Dotsider.Core.Analysis.Disasm

Classes

NativeDisassembler

Disassembles a native code window into NativeInstructions and a rendered listing, dispatching to the architecture-specific decoders. The listing mirrors the IL disassembly shape (IlDisassembler.DisassembleWithText): an optional header, then one line per instruction, loc_…: labels for intra-function targets, and each rendered line’s column spans recorded on Layout so the TUI decorates structurally. Call/branch/data targets are resolved to names through a NativeSymbolResolver. A byte the decoder cannot recognize renders as an exact-width .byte/.word safety net that never desyncs the listing.

public static class NativeDisassembler

NativeImportResolver

Resolves an indirect call/branch target that lands on an import slot to the imported symbol name, so a call [rip+disp] through the PE Import Address Table renders as KERNEL32!GetProcAddress, an ELF PLT stub jumping through its GOT slot renders as the bound dynamic symbol, and a Mach-O stub renders as its imported symbol — rather than an unresolved address. Built once per image, it maps each import slot’s virtual address to its name. NativeSymbolRef%40) composes after the symbol resolver in NativeSymbol).

public sealed class NativeImportResolver

Structs

NativeSymbolName

Splits a recovered managed name (as joined by the native symbol reader, e.g. System.Text.StringBuilder.Append(char)) into its namespace, declaring type, and member, so the native IL-inspector tree can bucket functions the same namespace → type → method way the managed tree does. The parse is signature-aware (it ignores the parameter list) and handles nested types (+) and generic arity markers.

public readonly record struct NativeSymbolName : IEquatable<NativeSymbolName>

Delegates

NativeSymbolResolver

Resolves a code or data virtual address to the symbol that contains it, so the disassembler can name call/branch/data targets. Returns false when no symbol covers the address. The out Offset lets the caller render Name+0x{offset} for a target that lands inside a symbol rather than at its start.

Parameters:

• virtualAddress (UInt64): The target virtual address to resolve.
• symbol (NativeSymbolRef): The containing symbol reference when found.

Returns: Boolean

True when a symbol contains virtualAddress; otherwise false.

public delegate bool NativeSymbolResolver(ulong virtualAddress, out NativeSymbolRef symbol)