Corvus

Typed values (URLs, IPs, paths, registry keys, crypto keys, base64) from literals, constants, resources and serialized asset fields, or native image strings (section, address), with count, locations and receiving APIs. read_result outputPath exports all (text: CSV).

Call chains that reach a method, from from= or entry points, shortest first. A native to= follows native callers and P/Invokes back to managed code.

What a method uses, in IL order with offsets: calls, field reads and writes, types, strings. A P/Invoke or native export gives native callees as call-tree rows.

Find where a type or member of the old build went in the new one: new name, token, confidence and body change, or the tied candidates. diff and il add C# and normalized IL diffs. [Long-running.]

Cross-references in DEX code with method and code offset. direction=to: who calls, reads, writes or uses target; from: what a method or class calls, reads, writes and loads. Methods match by exact id. [Long-running.]

Map a native address in AOT code to the methods whose function holds it, or the literal or metadata slot at it. Without script.json, generic instantiations are a guess.

Managed method whose ReadyToRun code holds a native address: name, token, range, offset and instruction, or what an import cell resolves to.

Every use of a symbol in loaded assemblies: method call sites (also via base or interface), field reads, writes, address uses and type uses. A native export gives P/Invoke callers and native call sites.

Find functions like a given one, ranked by code shape, control flow and shared strings, constants, imports, callees. view=duplicates or clusters groups look-alike functions image-wide. [Long-running.]

Resolve virtual call sites through RTTI or NativeAOT MethodTables: receiver class, vftable slot and the implementations it can reach (exact, possible or unresolved). [Long-running.]

What references a native address: calls, jumps, data reads and writes, pointers, switch tables, each with its function; exports include other loaded images. direction=from lists what it references; Type::member finds struct member uses. [Long-running.]

Generate C++ binding code for a managed type of a Mono or AOT app: a struct that resolves the class once, typed field accessors, property getters and invoke wrappers.

Device properties (getprop) with a summary: SDK, model, ABIs, patch level, debug flags. view= reads processes, files, screenshots, bug reports. Read-only. [Long-running.]

AndroidManifest.xml decoded. view=summary: package, SDKs, permissions, exported components and why, highlights; components: each with intent filters, deep links and meta-data.

One installed package (dumpsys package): versions, SDKs, paths, flags, installer, uid, permissions with grant state.

One entry or resource of an Android package: an entry path (binary XML decoded, else text or hex), or @type/name / 0x7f... for its value in every configuration.

Assembly overview: identity, framework, entry point, counts, invalid IL, transformer, edits. view=references, metadata (tables, heaps), transforms (a dry run) or bindings (script names).

Custom attributes with arguments on a type or member (parameters and return value included), or on the assembly and module (symbol omitted; format=csharp decompiles them).

Call sites with recovered argument values: constants, strings, addresses, earlier call results. Known Win32, CRT and libc APIs name parameters and decode flags. Pass address, callee or both. [Long-running.]

Callers or callees of a method across loaded assemblies, several levels deep, one row per node. Continues through P/Invokes into native code; takes a native export.

Basic blocks of the native function at an address, paged: range, successors, switch tables and unresolved indirect jumps. [Long-running.]

One DEX class: superclass, interfaces, signature, inner classes, Kotlin @Metadata, annotations, fields and methods, paged.

IDA and Ghidra sessions of a native image: state, running job, engine view. Starts no engine.

Exception handling of a native function: handlers, try blocks or call sites, landing pads, caught types. Without address: the image's counts and rejected metadata. [Long-running.]

IL disassembly of a member or type (tokens, offsets, try blocks); each method starts with its normalized IL hash (stable across rebuilds) and raw IL SHA-256. Input for patch_method_il.

Native addresses, field offsets and tokens of an AOT method or type. script.json adds function bounds, shared code, generic instantiations and metadata slots; stringliteral.json adds the literals a method loads.

Stack frame of a native function: members with offset, name, type and size; locals=true adds decompiler locals. Offsets count from the lowest address, bracketed ones from the return address. [Long-running.]

Layout of a native type (fields, bases, enum values) from PDB, RTTI, metadata, ObjC, Swift or an engine. Look up by name, id or typed address; read=true adds the values at address. [Long-running.]

Metadata of a NativeAOT image (.NET 7-10; PE, ELF, Mach-O): MethodTables, method names, frozen strings and statics. Recovered names apply as the nativeaot layer. [Long-running.]

Overview of a native image: headers, sections, mitigations, imports and exports, PDB, version, signature and anomalies; the ELF and Mach-O equivalents. view=code adds code index statistics.

Precompiled native code of a method in a ReadyToRun assembly: entry, code ranges, fixup cells and x86 / x64 disassembly, per compiled generic instantiation.

Read a resource: text, a hex preview, or a .resources entry list (entry reads one; .baml as XAML); outputPath extracts the raw bytes. Native images take TYPE/NAME[/LANGUAGE].

Base chain, interfaces and directly derived or implementing loaded types of a type.

Outline of a type without decompiling: declaration, attributes, member counts, the first members of each kind; section= pages one kind. A field shows its value or FieldRVA data.