NativeDisassembler

Namespace: Dotsider.Core.Analysis.Disasm

Assembly: Dotsider.Core.dll

Disassembles a native code window into NativeInstructions and a rendered listing, dispatching to the architecture-specific decoders. The listing mirrors the IL disassembly shape (IlDisassembler.DisassembleWithText): an optional header, then one line per instruction, loc_…: labels for intra-function targets, and each rendered line’s column spans recorded on Layout so the TUI decorates structurally. Call/branch/data targets are resolved to names through a NativeSymbolResolver. A byte the decoder cannot recognize renders as an exact-width .byte/.word safety net that never desyncs the listing.

public static class NativeDisassembler

Inheritance

Object → NativeDisassembler

Methods

Disassemble(ReadOnlySpan<byte>, ulong, NativeArchitecture, NativeSymbolResolver?)

Decodes a code window into instructions, resolving call/branch/data targets to names and synthesizing labels for intra-window targets.

Parameters:

• code (ReadOnlySpan<Byte>): The exact code bytes of the region to disassemble.
• baseAddress (UInt64): The virtual address the first byte maps to.
• arch (NativeArchitecture): The instruction-set architecture to decode as.
• resolver (NativeSymbolResolver): Resolves a target address to a symbol name, or null for no naming.

Returns: IReadOnlyList<NativeInstruction>

public static IReadOnlyList<NativeInstruction> Disassemble(ReadOnlySpan<byte> code, ulong baseAddress, NativeArchitecture arch, NativeSymbolResolver? resolver = null)

DisassembleSymbol(AssemblyAnalyzer, NativeSymbol, Func<ulong, string?>?)

NativeSymbol) with correlation-aware target naming: managedNameResolver is consulted before the symbol and import resolvers, so a call target resolves to its pre-ILC companion-backed managed name when one exists. The two-argument overload is preserved as shipped public API and delegates here with a null resolver.

Parameters:

• analyzer (AssemblyAnalyzer): The analyzer that recovered the symbol.
• symbol (NativeSymbol): The symbol to disassemble.
• managedNameResolver (Func<UInt64, String>): Maps a target virtual address to a managed display name, or null for none.

Returns: Nullable<String, NativeInstruction>, Int32>>

public static (string Text, IReadOnlyList<NativeInstruction> Instructions, int HeaderLineCount)? DisassembleSymbol(AssemblyAnalyzer analyzer, NativeSymbol symbol, Func<ulong, string?>? managedNameResolver)

DisassembleSymbol(AssemblyAnalyzer, NativeSymbol)

The convenience the view, CLI, MCP, and session share: disassembles one recovered native symbol from its owning analyzer. It slices the symbol’s bytes, takes the architecture from the recovered symbol info (the real selected slice), resolves call/branch/ data targets through the other symbols, stamps each instruction’s source location from the symbol info’s source map, and renders a header with the symbol name and its file:line. Returns null when the symbol has no file-backed bytes or the architecture is unknown.

Parameters:

• analyzer (AssemblyAnalyzer): The analyzer that recovered the symbol.
• symbol (NativeSymbol): The symbol to disassemble.

Returns: Nullable<String, NativeInstruction>, Int32>>

public static (string Text, IReadOnlyList<NativeInstruction> Instructions, int HeaderLineCount)? DisassembleSymbol(AssemblyAnalyzer analyzer, NativeSymbol symbol)

DisassembleWithText(ReadOnlySpan<byte>, ulong, NativeArchitecture, string?, NativeSymbolResolver?)

Disassembles a code window and renders it to text, returning the text, the instruction list (each carrying its 1-based DisplayLine and Layout), and the header line count.

Parameters:

• code (ReadOnlySpan<Byte>): The exact code bytes of the region to disassemble.
• baseAddress (UInt64): The virtual address the first byte maps to.
• arch (NativeArchitecture): The instruction-set architecture to decode as.
• header (String): Optional header lines (without a trailing blank), or null.
• resolver (NativeSymbolResolver): Resolves a target address to a symbol name, or null for no naming.

Returns: ValueTuple<String, NativeInstruction>, Int32>

public static (string Text, IReadOnlyList<NativeInstruction> Instructions, int HeaderLineCount) DisassembleWithText(ReadOnlySpan<byte> code, ulong baseAddress, NativeArchitecture arch, string? header = null, NativeSymbolResolver? resolver = null)

FindExecutableSymbols(NativeSymbolInfo, string)

Resolves a disassembly target — a hex/decimal virtual address or a symbol name — to the matching executable symbols, so callers report an exact hit, an ambiguity, or a miss the same way. A hex 0x… or decimal address resolves through the containing symbol; a name prefers an exact managed-name match, then the raw symbol name, then a suffix match.

Parameters:

• info (NativeSymbolInfo): The recovered native symbols.
• target (String): The address or name to resolve.

Returns: IReadOnlyList<NativeSymbol>

public static IReadOnlyList<NativeSymbol> FindExecutableSymbols(NativeSymbolInfo info, string target)