Corvus

Copy names, comments and engine types from the old build to the new one through the function match, as undoable edits. Never replaces the new build's user annotations. [Long-running.]

Carry byte patches from an old build to a new one through the function match. A patch applies only where the mapped address holds its original bytes, else is refused; the same image twice with patchSet replays the set. [Long-running.]

Callers or callees of a native function across loaded images, thunks and import slots; module!import gives its callers. Callees include GetProcAddress and virtual call targets. [Long-running.]

Open a Windows minidump, ELF or Mach-O core, or region-set manifest; returns its id. view=summary: OS, process, exception, .NET state; other views page rows. [Long-running.]

Assemble x86/x64 instructions and write them at a native address in memory. Safety rules and undo as patch_bytes; PE absolute addresses get relocations. Warnings as patch_bytes. [Long-running.]

Replace bytes at a native address in memory as an undoable edit. Unsafe sites need allowUnsafe; encrypted bytes are refused; signatures become invalid. Warnings (writable_executable_section, high_entropy_section, signature_invalidated) name the site and the file. [Long-running.]

Replace a method, constructor or accessor body with C# compiled against the assembly; private members are accessible. Errors name your lines. [Long-running.]

Rewrite a method body from IL text, stack-validated: edit the get_il lines and pass them back (syntax: guide edits).

Copy one device file (not a directory) to outputPath with its size and SHA-256; a failed pull leaves nothing. [Long-running.]

Copy every APK of an installed package (base and splits) into a new or empty directory, with sizes and SHA-256. A failed pull leaves no files. [Long-running.]

Device log (logcat -d), newest lines first, by buffer, process, tag, priority and start time.

Hex dump of native image bytes at an address as the loader maps them; uninitialized bytes show as ??. type= reads values instead; get_native_type read=true reads structs.

Hex dump of a dump's memory at an address, with its module, captured range and protection. Bytes the dump lacks come from the module image (writable data: initial values) unless dumpOnly.

Page, search or save a kept result (r-..., kept 7 days). format=evidence bundles results and their calls into outputPath; format=verify re-runs a bundle or result, or compares it with against.

Start IDA or Ghidra auto-analysis over an image or range in the background and save; completes a cut-short analysis. analyzers=true lists the options. [Long-running.]

Record a finding, question, hypothesis or todo on a native address, .NET member, file or dump. Notes persist per user and follow the binary by SHA-256 or MVID.

Re-read an assembly from disk (after an update or an overwriting save), discarding unsaved edits.

Move every type of a namespace (optionally its sub-namespaces) to a new namespace, in memory.

Name a native address for every native tool and the engines; kept per file and undoable. Letters, digits, _ $ @, up to 255 chars; empty clears. items: many in one push. [Long-running.]

Rename a type, method, field, property (and accessors) or event in memory; other assemblies keep the old name.

What a native address is: RVA, VA, file offset, section, nearest symbol, source line; with the code index, its function, instruction or data item, references. Reads PDB, DWARF, AOT metadata where present. [Long-running.]

Resolve targets of call and tail-jump sites, indirect ones too, with basis and confidence. An unresolved site names its reason and the trace_native_values call to follow. engine= merges that engine's targets. [Long-running.]

Every match of a symbol string or token, with kind, assembly, token and signature; disambiguates before other calls.

Discard every unsaved edit of an assembly; resultId keeps them as a script (read_result outputPath=, then apply_edits).

Write an assembly and its edits to a new file, atomically; a file changed since load is refused. Members the writer changed are listed with reason codes (docs/saving.md).

Write the patched native image to a new file; the PE checksum is recomputed and a signature becomes invalid. replaceOriginal=true keeps a .bak and refuses a file changed on disk. Warnings as patch_bytes; stripSignature=true drops signature_invalidated. [Long-running.]

Save loaded files, .NET edits, native patches, names, comments, notes and open dumps to one JSON file; load_session restores it.

Find a hex or text pattern in the mapped sections of a native image: VA, section and file offset per hit. memory=engine searches the engine's loaded bytes.

Find a byte pattern with ?? wildcards (make_code_pattern's format except yara) in the executable sections of loaded native images, with each hit's function and offset. [Long-running.]

Find a number (magic, opcode id, flag, crypto constant) in IL literals, const and enum values, attribute arguments and static arrays.

Find managed types and members by name in a container or assembly, without extracting. Other kinds: paths, pcap packets, endpoints, capture requests, JS features, YARA rules, locked packages, incident lists.

Search the IDA or Ghidra pseudocode of every function, line by line, in address order. Stops at maxFunctions, timeoutSeconds or limit hits; continue with nextOffset. [Long-running.]

Search DEX code for strings (literals and decoder results), types, methods, fields, numeric constants or opcodes, with method and offset per use. [Long-running.]

Find methods with an IL instruction sequence: ;-separated opcode [operand] elements with * and ? wildcards (operands match names, strings, numbers); ... skips up to 16 instructions, e.g. "ldstr *password*; ...; call *::Hash*".

Find instructions by mnemonic, operand or line regex (case-insensitive), or by operand value, in all functions, one function or an address range. A page the scan budget stopped continues at nextOffset. [Long-running.]