StellaOps.BinaryIndex.Disassembly.Abstractions

Abstraction over binary disassembly engine plugins. Each plugin implements this interface to provide disassembly capabilities.

Gets the capabilities of this disassembly plugin.

Loads a binary from a stream and detects format/architecture.

The binary stream to load. Optional hint for architecture detection. Optional hint for format detection. Binary information including format, architecture, and metadata.

Loads a binary from a byte array.

The binary data. Optional hint for architecture detection. Optional hint for format detection. Binary information including format, architecture, and metadata.

Gets executable code regions (sections) from the binary.

The loaded binary information. Enumerable of code regions.

Gets symbols (functions) from the binary.

The loaded binary information. Enumerable of symbol information.

Disassembles a code region to instructions.

The loaded binary information. The code region to disassemble. Enumerable of disassembled instructions.

Disassembles starting at a specific address for a given length.

The loaded binary information. Virtual address to start disassembly. Maximum number of bytes to disassemble. Enumerable of disassembled instructions.

Disassembles a specific symbol/function.

The loaded binary information. The symbol to disassemble. Enumerable of disassembled instructions.

Registry for disassembly plugins. Manages plugin discovery and selection.

Gets all registered plugins.

Finds the best plugin for the given architecture and format.

Target CPU architecture. Target binary format. The best matching plugin, or null if none found.

Finds all plugins that support the given architecture.

Target CPU architecture. All matching plugins ordered by priority.

Finds all plugins that support the given format.

Target binary format. All matching plugins ordered by priority.

Gets a plugin by its unique identifier.

The plugin identifier. The plugin if found, null otherwise.

Facade service for disassembly operations. Automatically selects the best plugin.

Loads a binary and automatically selects the best plugin.

The binary stream to load. Optional preferred plugin ID. Binary information and the plugin used.

Loads a binary from bytes and automatically selects the best plugin.

The binary data. Optional preferred plugin ID. Binary information and the plugin used.

Gets the plugin registry.

Binary executable format.

Unknown format.

Raw binary data (no format metadata).

Executable and Linkable Format (Linux, BSD, etc.).

Portable Executable (Windows).

Mach-O (macOS, iOS).

WebAssembly module.

Information about a loaded binary.

Binary format: ELF, PE, MachO, etc. CPU architecture. 32 or 64 bit. Byte order. Application binary interface hint (gnu, musl, msvc, darwin). Entry point address if available. Build identifier if present (e.g., GNU build-id). Additional metadata from the binary. Internal handle for the disassembly engine (engine-specific).

Information about a loaded binary.

Binary format: ELF, PE, MachO, etc.

CPU architecture.

32 or 64 bit.

Byte order.

Application binary interface hint (gnu, musl, msvc, darwin).

Entry point address if available.

Build identifier if present (e.g., GNU build-id).

Additional metadata from the binary.

Internal handle for the disassembly engine (engine-specific).

Represents a code region (section) in a binary.

Section name: .text, .rodata, etc. Virtual address in memory. Offset in the binary file. Size in bytes. Whether the region contains executable code. Whether the region is readable. Whether the region is writable.

Represents a code region (section) in a binary.

Section name: .text, .rodata, etc.

Virtual address in memory.

Offset in the binary file.

Size in bytes.

Whether the region contains executable code.

Whether the region is readable.

Whether the region is writable.

CPU architecture identifier.

Unknown architecture.

Intel/AMD 32-bit x86.

Intel/AMD 64-bit x86-64 (amd64).

ARM 32-bit (ARMv7).

ARM 64-bit (AArch64/ARMv8).

MIPS 32-bit.

MIPS 64-bit.

RISC-V 64-bit.

PowerPC 32-bit.

PowerPC 64-bit.

SPARC.

SuperH SH4.

AVR microcontroller.

Ethereum Virtual Machine.

WebAssembly.

A disassembled instruction.

Virtual address of the instruction. Raw bytes of the instruction. Instruction mnemonic (e.g., MOV, ADD, JMP). Text representation of operands. Classification of the instruction. Parsed operands.

A disassembled instruction.

Virtual address of the instruction. Raw bytes of the instruction. Instruction mnemonic (e.g., MOV, ADD, JMP). Text representation of operands. Classification of the instruction. Parsed operands.

Virtual address of the instruction.

Raw bytes of the instruction.

Instruction mnemonic (e.g., MOV, ADD, JMP).

Text representation of operands.

Classification of the instruction.

Parsed operands.

Describes the capabilities of a disassembly plugin.

The unique identifier of the plugin.

Display name of the disassembly engine.

Version of the underlying disassembly library.

Supported CPU architectures.

Supported binary formats.

Whether the plugin supports lifting to intermediate representation.

Whether the plugin supports control flow graph recovery.

Priority for plugin selection when multiple plugins support the same arch/format. Higher values indicate higher priority.

Checks if this plugin supports the given architecture.

Checks if this plugin supports the given format.

Checks if this plugin can handle the given architecture and format combination.

Byte order.

Little-endian (LSB first).

Big-endian (MSB first).

Classification of instruction types.

Unknown or unclassified instruction.

Arithmetic operation (ADD, SUB, MUL, DIV).

Logical operation (AND, OR, XOR, NOT).

Data movement (MOV, PUSH, POP).

Memory load operation.

Memory store operation.

Unconditional branch (JMP).

Conditional branch (JE, JNE, JL, etc.).

Function call.

Function return.

No operation.

System call.

Software interrupt.

Compare operation.

Shift operation.

Vector/SIMD operation.

Floating point operation.

An instruction operand.

Operand type. Text representation. Immediate value if applicable. Register name if applicable. Base register for memory operand. Index register for memory operand. Scale factor for indexed memory operand. Displacement for memory operand.

An instruction operand.

Operand type.

Text representation.

Immediate value if applicable.

Base register for memory operand.

Index register for memory operand.

Scale factor for indexed memory operand.

Displacement for memory operand.

Type of operand.

Unknown operand type.

CPU register.

Immediate value.

Memory reference.

Address/label.

Information about a symbol in the binary.

Symbol name. Virtual address of the symbol. Size in bytes (0 if unknown). Symbol type. Symbol binding. Section containing the symbol.

Information about a symbol in the binary.

Symbol name. Virtual address of the symbol. Size in bytes (0 if unknown). Symbol type. Symbol binding. Section containing the symbol.

Symbol name.

Virtual address of the symbol.

Size in bytes (0 if unknown).

Symbol type.

Symbol binding.

Section containing the symbol.

Type of symbol.

Unknown or unspecified type.

Function/procedure.

Data object.

Section symbol.

Source file name.

Common block symbol.

Thread-local storage.

Symbol binding/visibility.

Unknown binding.

Local symbol (not visible outside the object).

Global symbol (visible to other objects).

Weak symbol (can be overridden).