disassembly（disassembly 搜索）

Trigger Intents

Use this skill when user asks for:

• Function/segment/instruction inspection
• Call-site or control-flow analysis from disassembly
• Operand formatting and low-level code structure
• Raw byte/instruction-level evidence

Route to:

• decompiler for AST/pseudocode semantics
• xrefs for relationship-heavy caller/callee workflows
• debugger for patching/breakpoint actions

Do This First (Warm-Start Sequence)

-- 1) Orientation
SELECT * FROM welcome;

-- 2) Segment map
SELECT name, printf('0x%X', start_ea) AS start_ea, printf('0x%X', end_ea) AS end_ea, perm
FROM segments
ORDER BY start_ea;

-- 3) Largest functions (triage anchors)
SELECT name, printf('0x%X', address) AS addr, size
FROM funcs
ORDER BY size DESC
LIMIT 20;

Interpretation guidance:

• Start from executable segments and largest/highly connected functions.
• Use func_addr constraints early when querying instruction-heavy surfaces.

Failure and Recovery

• Slow queries on instructions/heads:

- Add WHERE func_addr = X or tight EA ranges.

• Missing expected symbol names:

- Pivot to address-based workflows and enrich via names updates later.

• Ambiguous control-flow behavior:

- Cross-check with disasm_calls and then escalate to decompiler.

Handoff Patterns

1. disassembly -> xrefs for relation expansion.
2. disassembly -> decompiler for semantic interpretation.
3. disassembly -> debugger for patch/breakpoint execution.

Entity Tables

funcs

All detected functions in the binary with prototype information.

Prototype columns (populated when type info available):

-- 10 largest functions
SELECT name, size FROM funcs ORDER BY size DESC LIMIT 10;

-- Functions starting with "sub_" (auto-named, not analyzed)
SELECT name, printf('0x%X', address) as addr FROM funcs WHERE name LIKE 'sub_%';

-- Functions returning integers with 3+ arguments
SELECT name, return_type, arg_count FROM funcs
WHERE return_is_integral = 1 AND arg_count >= 3;

Write operations:

-- Create a function
INSERT INTO funcs (address) VALUES (0x401000);

-- Rename a function
UPDATE funcs SET name = 'my_func' WHERE address = 0x401000;

-- Delete a function
DELETE FROM funcs WHERE address = 0x401000;

segments

Memory segments. Supports INSERT, UPDATE (name, class, perm), and DELETE.

-- Find executable segments
SELECT name, printf('0x%X', start_ea) as start FROM segments WHERE perm & 1 = 1;

-- Rename a segment
UPDATE segments SET name = '.mytext' WHERE start_ea = 0x401000;

names

All named locations (functions, labels, data). Supports INSERT, UPDATE, and DELETE.

-- Create/set a name
INSERT INTO names (address, name) VALUES (0x401000, 'my_symbol');

-- Rename
UPDATE names SET name = 'my_symbol_renamed' WHERE address = 0x401000;

entries

Entry points (exports, program entry, tls callbacks, etc.).

Instruction Tables

instructions

instructions is the disassembly table. For scalar disassembly text at a specific EA, use disasm_at(ea[, context]). Use disasm_func() or disasm_range() when you explicitly need a function/range listing. Decoded instructions support DELETE (converts instruction to unexplored bytes) and operand representation updates via operand*_format_spec.

WHERE func_addr = X is the fast path (function-item iterator). Without it, the table scans all code heads.

-- Instruction profile of a function (FAST)
SELECT mnemonic, COUNT(*) as count
FROM instructions WHERE func_addr = 0x401330
GROUP BY mnemonic ORDER BY count DESC;

-- Find all call instructions in a function
SELECT address, disasm FROM instructions
WHERE func_addr = 0x401000 AND mnemonic = 'call';

-- Apply enum representation to operand 1
UPDATE instructions
SET operand1_format_spec = 'enum:MY_ENUM'
WHERE address = 0x401020;

-- Clear representation back to plain
UPDATE instructions
SET operand1_format_spec = 'clear'
WHERE address = 0x401020;

Performance: WHERE func_addr = X uses O(function_size) iteration. Without this constraint, it scans the entire database.

disasm_calls

All call instructions with resolved targets.

-- Functions that call malloc
SELECT DISTINCT func_at(func_addr) as caller
FROM disasm_calls WHERE callee_name LIKE '%malloc%';

blocks

Basic blocks within functions. Use func_ea constraint for performance.

-- Blocks in a specific function (FAST - uses constraint pushdown)
SELECT * FROM blocks WHERE func_ea = 0x401000;

-- Functions with most basic blocks
SELECT func_at(func_ea) as name, COUNT(*) as blocks
FROM blocks GROUP BY func_ea ORDER BY blocks DESC LIMIT 10;

cfg_edges

Control flow graph edges between basic blocks. Always use WHERE func_ea = X (filter_eq pushdown, O(blocks in function)).

-- Get CFG structure
SELECT * FROM cfg_edges WHERE func_ea = 0x401000;

-- Find branch points (conditional blocks)
SELECT from_block, COUNT(*) as succ_count
FROM cfg_edges WHERE func_ea = 0x401000
GROUP BY from_block HAVING succ_count > 1;

-- Find merge points (blocks with multiple predecessors)
SELECT to_block, COUNT(*) as pred_count
FROM cfg_edges WHERE func_ea = 0x401000
GROUP BY to_block HAVING pred_count > 1;

-- Function complexity ranking: combine CFG, loops, and call metrics
SELECT f.name, f.size,
       (SELECT COUNT(*)
        FROM (
            SELECT ce.from_block
            FROM cfg_edges ce
            WHERE ce.func_ea = f.address
            GROUP BY ce.from_block
            HAVING COUNT(*) > 1
        ) branch_blocks) as branch_sites,
       (SELECT COUNT(*) FROM disasm_loops dl WHERE dl.func_addr = f.address) as loops,
       (SELECT COUNT(*) FROM disasm_calls dc WHERE dc.func_addr = f.address) as calls_made
FROM funcs f
WHERE f.size > 32
ORDER BY branch_sites DESC
LIMIT 20;

function_chunks

Cached table with one row per function chunk. Aggregate by func_addr when you need function-level span or density metrics.

SELECT * FROM function_chunks WHERE func_addr = 0x401000;

SQL Functions -- Disassembly

Disassembly Examples

-- Canonical single-EA disassembly (safe for code or data)
SELECT disasm_at(0x401000);

-- Canonical context window (+/- 2 heads)
SELECT disasm_at(0x401000, 2);

-- Full function disassembly (resolves boundaries via get_func)
SELECT disasm_func(address) FROM funcs WHERE name = '_main';

-- Disassemble a specific address range
SELECT disasm_range(0x401000, 0x401100);

-- Sliding window: next 5 instructions from an address
SELECT disasm(0x401000, 5);

SQL Functions -- Names & Functions

Address argument note: addr/ea/func_addr parameters accept integer EAs, numeric strings, and symbol names.

SQL Functions -- Navigation

SQL Functions -- Item Analysis

SQL Functions -- Instruction Details

SQL Functions -- File Generation

SQL Functions -- Graph Generation

-- Get CFG for a function as DOT format
SELECT gen_cfg_dot(0x401000);

Performance Rules

Key rules:

• funcs is always fast -- no constraint needed.
• instructions without func_addr scans every code head -- use func_addr for per-function queries.
• blocks without func_ea iterates all functions' flowcharts -- always constrain.
• heads is the largest table in most databases. Always filter by address range.

Cost model:

funcs (full scan)            -> O(func_qty()), typically ~1000s, fast
instructions WHERE func_addr -> O(function_size / avg_insn_size)
instructions (no constraint) -> O(total_code_heads), potentially 100K+
blocks WHERE func_ea         -> O(block_count_in_func), fast
cfg_edges WHERE func_ea      -> O(block_count_in_func), fast
disasm_calls WHERE func_addr -> O(instructions_in_func), streaming

Additional Resources

• For advanced CTE patterns and instruction lifecycle playbooks: references/disassembly-examples.md
• For additional table schemas (fchunks, heads, bytes, signatures, problems, fixups, etc.): references/disassembly-tables.md