer): Most rows.
- `offset` (integer): Rows to skip.
- `outputPath` (string): view=screen: new PNG path; bugreport: new or empty directory; default under temp.
- `query` (string): Name or value filter; view=files: directory (default /data/local/tmp); window: local APK.
- `serial` (string): Device serial; omit if one device.
- `view` (string): What to read.

Output parameters:

- `properties` (array)
- `serial` (string)
- `summary` (object)

### `list_imports` (~167 tokens)

List native imports

Imports of a native image per library, with the IAT slot code calls through; delay-loaded imports are marked. bind=true names the export each import binds to. [Long-running.]

Input parameters:

- `bind` (boolean): Bind each import to its export, or say why not (load_assembly loadProviders=true loads targets).
- `filter` (string): Name substring, any case.
- `image` (string, required): Image id, name, path.
- `includeDynamic` (boolean): Also GetProcAddress imports, marked [dynamic] (waits for the code index).
- `library` (string): Only this library (.dll optional).
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.

Output parameters:

- `bindings` (string)
- `image` (string)
- `items` (array)

### `disassemble_dex` (~169 tokens)

Disassemble DEX

Smali of a DEX method or class; format=annotated adds code offsets, simplified the string each decoder call returns. A jar or .class: the javap -c -p listing.

Input parameters:

- `format` (string): Output layout; default smali.
- `mapping` (string): R8/ProGuard mapping.txt: shows and accepts original names; kept per package.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Character offset (nextOffset).
- `path` (string, required): An Android package, .dex, jar or .class.
- `symbol` (string, required): Method (Lpkg/C;->m(I)V, pkg.C::m, pkg.C::m(int)) or class (pkg.C, Lpkg/C;).

Output parameters:

- `code` (string)
- `nextOffset` (integer)
- `offset` (integer)
- `totalChars` (integer)

### `pull_android_file` (~89 tokens)

Pull device file

Copy one device file (not a directory) to outputPath with its size and SHA-256; a failed pull leaves nothing. [Long-running.]

Input parameters:

- `outputPath` (string, required): The local file to write.
- `overwrite` (boolean): Overwrite outputPath.
- `remotePath` (string, required): Path on the device.
- `serial` (string): Device serial; omit if one device.

Output parameters:

- `local` (string)
- `remote` (string)
- `sha256` (string)
- `size` (integer)

### `list_assemblies` (~128 tokens)

List loaded assemblies

Loaded assemblies and native images: ids, versions, flags, unsaved edits, index state. With path: the assemblies or files inside a container, without extracting.

Input parameters:

- `filter` (string): Id, name or path substring (case-insensitive).
- `limit` (integer): Rows per page.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `path` (string): Container file, Blazor or ClickOnce folder to list.
- `waitSeconds` (integer): Seconds (0-600) to wait for indexes.

Output parameters:

- `backgroundIndexing` (string)
- `container` (object)
- `items` (array)
- `searchDirectories` (array)

### `find_similar_functions` (~201 tokens)

Find similar functions

Find functions like a given one, ranked by code shape, control flow and shared strings, constants, imports, callees. view=duplicates or clusters groups look-alike functions image-wide. [Long-running.]

Input parameters:

- `address` (string): view=similar: an address in the function.
- `image` (string, required): Image id, name, path.
- `limit` (integer): Items to return (max 500).
- `maxTokens` (integer): Page size in tokens.
- `minInstructions` (integer): Smallest function compared, in instructions (1-1000).
- `minScore` (number): Least score 0-1 (default 0.5; clusters 0.8).
- `offset` (integer): Rows to skip.
- `scope` (string): all: every loaded image of the same architecture (view=similar; default image).
- `view` (string): Default: similar with address, else clusters.

Output parameters:

- `address` (string)
- `compared` (integer)
- `function` (string)
- `image` (string)
- `items` (array)
- `notes` (array)
- `view` (string)

### `read_android_log` (~147 tokens)

Read device log

Device log (logcat -d), newest lines first, by buffer, process, tag, priority and start time.

Input parameters:

- `buffer` (string): Log buffer (default: main, system, crash).
- `limit` (integer): Most lines.
- `offset` (integer): Lines to skip from the newest.
- `pid` (integer): Only this process id.
- `priority` (string): Lowest priority.
- `serial` (string): Device serial; omit if one device.
- `since` (string): Only lines since this time ("01-31 12:00:00.000") or the last N lines.
- `tag` (string): Only this log tag.

Output parameters:

- `items` (array)
- `serial` (string)

### `revert_edits` (~51 tokens)

Discard all edits

Discard every unsaved edit of an assembly; resultId keeps them as a script (read_result outputPath=, then apply_edits).

Input parameters:

- `assembly` (string, required): Assembly id, name, path.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)

### `declare_native_types` (~241 tokens)

Declare C types in the engine

Declare C types in the engine, replacing same-named ones; an engine error saves nothing. typeName edits one enum, struct or union; delete and rename take any named type. Kept in annotations. [Long-running.]

Input parameters:

- `declarations` (string): C declarations; named types must exist or be declared too.
- `delete` (string): A type to delete.
- `engine` (string): Default auto.
- `fields` (string): Struct or union: name: type; name@0x10: type; @0x10: type (or lines); name: removes; +name@0x10: type inserts.
- `image` (string, required): Image id, name, path.
- `members` (string): Enum: NAME=value, ... (hex or decimal; or lines); NAME= removes.
- `nameGaps` (boolean): Struct: name unnamed gaps gap_OFFSET.
- `rename` (string): Old=New; kept edits naming it follow.
- `resize` (string): Struct: new size (hex or decimal); goes alone.
- `typeName` (string): Enum, struct or union to edit.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)

### `get_type_info` (~149 tokens)

Type outline

Outline of a type without decompiling: declaration, attributes, member counts, the first members of each kind; section= pages one kind. A field shows its value or FieldRVA data.

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `includeCompilerGenerated` (boolean): Include compiler-generated members.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `section` (string): A kind to page, or all.
- `type` (string, required): Ns.Type, Ns.Outer+Inner, Ns.Type::Method(int), name or token.

Output parameters:

- `attributes` (array)
- `compilerGeneratedHidden` (boolean)
- `counts` (object)
- `declaration` (string)
- `declaringType` (string)
- `initialData` (object)
- `items` (array)
- `section` (string)
- `type` (object)

### `add_members_csharp` (~102 tokens)

Add members to a type (C#)

Add C# members to a class or struct; private members are accessible. No field or property initializers. [Long-running.]

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `code` (string, required): C# member declarations.
- `dryRun` (boolean): true previews; false applies.
- `type` (string, required): Ns.Type, Ns.Outer+Inner, Ns.Type::Method(int), name or token.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)

### `reload_assembly` (~44 tokens)

Reload assembly

Re-read an assembly from disk (after an update or an overwriting save), discarding unsaved edits.

Input parameters:

- `assembly` (string, required): Assembly id, name, path.

Output parameters:

- `discardedEdits` (integer)
- `entries` (array)
- `ids` (array)
- `skipped` (integer)

### `undo_native_edit` (~85 tokens)

Undo a native edit

Undo native edits by editId, the last by default, and push the previous values to the engines. Refused while a later edit changed the same item. [Long-running.]

Input parameters:

- `editId` (string): image#n or #n; comma-separated for several, undone in order; default the last.
- `image` (string, required): Image id, name, path.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)
- `items` (array)
- `pushedTo` (array)

### `list_resources` (~88 tokens)

List manifest resources

Manifest resources (embedded, .resources, linked) with SHA-256 and file offsets; a native image lists its Win32 resources as TYPE/NAME/LANGUAGE with file ranges.

Input parameters:

- `assembly` (string, required): Assembly id, name, path.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.

Output parameters:

- `assembly` (string)
- `items` (array)

### `install_android_package` (~122 tokens)

Install package on device

Install an APK, split set or folder of APKs on a device; failures report their INSTALL_FAILED_ code. Changes the device: needs --allow-device-changes. [Long-running.]

Input parameters:

- `downgrade` (boolean): Allow a lower version code.
- `grantPermissions` (boolean): Grant all requested runtime permissions.
- `keepInstalled` (boolean): Fail if the app is installed instead of replacing it.
- `path` (string, required): An .apk, split set or folder of APKs.
- `serial` (string): Device serial; omit if one device.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)
- `items` (array)
- `pushedTo` (array)

### `summarize_build` (~102 tokens)

Build summary

Summarize an application build without loading it: engine version, scripting backend (aot or mono), metadata version, platform, architecture and next calls.

Input parameters:

- `detectItEasy` (boolean): Also run Detect It Easy (CORVUS_DIE or PATH) on the main binaries; about 1 s each.
- `path` (string, required): Folder, executable, *_Data, global-metadata.dat or package (.apk, .ipa, .app, zip).

Output parameters:

- `appDirectory` (string)
- `architecture` (string)
- `architectureSource` (string)
- `backend` (object)
- `company` (string)
- `dataDirectory` (string)
- `engine` (object)
- `executable` (string)
- `folders` (array)
- `input` (string)
- `markers` (array)
- `nextSteps` (array)
- `notes` (array)
- `platform` (string)
- `product` (string)

### `decompile_native` (~319 tokens)

Decompile native function

C pseudocode of a native function from IDA or Ghidra, with the names, comments and types made here; address= on x64 adds the method behind slot-indexed virtual calls. The first call analyzes the image; functions= decompiles several per request. [Long-running.]

Input parameters:

- `address` (string): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `addresses` (boolean): Prefix lines with their source address.
- `callersOf` (string): Instead of address: decompile this function's callers (engine references).
- `engine` (string): Default auto; all: each installed engine in turn.
- `functions` (array): Instead of address: several addresses or names.
- `image` (string, required): Image id, name, path.
- `maxFunctions` (integer): With functions: most decompiled (1-200); the rest follow.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Character offset; with functions/callersOf the first input (nextInput).
- `perFunctionSeconds` (integer): With functions: seconds per function (1-600).
- `refs` (boolean): With address: a footer of the globals, functions, strings and imports used.
- `timeoutSeconds` (integer): Seconds per engine request (1-600); Ghidra retries once with 4x.
- `view` (string): c, or pcode (Ghidra high p-code per block).

Output parameters:

- `code` (string)
- `engine` (string)
- `engineNote` (string)
- `failed` (integer)
- `image` (string)
- `inputs` (integer)
- `items` (array)
- `nextInput` (integer)
- `nextOffset` (integer)
- `offset` (integer)
- `skipped` (integer)
- `succeeded` (integer)
- `totalChars` (integer)

### `stub_method` (~125 tokens)

Stub method (return constant)

Replace a method body with "return <value>;" ("return;" for void) in memory: force a check true, disable a call.

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `dryRun` (boolean): true previews; false applies.
- `method` (string, required): Ns.Type, Ns.Outer+Inner, Ns.Type::Method(int), name or token.
- `value` (string): true/false, integer (decimal or 0x), float, "string" or null; omit for void or default(T).

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)

### `open_minidump` (~370 tokens)

Open a crash dump

Open a Windows minidump, ELF or Mach-O core, or region-set manifest; returns its id. view=summary: OS, process, exception, .NET state; other views page rows. [Long-running.]

Input parameters:

- `base` (string): outputPath: loaded or preferred.
- `compareWith` (string): view=changes: dump to compare with.
- `dacPath` (string): DAC file or folder for a build not installed.
- `downloadDac` (boolean): Fetch a matching DAC (symbol server; refused under CORVUS_OFFLINE=1).
- `group` (string): view=changes: shape groups rows by module, section, kind and shape; default none.
- `imageDirectories` (string): Program binary folders (';'-separated), kept for the dump, plus its own.
- `imports` (string): outputPath: restore or keep.
- `layout` (string): outputPath: file or mapped.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `modules` (string): File name, 0x address, all or unlisted; outputPath also code.
- `offset` (integer): Rows to skip.
- `outputPath` (string): view=modules: new or empty image folder.
- `path` (string, required): The .dmp path or open dump id.
- `regionFilter` (string): view=memory: all (default) or unbacked.
- `symbols` (string): outputPath: none, local or download PDBs.
- `view` (string): summary, modules, threads, memory, unloaded or changes.
- `yara` (string): unbacked: YARA rules (text, file, folder, pack:name).

Output parameters:

- `counts` (object)
- `dumpType` (array)
- `exception` (object)
- `faultingModule` (object)
- `faultingThread` (object)
- `fileSize` (integer)
- `handleTypes` (array)
- `id` (string)
- `issues` (array)
- `items` (array)
- `managed` (object)
- `path` (string)
- `process` (object)
- `system` (object)
- `timeUtc` (string)
- `view` (string)

### `list_globals` (~144 tokens)

List native globals

Named data of a native image outside code, from every name source, with type and size if known. An engine adds its defined data with values; get_native_type read=true reads fields. [Long-running.]

Input parameters:

- `engine` (string): auto (default): IDA or Ghidra if analyzed, else ours.
- `filter` (string): Name substring, any case.
- `image` (string, required): Image id, name, path.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `section` (string): Only this section, e.g. .data.

Output parameters:

- `engine` (string)
- `image` (string)
- `items` (array)

### `find_callees` (~154 tokens)

What a method uses (xrefs from)

What a method uses, in IL order with offsets: calls, field reads and writes, types, strings. A P/Invoke or native export gives native callees as call-tree rows.

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `distinct` (boolean): One row per target, with a count.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `method` (string, required): Type or member (Ns.Type::Method(int), name, token) or native export (kernel32.dll!CreateFileW, native:IMAGE!NAME|#ORD|ADDR).
- `offset` (integer): Rows to skip.

Output parameters:

- `items` (array)
- `method` (string)

### `native_call_tree` (~198 tokens)

Native call tree

Callers or callees of a native function across loaded images, thunks and import slots; module!import gives its callers. Callees include GetProcAddress and virtual call targets. [Long-running.]

Input parameters:

- `calls` (string): Call edges (default all).
- `depth` (integer): Levels (1-8).
- `direction` (string): both: depth 1, by call site.
- `engine` (string): auto (default): IDA or Ghidra if analyzed, else ours.
- `function` (string, required): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `image` (string, required): Image id, name, path.
- `limit` (integer): Max nodes per page.
- `maxNodes` (integer): Max nodes in the tree.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.

Output parameters:

- `direction` (string)
- `engine` (string)
- `engineNote` (string)
- `frontier` (array)
- `image` (string)
- `items` (array)
- `partial` (string)
- `pendingParents` (array)
- `root` (string)

### `list_namespaces` (~87 tokens)

List namespaces

List namespaces with their type counts (nested types under the namespace of their outer type).

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `filter` (string): Substring (case-insensitive).
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.

Output parameters:

- `items` (array)

### `get_resource` (~140 tokens)

Read / extract resource

Read a resource: text, a hex preview, or a .resources entry list (entry reads one; .baml as XAML); outputPath extracts the raw bytes. Native images take TYPE/NAME[/LANGUAGE].

Input parameters:

- `assembly` (string, required): Assembly id, name, path.
- `entry` (string): Entry inside a .resources container.
- `maxTokens` (integer): Page size in tokens.
- `name` (string, required): Name from list_resources.
- `offset` (integer): Character offset (nextOffset).
- `outputPath` (string): Write the raw bytes to this file.
- `overwrite` (boolean): Overwrite outputPath.

Output parameters:

- `code` (string)
- `kind` (string)
- `name` (string)
- `nextOffset` (integer)
- `offset` (integer)
- `savedTo` (string)
- `size` (integer)
- `totalChars` (integer)

### `migrate_native_patches` (~192 tokens)

Migrate patches to a new build

Carry byte patches from an old build to a new one through the function match. A patch applies only where the mapped address holds its original bytes, else is refused; the same image twice with patchSet replays the set. [Long-running.]

Input parameters:

- `codeOnly` (boolean): Match by code, not names.
- `dryRun` (boolean): true previews; false applies.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `newImage` (string, required): New build: image id or path (the second load gets an id like name#2).
- `offset` (integer): Rows to skip.
- `oldImage` (string, required): Old build: image id or path (its in-memory patches are the source unless patchSet).
- `patchSet` (string): A JSON patch set (export_native_patches format=json): path or text.

Output parameters:

- `applied` (boolean)
- `carried` (integer)
- `dryRun` (boolean)
- `editIds` (array)
- `items` (array)
- `newImage` (string)
- `notes` (array)
- `oldImage` (string)
- `patches` (integer)
- `refused` (integer)
- `refusedBy` (array)
- `source` (string)

### `live_script` (~94 tokens)

User script in a session

Load, list or unload a Frida script in a session; its messages are events (live_events from=SCRIPT). Needs --live-scripting.

Input parameters:

- `action` (string): Action.
- `path` (string): load: a .js file instead.
- `script` (string): unload: script id.
- `session` (string, required): Id from live_session.
- `source` (string): load: JavaScript source.

Output parameters:

- `scripts` (array)
- `session` (string)

### `verify_native_imports` (~133 tokens)

Verify native imports

Check P/Invoke declarations, PE imports or Mach-O load commands against library exports as the loader resolves them. Verdicts: verified, contradicted, unresolved, dynamic_only, not_checked. [Long-running.]

Input parameters:

- `assembly` (string, required): Assembly id, name, path.
- `limit` (integer): Max rows (max 5000).
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `platform` (string): Target platform (default auto).
- `status` (string): Only this verdict or reason (contradicted, missing_export...).

Output parameters:

- `assembly` (string)
- `counts` (array)
- `declarations` (integer)
- `dynamicLoads` (array)
- `dynamicLoadsTotal` (integer)
- `filter` (string)
- `items` (array)
- `metadataIssues` (array)
- `notes` (array)

### `search_bytes` (~210 tokens)

Search native bytes

Find a hex or text pattern in the mapped sections of a native image: VA, section and file offset per hit. memory=engine searches the engine's loaded bytes.

Input parameters:

- `image` (string, required): Image id, name, path.
- `limit` (integer): Max hits.
- `mask` (string): Bit mask per pattern byte (FF F0 FF).
- `maxTokens` (integer): Page size in tokens.
- `memory` (string): file, or engine / ida / ghidra: its loaded bytes.
- `offset` (integer): Rows to skip.
- `pattern` (string): Hex (48 8B 05 ?? ?? ?? ??): ?? any byte, 4? a nibble, 40&F8 masked bits.
- `patterns` (array): Instead of pattern: up to 50.
- `section` (string): Only this section, e.g. .text.
- `text` (boolean): pattern is text (ASCII and UTF-16LE).

Output parameters:

- `failed` (integer)
- `image` (string)
- `items` (array)
- `memory` (string)
- `patterns` (array)

### `get_r2r_code` (~165 tokens)

ReadyToRun native code of a method

Precompiled native code of a method in a ReadyToRun assembly: entry, code ranges, fixup cells and x86 / x64 disassembly, per compiled generic instantiation.

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `instantiation` (string): Only bodies whose name contains this text (Int32, __Canon).
- `maxBodies` (integer): Max bodies disassembled; the rest listed with addresses.
- `maxInstructions` (integer): Max instructions per body.
- `maxTokens` (integer): Page size in tokens.
- `method` (string, required): Ns.Type, Ns.Outer+Inner, Ns.Type::Method(int), name or token.
- `offset` (integer): Character offset (nextOffset).

Output parameters:

- `bodies` (array)
- `code` (string)
- `language` (string)
- `methods` (array)
- `nextOffset` (integer)
- `offset` (integer)
- `symbols` (array)
- `totalChars` (integer)

### `search_dex` (~150 tokens)

Search DEX code

Search DEX code for strings (literals and decoder results), types, methods, fields, numeric constants or opcodes, with method and offset per use. [Long-running.]

Input parameters:

- `kind` (string, required): What to search.
- `limit` (integer): Most hits.
- `mapping` (string): R8/ProGuard mapping.txt: shows and accepts original names; kept per package.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `path` (string, required): An Android package, .dex or jar with classes*.dex.
- `query` (string, required): Case-insensitive substring or * / ? pattern; for const a number.

Output parameters:

- `items` (array)
- `notes` (array)

### `add_types_csharp` (~80 tokens)

Add new types (C#)

Add C# types (with namespace) to an assembly; they see its internal types; patch_method_csharp can call them. [Long-running.]

Input parameters:

- `assembly` (string, required): Assembly id, name, path.
- `code` (string, required): C# source declaring the new types.
- `dryRun` (boolean): true previews; false applies.

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)

### `analyze_js` (~205 tokens)

Analyze a JavaScript bundle

Read a JavaScript bundle, Hermes or Ark bytecode statically: modules, source map, endpoints, secrets and data flow.

Input parameters:

- `column` (integer): See line.
- `limit` (integer): Rows: flow 50, react 200.
- `line` (integer): position (original source), flow: 1-based generated line.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Char offset; flow, origins: flow index.
- `path` (string, required): A .js, Hermes or Ark file or package.
- `query` (string): Module id; search filter; function #id|name; flow: name, quoted literal, sinks, sink:KIND, module:ID; beautify: a=b, a@line:col=b, auto; react/jsx: name.
- `source` (string): source: path or index; diff: old bundle.
- `view` (string): View.

Output parameters:

- `diff` (object)
- `endpoints` (array)
- `flow` (object)
- `functions` (array)
- `hermes` (object)
- `modules` (array)
- `position` (object)
- `runtime` (object)
- `secrets` (array)
- `summary` (object)
- `total` (integer)
- `view` (string)

### `live_session` (~306 tokens)

Session on a program

Open, list, inspect or close a session on a program; modules match to images; snapshot saves a dump; save_modules saves rebuilt modules.

Input parameters:

- `action` (string): Action.
- `arguments` (array): spawn: program arguments; page_diff: old, new result id.
- `base` (string): save_modules: loaded or preferred.
- `childNames` (array): Hold children by image name (* any).
- `device` (string): adb serial for frida-server.
- `downloadDac` (boolean): Download a missing DAC.
- `environment` (array): spawn: NAME=value.
- `imports` (string): save_modules: restore or keep.
- `layout` (string): save_modules: file or mapped.
- `modules` (string): save_modules: file name, 0x address, all, unlisted or code; coverage: start|take|stop.
- `outputPath` (string): snapshot: dump file, save_modules: new or empty folder (both default temp); screenshot: PNG file.
- `overwrite` (boolean): Overwrite outputPath.
- `program` (string): attach: pid, name, inspector:PORT, cdp:PORT, jdwp:PORT, ttd:PATH; spawn: program path (suspended); processes: name filter; *_child: pid.
- `session` (string): Id from live_session.
- `symbols` (string): save_modules: none, local or download PDBs.

Output parameters:

- `action` (string)
- `backend` (string)
- `ipc` (string)
- `modules` (array)
- `processId` (integer)
- `processes` (array)
- `program` (string)
- `saved` (object)
- `session` (string)
- `sessions` (array)
- `snapshot` (object)
- `state` (string)

### `migrate_native_names` (~219 tokens)

Carry names to a new build

Copy names, comments and engine types from the old build to the new one through the function match, as undoable edits. Never replaces the new build's user annotations. [Long-running.]

Input parameters:

- `codeOnly` (boolean): Match by code, not names.
- `dryRun` (boolean): true previews; false applies.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `minScore` (number): Least mapping confidence accepted (0-1).
- `minTier` (integer): Weakest match tier accepted: 1 (names, identical bytes) to 5 (all).
- `namesOnly` (boolean): Names only, no comments.
- `newImage` (string, required): New build: image id or path.
- `offset` (integer): Rows to skip.
- `oldImage` (string, required): Older build (image id or path), static library or object file: its functions name the starts holding their bytes.
- `sources` (array): Layers to copy (default user).

Output parameters:

- `applied` (boolean)
- `dryRun` (boolean)
- `editIds` (array)
- `items` (array)
- `newImage` (string)
- `notes` (array)
- `oldImage` (string)
- `set` (integer)
- `skipped` (integer)
- `skippedBy` (array)

### `search_pdb_symbols` (~115 tokens)

Search native debug symbols

Search the PDB or DWARF symbols loaded for a native image: address, kind, size, name, signature, object file.

Input parameters:

- `image` (string, required): Image id, name, path.
- `kind` (string): Only this kind (default all).
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `query` (string): Name or decorated name substring (case-insensitive); empty for all.

Output parameters:

- `image` (string)
- `items` (array)

### `update_note` (~189 tokens)

Update a note

Change a note's status, kind, text, tags or evidence. verify=true re-checks linked records and sets a hypothesis confirmed or refuted; a stale expectedRevision is a conflict.

Input parameters:

- `addEvidence` (array): At most 10: {result: r-... or last:N, expect: supports|refutes}, {tool, args} of a call made here, or {text}.
- `addTags` (array): Tags to add.
- `appendText` (string): Text appended on a new line.
- `expectedRevision` (integer, required): The revision last read.
- `id` (string, required): Note id.
- `kind` (string): New kind.
- `removeTags` (array): Tags to remove.
- `status` (string): New status.
- `text` (string): Replacement text.
- `verify` (boolean): Re-check linked records after the other changes.

Output parameters:

- `anchor` (object)
- `author` (string)
- `created` (string)
- `evidence` (array)
- `id` (string)
- `kind` (string)
- `origin` (string)
- `revision` (integer)
- `status` (string)
- `tags` (array)
- `text` (string)
- `updated` (string)

### `save_native` (~156 tokens)

Save patched native image

Write the patched native image to a new file; the PE checksum is recomputed and a signature becomes invalid. replaceOriginal=true keeps a .bak and refuses a file changed on disk. Warnings as patch_bytes; stripSignature=true drops signature_invalidated. [Long-running.]

Input parameters:

- `image` (string, required): Image id, name, path.
- `outputPath` (string, required): Output file path.
- `overwrite` (boolean): Replace an existing file, not the original.
- `replaceOriginal` (boolean): Replace the loaded file (needs --allow-replace-original).
- `stripSignature` (boolean): Remove the Authenticode certificate table from the output.
- `versioned` (boolean): Write NAME.N.dll, the first free N.

Output parameters:

- `backup` (string)
- `bytes` (integer)
- `checksum` (string)
- `editList` (array)
- `notes` (array)
- `outputPath` (string)
- `patches` (integer)
- `sha256` (string)
- `verified` (boolean)

### `resolve_address` (~117 tokens)

Resolve native address

What a native address is: RVA, VA, file offset, section, nearest symbol, source line; with the code index, its function, instruction or data item, references. Reads PDB, DWARF, AOT metadata where present. [Long-running.]

Input parameters:

- `address` (string): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `addresses` (array): Instead of address: up to 100.
- `image` (string, required): Image id, name, path.

Output parameters:

- `access` (string)
- `boundTo` (string)
- `comment` (string)
- `containingInstruction` (string)
- `dataItem` (string)
- `export` (string)
- `failed` (integer)
- `fileOffset` (string)
- `function` (string)
- `image` (string)
- `import` (string)
- `inlined` (array)
- `name` (string)
- `nameSource` (string)
- `referencesTo` (object)
- `results` (array)
- `rva` (string)
- `section` (string)
- `source` (string)
- `status` (string)
- `va` (string)

### `get_attributes` (~158 tokens)

Custom attributes

Custom attributes with arguments on a type or member (parameters and return value included), or on the assembly and module (symbol omitted; format=csharp decompiles them).

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all. Required without symbol.
- `filter` (string): Only attributes whose type name contains this.
- `format` (string): csharp only without symbol.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip (characters with format=csharp).
- `symbol` (string): Ns.Type, Ns.Outer+Inner, Ns.Type::Method(int), name or token. Omit for assembly-level attributes.

Output parameters:

- `code` (string)
- `items` (array)
- `totalChars` (integer)

### `live_read` (~161 tokens)

Read a stopped thread

Read a held thread's registers and program memory as typed values, named through the loaded images.

Input parameters:

- `length` (integer): memory: untyped bytes, or a string's limit (max 4096).
- `memory` (string): An address, register or name to read.
- `registers` (string): Register names, comma-separated; default all.
- `rules` (string): YARA rules (text, file, folder, pack:name) to scan writable memory.
- `session` (string, required): Id from live_session.
- `thread` (string): Thread id; default the first held.
- `type` (string): memory: int8..uint64, float, double, pointer, cstring, utf16; [n] for arrays.

Output parameters:

- `code` (string)
- `memory` (array)
- `namedAddresses` (array)
- `nextOffset` (integer)
- `offset` (integer)
- `registers` (array)
- `session` (string)
- `thread` (string)
- `totalChars` (integer)

### `diff_function` (~282 tokens)

Diff a function between builds

Diff one function between two builds: aligned instruction rows, or a unified pseudocode diff with view=pseudocode. oldResult / newResult diff kept code. [Long-running.]

Input parameters:

- `address` (string): In the function: Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `addresses` (array): Instead of address: up to 20 functions, one summary each.
- `codeOnly` (boolean): Match by code, not names.
- `context` (integer): Unchanged rows around each change (0-50).
- `engine` (string): view=pseudocode: the engine.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `newImage` (string): New build: image id or path.
- `newResult` (string): Same tool; or one result plus the other image and address.
- `offset` (integer): Rows to skip.
- `oldImage` (string): Old build: image id or path.
- `oldResult` (string): Instead: old code as a kept result (r-...), last:N (recent call) or bundle entry (file.json#r-...).
- `side` (string): Which build the address is in.
- `view` (string): pseudocode needs an engine.

Output parameters:

- `added` (integer)
- `basis` (string)
- `candidates` (array)
- `changed` (integer)
- `evidence` (object)
- `functions` (array)
- `items` (array)
- `newAddress` (string)
- `newFunction` (string)
- `newImage` (string)
- `notes` (array)
- `oldAddress` (string)
- `oldFunction` (string)
- `oldImage` (string)
- `removed` (integer)
- `same` (integer)
- `score` (number)
- `summary` (string)
- `tier` (integer)
- `view` (string)

### `list_android_devices` (~37 tokens)

List Android devices

Android devices and emulators: serial, state, model. adb: CORVUS_ADB, else PATH, else SDK platform-tools.

Output parameters:

- `items` (array)
- `unparsed` (array)

### `get_native_frame` (~145 tokens)

Native stack frame and locals

Stack frame of a native function: members with offset, name, type and size; locals=true adds decompiler locals. Offsets count from the lowest address, bracketed ones from the return address. [Long-running.]

Input parameters:

- `engine` (string): Default auto.
- `function` (string, required): Hex VA/RVA (rva:/va:/off:), export, module!import, function. Comma-separated for several.
- `image` (string, required): Image id, name, path.
- `limit` (integer): Max rows (max 5000).
- `locals` (boolean): Decompile for the locals too.
- `offset` (integer): Rows to skip.

Output parameters:

- `engine` (string)
- `frames` (integer)
- `function` (string)
- `image` (string)
- `items` (array)
- `localSize` (integer)
- `locals` (integer)
- `localsNote` (string)
- `members` (integer)
- `name` (string)
- `returnAddressOffset` (integer)
- `savedRegisters` (integer)

### `live_coverage` (~187 tokens)

Code coverage of a session

Collect code coverage in a session: which functions ran and how often; diff compares runs.

Input parameters:

- `action` (string): Action.
- `format` (string): report: text, or dot (call graph; offset counts characters).
- `hitLimit` (integer): start: stops per function before it is cleared.
- `limit` (integer): Max rows.
- `match` (string): Names containing this; start: module!part for another module.
- `offset` (integer): Rows to skip.
- `other` (string): diff: second run.
- `outputPath` (string): Save as JSON to a new file; an existing path is refused.
- `run` (string): Run id (cov-1; omitted: the only run).
- `session` (string): Session id; start only.
- `show` (string): report: ran, missed or all.

Output parameters:

- `code` (string)
- `diff` (object)
- `items` (array)
- `namedAddresses` (array)
- `run` (object)
- `runs` (array)
- `totalChars` (integer)

### `dump_stack` (~206 tokens)

Crash dump stack

Walk the call stack of a dump thread, naming frames from loaded images, PDBs or exports. .NET frames add token, IL offset and C# statement.

Input parameters:

- `dump` (string, required): A .dmp path or open_minidump's id.
- `dumpTimeContext` (boolean): Faulting thread: its context at dump time, not the exception's (.ecxr).
- `imageDirectories` (string): Program binary folders (';'-separated), kept for the dump, plus its own.
- `limit` (integer): Max rows.
- `managed` (string): auto: .NET frames via the DAC; off: native only.
- `maxFrames` (integer): Max frames walked (up to 1024).
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `thread` (string): Thread id, '#index', name or 'exception' (default: faulting, else first).

Output parameters:

- `architecture` (string)
- `context` (string)
- `dump` (string)
- `items` (array)
- `managed` (string)
- `notes` (array)
- `registers` (string)
- `scannedFrames` (integer)
- `stop` (string)
- `threadId` (integer)
- `threadName` (string)

### `generate_cpp_binding` (~220 tokens)

Generate C++ binding

Generate C++ binding code for a managed type of a Mono or AOT app: a struct that resolves the class once, typed field accessors, property getters and invoke wrappers.

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `headerPath` (string): Header path (absolute or under projectDir; default projectDir); #include base.
- `includeInherited` (boolean): Also bind inherited property getters.
- `maxTokens` (integer): Page size in tokens.
- `members` (string): Comma-separated member names; default all but compiler-generated.
- `offset` (integer): Character offset (nextOffset).
- `projectDir` (string): C/C++ project of the header, scanned for a host function table and helpers.
- `style` (string): mono: embedding API; aot: runtime exports; hostapi: host function table. Default detected, else mono.
- `type` (string, required): Ns.Type, Ns.Outer+Inner, Ns.Type::Method(int), name or token.

Output parameters:

- `code` (string)
- `nextOffset` (integer)
- `offset` (integer)
- `totalChars` (integer)

### `list_android_packages` (~105 tokens)

List installed packages

Packages installed on a device (pm list packages -f -U -i): name, APK path, uid and installer.

Input parameters:

- `limit` (integer): Most packages.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `query` (string): Only package names containing this.
- `serial` (string): Device serial; omit if one device.
- `user` (integer): Android user id (default: current).

Output parameters:

- `items` (array)
- `serial` (string)

### `read_bytes` (~189 tokens)

Read native bytes or values

Hex dump of native image bytes at an address as the loader maps them; uninitialized bytes show as ??. type= reads values instead; get_native_type read=true reads structs.

Input parameters:

- `address` (string, required): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `image` (string, required): Image id, name, path.
- `length` (integer): Bytes (default 256, max 65536); with type: values (default 1, max 4096).
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Bytes from address (a page's nextOffset).
- `type` (string): Value type: u8-u64, i8-i64 (be suffix: u32be), f32, f64, ptr, a C name (DWORD), cstr or wstr.

Output parameters:

- `address` (string)
- `code` (string)
- `image` (string)
- `length` (integer)
- `nextAddress` (string)
- `nextOffset` (integer)
- `offset` (integer)
- `totalBytes` (integer)
- `totalChars` (integer)

### `list_android_resources` (~148 tokens)

List Android resources

Compiled resources of an Android package (resources.arsc or resources.pb): one row per resource and configuration, values cut at 200 characters.

Input parameters:

- `config` (string): Only this configuration (pt-rBR, or default).
- `limit` (integer): Most rows.
- `maxTokens` (integer): Page size in tokens.
- `name` (string): Only names matching this (* and ? wildcards).
- `offset` (integer): Rows to skip.
- `path` (string, required): An .apk, .aab or split set (.apks, .xapk, .apkm).
- `type` (string): Only this type (string, layout, xml...).

Output parameters:

- `items` (array)
- `types` (object)

### `list_edits` (~78 tokens)

List unsaved edits

Unsaved edits of an assembly in order; numbers (editId <assembly>#<n>) stay when others are undone.

Input parameters:

- `assembly` (string, required): Assembly id, name, path.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.

Output parameters:

- `assembly` (string)
- `items` (array)

### `live_console` (~189 tokens)

Scripted console run

Drive a program with a background script; status shows steps, transcript pages output.

Input parameters:

- `action` (string): Action.
- `arguments` (array): start: arguments.
- `cursor` (string): transcript: cursor of a page; default the oldest line.
- `limit` (integer): Max rows.
- `program` (string): start: program path.
- `run` (string): Run id (con-1; omitted: the only one).
- `script` (array): start: steps, one per line: send TEXT, wait TEXT (output contains it), resize COLUMNS ROWS, delay MS; TEXT takes \r (Enter), \n, \t, \e, \xHH.
- `timeoutSeconds` (integer): Seconds per wait step (1-300).
- `waitSeconds` (integer): status: seconds to wait for the script, 0-300.

Output parameters:

- `cursor` (string)
- `dropped` (integer)
- `items` (array)
- `run` (object)
- `runs` (array)
- `steps` (array)

### `live_timeline` (~190 tokens)

Activity trace of a session

Trace the files, registry keys, endpoints and child processes a program opens; report counts names, diff compares traces.

Input parameters:

- `a` (string): diff: first timeline.
- `action` (string): Action.
- `b` (string): diff: second timeline.
- `category` (string): Only file, registry, network or process.
- `cursor` (string): list: cursor of an earlier page; default the oldest entry kept.
- `limit` (integer): Max rows.
- `match` (string): Names containing this.
- `offset` (integer): Rows to skip. (report).
- `outputPath` (string): Save as JSON to a new file; an existing path is refused.
- `run` (string): Run id (tl-1; omitted: the only one); list without it or a filter lists runs.
- `session` (string): Session id; start only.

Output parameters:

- `cursor` (string)
- `diff` (object)
- `dropped` (integer)
- `items` (array)
- `names` (array)
- `run` (object)
- `runs` (array)

### `find_xrefs` (~251 tokens)

Native cross-references

What references a native address: calls, jumps, data reads and writes, pointers, switch tables, each with its function; exports include other loaded images. direction=from lists what it references; Type::member finds struct member uses. [Long-running.]

Input parameters:

- `address` (string): Hex VA/RVA (rva:/va:/off:), export, module!import, function. Or Type::member, Type.member, Type+0xOFFSET.
- `addresses` (array): Instead of address: up to 100.
- `direction` (string): Default to.
- `engine` (string): auto (default): IDA or Ghidra if analyzed, else ours. Adds RTTI virtual calls.
- `image` (string, required): Image id, name, path.
- `kind` (string): code: calls, jumps; data: reads, writes, pointers; metadata: .pdata, CFG, exports.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `scope` (string): Struct member: typed (default) or all (every function; call again to go on).

Output parameters:

- `boundTo` (string)
- `engine` (string)
- `engineNote` (string)
- `failed` (integer)
- `image` (string)
- `items` (array)
- `target` (string)
- `targets` (array)

### `decompile_java` (~258 tokens)

Decompile Java

Java source of a class or method via JADX (CORVUS_JAVA_DECOMPILER, JDK 17+), or a jar or .class via Vineflower (engine=vineflower, CORVUS_JAVA_DECOMPILER2). simplified=true replaces each decoder call with a known value by its string literal. Without either: disassemble_dex. [Long-running.]

Input parameters:

- `engine` (string): jadx (default) or vineflower (class files only).
- `javaOnly` (boolean): Partial Java where JADX fails; default: smali there.
- `mapping` (string): R8/ProGuard mapping.txt: shows and accepts original names; kept per package.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Character offset (nextOffset).
- `path` (string, required): An .apk, .aab or split set, a .dex, a jar or a .class.
- `simplified` (boolean): Show string decoder calls as their decoded literals; a header counts unknown calls.
- `symbol` (string, required): Class (pkg.C, Lpkg/C;) or method (Lpkg/C;->m(I)V, pkg.C::m, pkg.C::m(int)).

Output parameters:

- `code` (string)
- `nextOffset` (integer)
- `offset` (integer)
- `totalChars` (integer)

### `load_pdb` (~236 tokens)

Load native debug symbols

Load PDB (GUID and age checked) or DWARF debug symbols for a native image: names, types, source lines. Searches path, the image folder, symbol paths and CORVUS_DEBUG_DIRS; local matches load automatically. [Long-running.]

Input parameters:

- `allowMismatch` (boolean): Use the path file even if GUID/age or build-id differs.
- `clear` (boolean): Remove the PDB names and saved copy instead.
- `download` (boolean): If nothing local matches: symbol server (PDB), debuginfod (ELF).
- `image` (string, required): Image id, name, path.
- `maxMegabytes` (integer): Download size limit in MB (1-16384).
- `path` (string): PDB or debug file, dSYM, or a folder or symbol store to look in first.
- `server` (string): Default: _NT_SYMBOL_PATH servers, else Microsoft (PDB); CORVUS_DEBUGINFOD_URLS (DWARF). Others are refused.
- `timeoutSeconds` (integer): Download time limit, seconds (5-3600).

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)

### `search_native_strings` (~184 tokens)

Search native strings

Strings referenced by code or data of a native image, with address, reference count and first referencing function. Metadata literals appear after apply_metadata_names; an engine adds unreferenced strings. [Long-running.]

Input parameters:

- `engine` (string): auto (default): IDA or Ghidra if analyzed, else ours.
- `image` (string, required): Image id, name, path.
- `limit` (integer): Max rows.
- `maxLength` (integer): Characters per string (max 4000); longer ones are clipped.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `query` (string): Case-insensitive substring, or regex (regex=true, or /pattern/: always a regex; regex=true keeps the slashes); omit for all.
- `regex` (boolean): query is a regex.

Output parameters:

- `image` (string)
- `items` (array)
- `notEvaluated` (integer)

### `search_symbols` (~154 tokens)

Search symbols by name

Find types and members by name in loaded assemblies: case-insensitive substring, wildcard (Get*Value?) or regex; queries with . or :: match full names. Exact matches first, then by name length, assembly and token.

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `kind` (string): Restrict to this kind.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `namespace` (string): Only namespaces starting with this.
- `offset` (integer): Rows to skip.
- `query` (string, required): Name, substring, wildcard, regex or /pattern/.
- `regex` (boolean): query is a regex.

Output parameters:

- `items` (array)
- `notEvaluated` (integer)

### `save_session` (~85 tokens)

Save the session

Save loaded files, .NET edits, native patches, names, comments, notes and open dumps to one JSON file; load_session restores it.

Input parameters:

- `include` (string): Comma list: edits, patches, annotations, notes, all (default).
- `outputPath` (string, required): Output file path (.json).
- `overwrite` (boolean): Replace the file if it exists.

Output parameters:

- `actionNotes` (array)
- `comments` (integer)
- `editedAssemblies` (integer)
- `edits` (integer)
- `files` (integer)
- `names` (integer)
- `notes` (integer)
- `outputPath` (string)
- `patchedImages` (integer)
- `patches` (integer)

### `set_native_operand` (~163 tokens)

Set how an operand displays

Set how an instruction operand displays in engine disassembly and pseudocode. Kept in annotations. [Long-running.]

Input parameters:

- `address` (string, required): Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `display` (string): offset: an address; struct: IDA only.
- `engine` (string): Default auto.
- `image` (string, required): Image id, name, path.
- `items` (string): Instead: lines address operand display [type], or JSON [{address, operand, display, type?}].
- `operand` (integer): Operand index, 0 for the first.
- `type` (string): display=enum or struct: the type name (struct: optionally +delta).

Output parameters:

- `applied` (boolean)
- `changes` (array)
- `digest` (string)
- `dryRun` (boolean)
- `editIds` (array)
- `failed` (integer)

### `pull_android_package` (~91 tokens)

Pull installed package

Copy every APK of an installed package (base and splits) into a new or empty directory, with sizes and SHA-256. A failed pull leaves no files. [Long-running.]

Input parameters:

- `outputDirectory` (string, required): A new or empty directory to write the APKs to.
- `package` (string, required): Package (com.example.app).
- `serial` (string): Device serial; omit if one device.

Output parameters:

- `aotCode` (array)
- `files` (array)
- `next` (string)
- `package` (string)
- `serial` (string)
- `summary` (object)

### `map_address_between_builds` (~136 tokens)

Map an address to a new build

Map old-build addresses (functions, instructions, strings, referenced data) to the new build: new address, confidence and reason, or why not with candidates. [Long-running.]

Input parameters:

- `address` (string): Old build: Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `addresses` (array): Instead of address: up to 100.
- `codeOnly` (boolean): Match by code, not names.
- `newImage` (string, required): New build: image id or path.
- `oldImage` (string, required): Old build: image id or path.

Output parameters:

- `failed` (integer)
- `newImage` (string)
- `oldImage` (string)
- `results` (array)

### `add_search_directory` (~32 tokens)

Add reference search directory

Add a folder where unloaded referenced assemblies are resolved; subfolders excluded.

Input parameters:

- `directory` (string, required): Directory path.

Output parameters:

- `searchDirectories` (array)
- `suggested` (array)

### `export_native_annotations` (~98 tokens)

Export native annotations

Write the image's names, comments and user types as IDAPython, a Ghidra script, JSON or a C header. objc-header writes the Objective-C and Swift declarations of a Mach-O. [Long-running.]

Input parameters:

- `format` (string): Default json.
- `image` (string, required): Image id, name, path.
- `outputPath` (string, required): Output file path.
- `overwrite` (boolean): Overwrite outputPath.

Output parameters:

- `bytes` (integer)
- `comments` (integer)
- `format` (string)
- `imported` (integer)
- `names` (integer)
- `outputPath` (string)
- `pseudoComments` (integer)
- `sha256` (string)
- `types` (integer)

### `find_method_by_address` (~174 tokens)

Native address to method

Map a native address in AOT code to the methods whose function holds it, or the literal or metadata slot at it. Without script.json, generic instantiations are a guess.

Input parameters:

- `address` (string, required): Hex as IDA / Ghidra show it (0x1A2B3C, 1A2B3Ch, 00000001`8001A2B3); d: prefix for decimal.
- `assembly` (string): Assembly id, name, path; omit: all.
- `kind` (string): auto: a VA at or above the image base, else an RVA, else a file offset.
- `limit` (integer): Max methods listed.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.

Output parameters:

- `address` (string)
- `items` (array)

### `read_result` (~259 tokens)

Read a kept result

Page, search or save a kept result (r-..., kept 7 days). format=evidence bundles results and their calls into outputPath; format=verify re-runs a bundle or result, or compares it with against.

Input parameters:

- `against` (string): format=verify: compare with this, not a re-run: a kept result (r-...), last:N (recent call) or bundle entry (file.json#r-...).
- `format` (string): text; json: the structured record; jsonl: its items, one per line; timesketch: Timesketch events, one per UTC timestamp.
- `id` (string, required): Result id (r-...); evidence: ids or last:N, comma-separated; verify: also a bundle file or entry (file.json#r-...).
- `maxTokens` (integer): Page size in tokens (default 6000).
- `offset` (integer): Character offset (nextOffset).
- `outputPath` (string): Write the whole result to this file; returns path, bytes, SHA-256.
- `overwrite` (boolean): Overwrite outputPath.
- `query` (string): Only lines containing this text (/regex/ for a pattern), with offsets.

Output parameters:

- `bytes` (integer)
- `checks` (array)
- `code` (string)
- `id` (string)
- `input` (string)
- `matches` (array)
- `nextOffset` (integer)
- `offset` (integer)
- `path` (string)
- `sha256` (string)
- `tool` (string)
- `totalChars` (integer)

### `search_il` (~138 tokens)

Search IL instruction patterns

Find methods with an IL instruction sequence: ;-separated opcode [operand] elements with * and ? wildcards (operands match names, strings, numbers); ... skips up to 16 instructions, e.g. "ldstr *password*; ...; call *::Hash*".

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `context` (integer): Instructions shown per match (1-24).
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `pattern` (string, required): Instruction pattern.

Output parameters:

- `items` (array)

### `diff_edits` (~80 tokens)

Diff edits (before/after C#)

Unified diff of the decompiled C# of each member the edits (or one) touched.

Input parameters:

- `assembly` (string, required): Assembly id, name, path.
- `maxTokens` (integer): Page size in tokens.
- `number` (integer): Only this edit (list_edits number).
- `offset` (integer): Character offset (nextOffset).

Output parameters:

- `code` (string)
- `nextOffset` (integer)
- `offset` (integer)
- `totalChars` (integer)

### `find_virtual_calls` (~197 tokens)

Native virtual calls

Resolve virtual call sites through RTTI or NativeAOT MethodTables: receiver class, vftable slot and the implementations it can reach (exact, possible or unresolved). [Long-running.]

Input parameters:

- `crossCheck` (boolean): Compare a sample with IDA (else Ghidra); minutes on a large image at first.
- `function` (string): Only sites in this function: Hex VA/RVA (rva:/va:/off:), export, module!import, function.
- `image` (string, required): Image id, name, path.
- `limit` (integer): Max sites (max 1000).
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `sampleFunctions` (integer): Cross-check: functions to sample.
- `status` (string): Only sites with this status.
- `timeoutSeconds` (integer): Cross-check: time budget in seconds.

Output parameters:

- `crossCheck` (object)
- `directEdges` (integer)
- `edges` (integer)
- `exact` (integer)
- `image` (string)
- `items` (array)
- `notes` (array)
- `possible` (integer)
- `rttiClasses` (integer)
- `sites` (integer)
- `unresolved` (integer)

### `ghidra_script` (~249 tokens)

Run a Ghidra script on a native image

Run a Java or Python Ghidra script on the image in one transaction: saved on return, rolled back on an exception. Off unless --ghidra-scripting (CORVUS_GHIDRA_SCRIPTING=1); runs with server rights. [Long-running.]

Input parameters:

- `allowError` (boolean): Return the exception as the result.
- `args` (array): With name: script arguments (getScriptArgs).
- `background` (boolean): Return at once; a notice reports the end.
- `code` (string): Java (a GhidraScript class, or a run() body with imports first) or Python source.
- `engine` (string): Default auto.
- `image` (string, required): Image id, name, path.
- `language` (string): java (default) or python (needs CORVUS_GHIDRA_PYTHON); name *.py is Python.
- `maxTokens` (integer): Page size in tokens.
- `name` (string): Instead of code: a script in the Ghidra script folders or DATA/ghidra_scripts.
- `timeoutSeconds` (integer): Seconds before it is cancelled; default 120.

Output parameters:

- `engine` (string)
- `error` (string)
- `image` (string)
- `result` (string)
- `saved` (boolean)
- `stderr` (string)
- `stdout` (string)

### `live_watch` (~114 tokens)

Record calls in a session

Record each call of a function with arguments and result as events (live_events from=WATCH).

Input parameters:

- `action` (string): Action.
- `arguments` (integer): set: raw values without a prototype (0-16).
- `at` (string): set: name, module!export or address.
- `rateLimit` (integer): set: calls/s recorded (1-100000); the rest are counted.
- `session` (string, required): Id from live_session.
- `watch` (string): clear: watch id.

Output parameters:

- `namedAddresses` (array)
- `session` (string)
- `watches` (array)

### `dump_heap` (~180 tokens)

.NET heap of a dump or session

List the .NET GC heap of a dump or session: per-type counts and sizes, or matching objects (first 100000 paged). Needs heap memory in the dump, else heap_not_captured. [Long-running.]

Input parameters:

- `dump` (string, required): A .dmp path, open_minidump's id or a session id (live-1): its program, read while it runs.
- `limit` (integer): Max rows.
- `maxObjects` (integer): Max objects walked.
- `maxTokens` (integer): Page size in tokens.
- `minSize` (integer): Min object size in bytes.
- `mode` (string): stats (per type) or objects (one row each).
- `offset` (integer): Rows to skip.
- `type` (string): Type full name, * ? wildcards; default all.

Output parameters:

- `dump` (string)
- `items` (array)
- `matchedBytes` (integer)
- `mode` (string)
- `notes` (array)
- `type` (string)
- `walked` (integer)

### `reanalyze_native` (~216 tokens)

Re-run native auto-analysis

Start IDA or Ghidra auto-analysis over an image or range in the background and save; completes a cut-short analysis. analyzers=true lists the options. [Long-running.]

Input parameters:

- `analyzers` (boolean): List analyzer options instead of running.
- `engine` (string): Default auto.
- `filter` (string): With analyzers: name filter.
- `from` (string): Range start (default: whole image).
- `image` (string, required): Image id, name, path.
- `limit` (integer): With analyzers: max rows.
- `offset` (integer): With analyzers: rows to skip.
- `options` (array): name=value per analyzer option for this run (AF_FLIRT=false).
- `preset` (string): full (Ghidra defaults) or a preset in analysis-presets.json.
- `timeoutSeconds` (integer): Budget in seconds; omit to run until done or stalled. Other engine calls conflict until done.
- `to` (string): Range end (exclusive).

Output parameters:

- `engine` (string)
- `image` (string)
- `items` (array)
- `options` (array)
- `scope` (string)

### `record_note` (~169 tokens)

Record a note

Record a finding, question, hypothesis or todo on a native address, .NET member, file or dump. Notes persist per user and follow the binary by SHA-256 or MVID.

Input parameters:

- `anchor` (string): <image>@<address>, <assembly>:<symbol or token>, image or assembly id, dump:<id or path>, or empty (session-wide).
- `evidence` (array): At most 10: {result: r-... or last:N, expect: supports|refutes}, {tool, args} of a call made here, or {text}.
- `kind` (string): Default finding.
- `status` (string): Default open.
- `tags` (array): At most 10.
- `text` (string, required): At most 4,000 characters.

Output parameters:

- `anchor` (object)
- `author` (string)
- `created` (string)
- `evidence` (array)
- `id` (string)
- `kind` (string)
- `origin` (string)
- `revision` (integer)
- `status` (string)
- `tags` (array)
- `text` (string)
- `updated` (string)

### `resolve_symbol` (~118 tokens)

Resolve symbol

Every match of a symbol string or token, with kind, assembly, token and signature; disambiguates before other calls.

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `kind` (string): Restrict to this kind.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `symbol` (string, required): Ns.Type, Ns.Outer+Inner, Ns.Type::Method(int), name or token.

Output parameters:

- `items` (array)
- `notEvaluated` (integer)

### `list_notes` (~164 tokens)

List notes

Notes, newest first, filtered by status, kind, anchor, tag and text. A file anchor lists all its notes, an address its function's, a type its members' too.

Input parameters:

- `anchor` (string): <image>@<address>, <assembly>:<symbol or token>, image or assembly id, dump:<id or path>, or empty (session-wide).
- `kind` (string): Only this kind.
- `limit` (integer): Notes per page.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `status` (string): Default open; all for every status.
- `tag` (string): Only notes with this tag.
- `text` (string): Text substring (case-insensitive).

Output parameters:

- `items` (array)
- `notes` (array)

### `live_events` (~151 tokens)

Session events

Page session events by cursor and filter; waitSeconds waits for the next.

Input parameters:

- `cursor` (string): Cursor of an earlier page; default oldest kept.
- `from` (string): Only this watch or script id.
- `kind` (string): Only this kind.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `outputPath` (string): Save as JSON to a new file; an existing path is refused.
- `session` (string, required): Id from live_session.
- `thread` (string): Only this thread id.
- `waitSeconds` (integer): Seconds to wait for an event, 1-300; 0 returns at once.

Output parameters:

- `cursor` (string)
- `dropped` (integer)
- `items` (array)
- `namedAddresses` (array)
- `session` (string)

### `update_to_new_build` (~261 tokens)

Update work to a new build

Carry names, comments, types, name layers, patches, code patterns and notes from an old native build to a new one by one function match. Re-runs report already_present; .NET pairs carry notes only. [Long-running.]

Input parameters:

- `category` (string): Only items of this category.
- `codeOnly` (boolean): Match by code, not names.
- `dryRun` (boolean): true previews; false applies.
- `include` (array): Categories to carry (default all).
- `limit` (integer): Max rows.
- `maxPatterns` (integer): Most code patterns made (0-1000).
- `maxTokens` (integer): Page size in tokens.
- `newImage` (string, required): New build: image id or path.
- `newMetadata` (array): Dummy assemblies, new build.
- `offset` (integer): Rows to skip.
- `oldImage` (string, required): Old build: image id or path.
- `oldMetadata` (array): Dummy assemblies, old build.
- `outcome` (string): Only items with this outcome.
- `patchSet` (string): Patch set (export_native_patches json): text or path.
- `stubPlacement` (string): Placement of re-created patch stubs.

Output parameters:

- `categories` (array)
- `dryRun` (boolean)
- `editIds` (array)
- `functionsMatched` (integer)
- `included` (array)
- `items` (array)
- `methodMapping` (object)
- `newFunctions` (integer)
- `newImage` (string)
- `notes` (array)
- `oldFunctions` (integer)
- `oldImage` (string)
- `summary` (string)

### `get_type_hierarchy` (~98 tokens)

Type hierarchy

Base chain, interfaces and directly derived or implementing loaded types of a type.

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `limit` (integer): Max rows.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Rows to skip.
- `type` (string, required): Ns.Type, Ns.Outer+Inner, Ns.Type::Method(int), name or token.

Output parameters:

- `baseChain` (array)
- `interfaces` (array)
- `items` (array)
- `type` (object)

### `get_il` (~139 tokens)

IL disassembly

IL disassembly of a member or type (tokens, offsets, try blocks); each method starts with its normalized IL hash (stable across rebuilds) and raw IL SHA-256. Input for patch_method_il.

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `maxTokens` (integer): Page size in tokens.
- `offset` (integer): Character offset (nextOffset).
- `source` (boolean): Portable PDB source lines at IL offsets, local names, SourceLink URLs.
- `symbol` (string, required): Ns.Type, Ns.Outer+Inner, Ns.Type::Method(int), name or token.

Output parameters:

- `bodies` (array)
- `code` (string)
- `language` (string)
- `methods` (array)
- `nextOffset` (integer)
- `offset` (integer)
- `symbols` (array)
- `totalChars` (integer)

### `dump_object` (~123 tokens)

.NET object of a dump or session

Read one .NET object of a dump or session: type, size, fields, a string's or boxed value, or array elements.

Input parameters:

- `address` (string, required): Hex address of the object.
- `depth` (integer): Reference levels expanded (up to 3).
- `dump` (string, required): A .dmp path, open_minidump's id or a session id (live-1): its program, read while it runs.
- `maxArrayItems` (integer): Max array elements.
- `maxFields` (integer): Max fields, nested included.

Output parameters:

- `address` (string)
- `assembly` (string)
- `buildCheck` (string)
- `dump` (string)
- `fields` (array)
- `length` (integer)
- `notes` (array)
- `size` (integer)
- `token` (string)
- `truncated` (boolean)
- `type` (string)
- `value` (string)

### `decompile_member` (~165 tokens)

Decompile to C#

Decompile a member or a whole type to C#; every overload unless a parameter list picks one. Code the decompiler fails on shows as IL.

Input parameters:

- `assembly` (string): Assembly id, name, path; omit: all.
- `kind` (string): Restrict to this kind (default any).
- `maxTokens` (integer): Page size in tokens.
- `member` (string, required): Ns.Type, Ns.Outer+Inner, Ns.Type::Method(int), name or token.
- `offset` (integer): Character offset (nextOffset).
- `provenance` (boolean): Start with build-pinning comments: SHA-256, MVID, tokens, IL hashes.
- `simplified` (boolean): Show the code as simplify_methods would leave it, assembly unchanged.

Output parameters:

- `bodies` (array)
- `code` (string)
- `language` (string)
- `methods` (array)
- `nextOffset` (integer)
- `offset` (integer)
- `symbols` (array)
- `totalChars` (integer)

### `save_assembly` (~163 tokens)

Save patched assembly

Write an assembly and its edits to a new file, atomically; a file changed since load is refused. Members the writer changed are listed with reason codes (docs/saving.md).

Input parameters:

- `assembly` (string, required): Assembly id, name, path.
- `outputPath` (string): Output path (.wasm writes Webcil for Blazor); default ORIGINAL.patched.dll.
- `overwrite` (boolean): Replace an existing file, not the original.
- `replaceOriginal` (boolean): Replace the loaded file, keeping a .bak (needs --allow-replace-original).
- `strict` (boolean): Write nothing if the writer would change a member (default: save, list them).
- `versioned` (boolean): Write NAME.N.dll, the first free N.

Output parameters:

- `backup` (string)
- `bytes` (integer)
- `editList` (array)
- `edits` (integer)
- `outputPath` (string)
- `sha256` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/albasha0x0-corvus/corvusre#diagnostics

## Score history

- 2026-11-05: 77
- 2026-11-04: 76
- 2026-11-03: 75
- 2026-11-02: 74
- 2026-11-01: 74
- 2026-10-31: 74
- 2026-10-30: 73
- 2026-10-29: 73
- 2026-10-28: 72
- 2026-10-27: 57
- 2026-10-26: 71
- 2026-10-25: 71
- 2026-10-24: 71
- 2026-10-23: 55
- 2026-10-22: 84
- 2026-10-21: 83
- 2026-10-20: 83
- 2026-10-19: 82
- 2026-10-18: 82
- 2026-10-17: 71
- 2026-10-16: 71
- 2026-10-15: 56
- 2026-10-14: 40

## Common questions

### What is the Corvus MCP server?

Corvus is an MCP server listed in the public MCP registry as io.github.Albasha0x0/corvus. Reverse engineering and security analysis of .NET and native binaries: decompile, compare, patch. This page covers its NuGet package (CorvusRE).

### Is the Corvus MCP server safe to use?

Corvus scores 77 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Corvus MCP server expose?

Corvus exposes 165 tools: get_engine_status, export_edits, list_types, resolve_call_targets, search_constants, and 160 more. Their descriptions and schemas cost roughly 27,723 tokens of context every time the server is loaded.

### Is the Corvus MCP server still maintained?

Corvus is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Corvus MCP server under?

Corvus declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- NuGet package: https://www.nuget.org/packages/CorvusRE
- Socket report: https://socket.dev/nuget/package/CorvusRE
- Repository: https://github.com/Albasha0x0/Corvus
- Changelog RSS feed: https://verifymcp.io/servers/albasha0x0-corvus/corvusre.xml
- Changelog JSON feed: https://verifymcp.io/servers/albasha0x0-corvus/corvusre.json
- HTML version of this page: https://verifymcp.io/servers/albasha0x0-corvus/corvusre