Native 分析 MCP 工具

这一组工具覆盖 SO 缓存、ELF 元数据、符号/字符串/重定位、JNI 映射、反汇编与反编译、图分析、运行时内存、跟踪、快照和 unidbg 仿真。

当前源码在这一组注册了 68 个工具。新增的运行时检查、内存范围/扫描、运行时地址解析、直接引用扫描、生命周期入口、目标导向调查和窗口反汇编等能力也包含在本页中。工具名大小写敏感；调用参数以本页表格和 MCP 客户端实时拿到的 input schema 为准。

使用前先知道

• 所有工具都通过 ScriptX 设置页启动的内置 MCP 服务暴露，不是脚本侧的 mcpServer 对象。
• 所有返回值至少包含 ok、message、result。不要只判断 HTTP 状态码。
• 带 projectDir 的分析工具通常要求先在 ScriptX 中缓存 APK，并使用 get_analysis_state / list_apk_workspaces 得到的真实工作区名。
• 安装、卸载、停止运行时和恢复备份等有副作用的工具，必须按参数表显式传入 confirm: true。

analyze_native

Run the available built-in ELF and symbol analysis for one cached SO and persist the analysis revision. This is synchronous and bounded.

显示名称：Analyze native library

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"analyze_native","arguments":{"projectDir":"project_xxx","nativeId":"sha256"}}

audit_native_security

Produce an evidence-backed static hardening audit for NX, RELRO, stack canaries, FORTIFY, text relocations, runtime search paths, and risky imports.

显示名称：Audit native security

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"audit_native_security","arguments":{"projectDir":"project_xxx","nativeId":"sha256"}}

calculate_native_hashes

Calculate MD5, SHA-1, SHA-256, CRC32, and byte size from the verified read-only SO copy. SHA-256 must match nativeId.

显示名称：Calculate native hashes

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"calculate_native_hashes","arguments":{"projectDir":"project_xxx","nativeId":"sha256"}}

clear_native_workspace

Delete only the reproducible extracted SO copy and close its deep-analysis session. The cached APK, Dex/Smali index, native entry index, and original APK bytes are retained. Requires confirm=true.

显示名称：Clear native analysis workspace

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
confirm	boolean	是	仅 true	Must be true after reviewing the deletion scope.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"clear_native_workspace","arguments":{"projectDir":"project_xxx","nativeId":"sha256","confirm":true}}

close_native_session

Close the Radare2 process for one SO while retaining all APK, index, and prepared native cache data. A later deep request opens a fresh session.

显示名称：Close native deep-analysis session

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"close_native_session","arguments":{"projectDir":"project_xxx","nativeId":"sha256"}}

compare_native_memory_snapshots

Compare two stages from one snapshot session or two compatible sessions. Executable bytes are aligned by process and ELF virtual address, while relocation changes report pointer, module, module-relative offset, and symbol evidence. Results are bounded and are not vulnerability claims.

显示名称：Compare runtime native memory snapshot stages

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace used by both snapshot sessions.
baselineSessionId	string	是	-	Snapshot session used as the baseline.
baselineStageSequence	number	否	>= 0；默认 1	Baseline stage number. Default 1; zero selects its latest completed stage.
comparisonSessionId	string	否	-	Optional second session. Blank compares another stage in the baseline session.
comparisonStageSequence	number	否	>= 0	Comparison stage number. Default zero selects the latest completed stage.
includeBytePreviews	boolean	否	true / false	Include at most 64 baseline and comparison bytes as hex for each returned range.
maxDifferences	number	否	<= 500；默认 100	Shared detail limit for changed, missing, and relocation ranges. Default 100, maximum 500.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"compare_native_memory_snapshots","arguments":{"projectDir":"project_xxx","baselineSessionId":"uuid","baselineStageSequence":1,"comparisonStageSequence":3}}

decompile_native_function

Return bounded C-like pseudocode from the deep engine for one function. Treat the output as a hypothesis and verify important statements against disassembly and xrefs.

显示名称：Decompile native function

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
function	string	是	-	Exact function name, demangled name, or virtual address.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"decompile_native_function","arguments":{"projectDir":"project_xxx","nativeId":"sha256","function":"Java_com_example_Native_run"}}

disassemble_native

Run bounded ARM or ARM64 static analysis and return structured instructions for one function. Use a symbol name or virtual address; results are paginated by instruction index.

显示名称：Disassemble native function

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
function	string	是	-	Exact function name, demangled name, or virtual address.
cursor	string	否	-	Opaque instruction cursor returned by the previous page.
limit	number	否	最小 1；最大 1000	Instruction page size. Default 100, maximum 1000.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"disassemble_native","arguments":{"projectDir":"project_xxx","nativeId":"sha256","function":"JNI_OnLoad","limit":100}}

disassemble_native_window

Disassemble a bounded executable byte window without requiring Radare2 to recover a containing function first. Use this for stripped SO addresses and exact instruction context.

显示名称：Disassemble native address window

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
address	string	是	-	ELF virtual address or SO file offset.
addressKind	string	否	可填：auto、vaddr、paddr	Address coordinate. Defaults to auto.
instructionMode	string	否	可填：auto、arm、thumb	Use auto except for ambiguous ARM32 code, where arm or thumb can be selected.
stopAtSymbolBoundary	boolean	否	true / false；默认 true	When true, cap the window at the end of a containing sized ELF function symbol. Defaults to true.
maxBytes	number	否	最小 1；最大 16384	Byte window. Default 4096, maximum 16384.
maxInstructions	number	否	最小 1；最大 1000	Maximum decoded instructions. Default 200, maximum 1000.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"disassemble_native_window","arguments":{"projectDir":"project_xxx","nativeId":"sha256","address":"0x1234","addressKind":"vaddr","instructionMode":"auto","stopAtSymbolBoundary":true,"maxBytes":4096,"maxInstructions":200}}

find_native_control_flow_path

Find a bounded static inter-function path between two functions. This is useful for tracing JNI entry points toward sensitive APIs, but it is not a proof of runtime reachability.

显示名称：Find native call path

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
source	string	是	-	Source function name or virtual address.
target	string	是	-	Target function name or virtual address.
maxDepth	number	否	<= 30；默认 12	Maximum call depth. Default 12, maximum 30.
maxNodes	number	否	<= 10000；默认 2000	Maximum explored nodes. Default 2000, maximum 10000.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"find_native_control_flow_path","arguments":{"projectDir":"project_xxx","nativeId":"sha256","source":"JNI_OnLoad","target":"system","maxDepth":12}}

find_native_dynamic_jni_bindings

Decode relocation-backed JNINativeMethod tables, resolve proven executable fnPtr targets, and correlate table xrefs and cached Dex native declarations. Falls back to RegisterNatives/string evidence when a table cannot be decoded.

显示名称：Find dynamic JNI bindings

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
maxStringBytes	number	否	<= 67108864；默认 16777216	Maximum bytes dereferenced or scanned for JNI strings. Default 16777216, maximum 67108864.
maxTableBytes	number	否	<= 67108864；默认 33554432	Maximum alloc-data section bytes scanned for JNINativeMethod triples. Default 33554432, maximum 67108864.
maxEntries	number	否	<= 5000；默认 1000	Maximum decoded table entries. Default 1000, maximum 5000.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"find_native_dynamic_jni_bindings","arguments":{"projectDir":"project_xxx","nativeId":"sha256","maxEntries":1000}}

find_native_jni_bindings

Match exported Java_ JNI symbols against native methods already indexed in the cached Dex workspace, and report JNI_OnLoad evidence for possible dynamic registration.

显示名称：Find native JNI bindings

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"find_native_jni_bindings","arguments":{"projectDir":"project_xxx","nativeId":"sha256"}}

get_native_analysis_state

Return preparation status, analysis level, engine identity, revision, and the last native analysis error.

显示名称：Get native analysis state

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_analysis_state","arguments":{"projectDir":"project_xxx","nativeId":"sha256"}}

get_native_call_graph

Build a bounded static inter-function call graph. Set rootFunction to focus on a reachable subgraph; omit it for a global function graph.

显示名称：Get native call graph

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
rootFunction	string	否	-	Optional function name or virtual address used as graph root.
maxDepth	number	否	<= 20；默认 5	Reachability depth. Default 5, maximum 20.
maxNodes	number	否	<= 2000；默认 500	Maximum graph nodes. Default 500, maximum 2000.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_call_graph","arguments":{"projectDir":"project_xxx","nativeId":"sha256","rootFunction":"JNI_OnLoad","maxDepth":5,"maxNodes":500}}

get_native_capabilities

Return the native analysis features that are actually available in this build. Call this before requesting deep analysis.

显示名称：Native analysis capabilities

参数：无。

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_capabilities","arguments":{}}

get_native_control_flow

Return the bounded intra-function basic-block graph for one analyzed function, including jump, fail, and switch edges. This is distinct from the inter-function call path tool.

显示名称：Get native function control flow

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
function	string	是	-	Exact function name, demangled name, or virtual address.
instructionMode	string	否	可填：auto、arm、thumb	Use auto for symbols and non-ARM ELF. For an ARM32 address fallback, arm or thumb can be selected.
allowAddressFallback	boolean	否	true / false；默认 true	Create a temporary Radare2 function at a raw executable address when full analysis did not recover one. Defaults to true.
outputMode	string	否	可填：full、summary	full returns blocks and edges; summary returns bounded previews and counts.
maxBlocks	number	否	最小 1；最大 5000	Maximum returned basic blocks. Default 1000, maximum 5000.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_control_flow","arguments":{"projectDir":"project_xxx","nativeId":"sha256","function":"0x1234","instructionMode":"auto","allowAddressFallback":true,"outputMode":"summary","maxBlocks":1000}}

get_native_cpp_model

Reconstruct a bounded C++ view from demangled functions and vtable-like symbols, including classes, methods, namespaces, and vtable addresses.

显示名称：Get native C++ model

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
query	string	否	-	Optional class or demangled method substring.
maxClasses	number	否	<= 1000；默认 200	Maximum returned classes. Default 200, maximum 1000.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_cpp_model","arguments":{"projectDir":"project_xxx","nativeId":"sha256","query":"Crypto","maxClasses":200}}

get_native_dependencies

Return the ELF SONAME, DT_NEEDED libraries, and declared runtime search paths without requiring the caller to page through dynamic entries.

显示名称：Get native dependencies

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_dependencies","arguments":{"projectDir":"project_xxx","nativeId":"sha256"}}

get_native_dependency_graph

Build a bounded ABI-aware graph from each SO's DT_NEEDED entries. APK targets are resolved by file name or SONAME and every edge is labeled RESOLVED, AMBIGUOUS, EXTERNAL, SKIPPED_BUDGET, or ERROR.

显示名称：Get APK native dependency graph

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace name, for example project_xxx.
abi	string	否	-	Optional exact ABI filter such as arm64-v8a.
maxLibraries	number	否	<= 200；默认 50	Maximum SO nodes included. Default 50, maximum 200.
maxTotalBytes	number	否	<= 536870912；默认 268435456	Maximum total SO bytes parsed. Default 268435456 (256 MiB), maximum 536870912.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_dependency_graph","arguments":{"projectDir":"project_xxx","abi":"arm64-v8a","maxLibraries":50}}

get_native_direct_xrefs

Run a bounded function-independent scan for direct call, jump, instruction-data, relocation, and aligned-pointer references to one ELF address. This is useful when functions are stripped or not recovered.

显示名称：Scan direct native references

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
target	string	是	-	Target ELF virtual address or SO file offset.
addressKind	string	否	可填：auto、vaddr、paddr	Target coordinate. Defaults to auto.
instructionMode	string	否	可填：auto、arm、thumb	Use auto except for ARM32 code scans, where arm or thumb should be explicit when the address is ambiguous.
scanKind	string	否	可填：code、data、both	Scan code, data, or both. Defaults to both.
referenceKinds	array	否	数组项可填：call、jump、data	Reference kinds to return. Defaults to call, jump, and data. scanKind=data requires only data.
maxScanBytes	number	否	最小 1；最大 16777216	Maximum code bytes and maximum aligned data bytes scanned in their selected domains. Default 1048576, maximum 16777216.
limit	number	否	最小 1；最大 500	Maximum references returned. Default 100, maximum 500.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_direct_xrefs","arguments":{"projectDir":"project_xxx","nativeId":"sha256","target":"0x1234","addressKind":"vaddr","instructionMode":"auto","scanKind":"both","referenceKinds":["call","jump","data"],"maxScanBytes":1048576,"limit":100}}

get_native_elf

Return normalized ELF information including header, program headers, sections, dynamic entries, dependencies, init/fini metadata, and security properties.

显示名称：Get native ELF information

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
view	string	否	可填：header、program_headers、sections、dynamic、dependencies、init_fini、security	ELF view: header, program_headers, sections, dynamic, dependencies, init_fini, or security. Defaults to header.
cursor	string	否	-	Opaque cursor for large program/section lists.
limit	number	否	最小 1；最大 200	Page size for lists. Default 100, maximum 200.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_elf","arguments":{"projectDir":"project_xxx","nativeId":"sha256","view":"header"}}

get_native_emulation_backend_job

Return installation or removal progress for an unidbg backend jobId. Progress, stage, and message come from the existing Ubuntu job system.

显示名称：Get native emulation backend job

参数

参数	类型	必填	可填值 / 范围	说明
jobId	string	是	-	Job identifier returned by install_native_emulation_backend or uninstall_native_emulation_backend.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_emulation_backend_job","arguments":{"jobId":"..."}}

get_native_emulation_status

Probe the optional Ubuntu-hosted unidbg Unicorn2 worker. This checks the bundled worker protocol, Java runtime, host architecture, and backend health without running a cached SO.

显示名称：Get native emulation backend status

参数

参数	类型	必填	可填值 / 范围	说明
probe	boolean	否	true / false；默认 true	Run an authoritative Ubuntu health check. Default true. Set false for the last cached state.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_emulation_status","arguments":{"probe":true}}

get_native_emulation_task

Return current progress, bounded stdout/stderr, and the structured unidbg result for taskId. Completed reports survive MCP calls and can be restored after an app process restart while the cached workspace remains.

显示名称：Get native emulation task

参数

参数	类型	必填	可填值 / 范围	说明
taskId	string	是	-	Task identifier returned by start_native_emulation.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_emulation_task","arguments":{"taskId":"emu-..."}}

get_native_function_trace

Return paginated hook-status and completed-call events for one cached native function. Calls include raw ABI integer/floating argument registers, raw return registers, duration, caller evidence, ASLR addresses, and reusable module-relative offsets.

显示名称：Get runtime native function trace

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace used when the trace was started.
sessionId	string	否	-	Session returned by start_native_function_trace. Blank selects the newest workspace session.
cursor	string	否	-	Opaque event cursor returned by the previous page.
limit	number	否	<= 500；默认 100	Events per page. Default 100, maximum 500.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_function_trace","arguments":{"projectDir":"project_xxx","sessionId":"uuid","limit":100}}

get_native_jni_trace

Return paginated real RegisterNatives events and correlate each Java class/name/descriptor and ASLR-normalized fnPtr with cached Dex native declarations, cached SO identities, ABI, and optional v6 decoded JNINativeMethod table evidence.

显示名称：Get runtime JNI registration trace

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace name used when the trace was started.
sessionId	string	否	-	Session returned by start_native_jni_trace. Blank selects the newest session for this workspace.
cursor	string	否	-	Opaque event cursor returned by the previous page.
limit	number	否	<= 500；默认 100	Events per page. Default 100, maximum 500.
includeStaticEvidence	boolean	否	true / false；默认 true	Decode bounded v6 JNINativeMethod table evidence for cached SO candidates. Defaults to true.
maxStaticLibraries	number	否	<= 50；默认 10	Maximum cached SO files decoded for this page. Default 10, maximum 50.
maxStaticBytes	number	否	<= 536870912；默认 134217728	Maximum total cached SO bytes decoded. Default 134217728, maximum 536870912.
maxStringBytesPerLibrary	number	否	<= 33554432；默认 8388608	Maximum string bytes scanned in each SO. Default 8388608, maximum 33554432.
maxTableBytesPerLibrary	number	否	<= 67108864；默认 16777216	Maximum alloc-data bytes scanned in each SO. Default 16777216, maximum 67108864.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_jni_trace","arguments":{"projectDir":"project_xxx","sessionId":"uuid","limit":100,"includeStaticEvidence":true}}

get_native_library

Return normalized ELF identity, cache state, analysis state, and all APK entry paths for one SO.

显示名称：Get native library

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_library","arguments":{"projectDir":"project_xxx","nativeId":"sha256"}}

get_native_load_trace

Return paginated initial-module, dlopen, and android_dlopen_ext events. Each result identifies loader outcome, requested and resolved paths, Android FD metadata, caller module/address, ABI, and correlation with cached APK SO identities.

显示名称：Get runtime native library load trace

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace name used when the trace was started.
sessionId	string	否	-	Session returned by start_native_load_trace. Blank selects the newest session for this workspace.
cursor	string	否	-	Opaque event cursor returned by the previous page.
limit	number	否	<= 500；默认 100	Events per page. Default 100, maximum 500.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_load_trace","arguments":{"projectDir":"project_xxx","sessionId":"uuid","limit":100}}

get_native_memory_snapshot

Return paginated snapshot status, executable-byte comparisons, contiguous modified ranges, function-entry branch-patch indicators, and resolved relocation-slot targets. Findings are evidence for reverse engineering and are not vulnerability claims.

显示名称：Get runtime native memory snapshot

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace used when the snapshot was started.
sessionId	string	否	-	Session returned by start_native_memory_snapshot. Blank selects the newest workspace session.
cursor	string	否	-	Opaque event cursor returned by the previous page.
limit	number	否	<= 200；默认 50	Events per page. Default 50, maximum 200.
includeBytePreviews	boolean	否	true / false；默认 false	Include at most 256 bytes of runtime/reference Base64 per captured item. Defaults to false.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_memory_snapshot","arguments":{"projectDir":"project_xxx","sessionId":"uuid","limit":50}}

get_native_runtime_state

Inspect the cached APK package's injected process and return its PID, ABI, pointer width, and a bounded loaded-module summary. The process must already be running; this tool does not relaunch it.

显示名称：Get native runtime state

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	要检查其已安装应用进程的 APK 工作区。
processName	string	否	-	精确进程名；空值选择主包进程。
waitTimeoutMs	number	否	<= 15000；默认 8000	How long MCP waits for the running process response. Default 8000, maximum 15000. Startup requests use bounded retries; a pending result can be cancelled with stop_native_runtime_operation.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_runtime_state","arguments":{"projectDir":"project_xxx","waitTimeoutMs":8000}}

get_native_xrefs

Return incoming references to, outgoing references from, or both directions around a function or address, with the containing function when Radare2 can resolve it.

显示名称：Get native cross references

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
target	string	是	-	Function name, demangled name, or virtual address.
direction	string	否	可填：to、from、both	to, from, or both. Defaults to both.
cursor	string	否	-	Opaque xref cursor returned by the previous page.
limit	number	否	最小 1；最大 500	Page size. Default 100, maximum 500.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"get_native_xrefs","arguments":{"projectDir":"project_xxx","nativeId":"sha256","target":"0x1234","direction":"both"}}

install_native_emulation_backend

Start installing the bundled ScriptX unidbg 0.9.8 Unicorn2 worker into Ubuntu. The worker JAR is shipped with ScriptX; only an OpenJDK 17 runtime may be downloaded through apt when absent. Returns immediately with a jobId.

显示名称：Install native emulation backend

参数：无。

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"install_native_emulation_backend","arguments":{}}

investigate_native_library

Run one goal-directed, evidence-backed SO investigation by composing the existing Native tools under bounded depth, finding-count, and cooperative time budgets. This is deterministic orchestration, not an embedded AI. Runtime goal never restarts the app or starts Hook/trace sessions automatically.

显示名称：Investigate native library

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
goal	string	否	可填：overview、jni、security、function、behavior、runtime	Investigation objective. Defaults to overview.
target	string	否	-	Function symbol or ELF virtual address. Required when goal=function; optional runtime trace target when goal=runtime.
depth	string	否	可填：quick、standard、deep	quick uses metadata and bounded decoding, standard adds focused deep analysis, and deep adds the most expensive justified stages. Defaults to standard.
instructionMode	string	否	可填：auto、arm、thumb	ARM32 function target mode. Only accepted for goal=function. Defaults to auto.
maxTimeMs	number	否	最小 1000；最大 180000	Cooperative overall time budget checked between stages. Defaults to 15000, 45000, or 90000 by depth; range 1000 to 180000.
maxFindings	number	否	最小 1；最大 100	Maximum evidence-backed findings. Defaults to 25, maximum 100.
retainDeepSession	boolean	否	true / false；默认 false	Keep the Radare2 session for immediate low-level follow-up calls. Defaults to false so the process is released.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"investigate_native_library","arguments":{"projectDir":"project_xxx","nativeId":"sha256","goal":"function","target":"JNI_OnLoad","depth":"standard","maxTimeMs":45000,"maxFindings":25}}

list_native_exports

List globally visible defined ELF symbols exported by this SO. This task-focused view is equivalent to list_native_symbols with scope=exports.

显示名称：List native exports

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
type	string	否	-	Optional ELF symbol type such as FUNC or OBJECT.
query	string	否	-	Optional case-insensitive name substring.
cursor	string	否	-	Opaque cursor returned by the previous page.
limit	number	否	<= 200；默认 100	Page size. Default 100, maximum 200.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"list_native_exports","arguments":{"projectDir":"project_xxx","nativeId":"sha256","query":"JNI_","limit":100}}

list_native_functions

List function and GNU IFUNC symbols ordered by virtual address. This is symbol-derived function metadata; it does not claim to recover stripped functions.

显示名称：List native functions

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
query	string	否	-	Optional case-insensitive function name substring.
includeImports	boolean	否	true / false；默认 false	Include imported PLT/API function symbols. Defaults to false.
cursor	string	否	-	Opaque cursor returned by the previous page.
limit	number	否	<= 200；默认 100	Page size. Default 100, maximum 200.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"list_native_functions","arguments":{"projectDir":"project_xxx","nativeId":"sha256","includeImports":true}}

list_native_imports

List undefined ELF symbols imported by this SO. This task-focused view is equivalent to list_native_symbols with scope=imports.

显示名称：List native imports

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
type	string	否	-	Optional ELF symbol type such as FUNC or OBJECT.
query	string	否	-	Optional case-insensitive name substring.
cursor	string	否	-	Opaque cursor returned by the previous page.
limit	number	否	<= 200；默认 100	Page size. Default 100, maximum 200.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"list_native_imports","arguments":{"projectDir":"project_xxx","nativeId":"sha256","type":"FUNC","limit":100}}

list_native_libraries

List content-addressed SO libraries from one cached APK workspace. Results are grouped by SO SHA-256 and include every APK entry and ABI.

显示名称：List cached native libraries

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace name, for example project_xxx.
abi	string	否	-	Optional exact ABI filter such as arm64-v8a.
query	string	否	-	Optional file name, APK path, or SHA-256 substring.
cursor	string	否	-	Opaque cursor returned by the previous page.
limit	number	否	<= 200；默认 100	Page size. Default 100, maximum 200.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"list_native_libraries","arguments":{"projectDir":"project_xxx","abi":"arm64-v8a","limit":100}}

list_native_lifecycle_entries

Decode DT_INIT, DT_FINI, and every file-backed preinit/init/fini array pointer slot. Relocation-backed targets are resolved when the ELF contains sufficient evidence.

显示名称：List native lifecycle entries

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
kind	string	否	可填：all、init、fini、preinit_array、init_array、fini_array	Lifecycle kind filter. Defaults to all.
cursor	string	否	-	Opaque cursor returned by the previous page.
limit	number	否	最小 1；最大 200	Page size. Default 100, maximum 200.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"list_native_lifecycle_entries","arguments":{"projectDir":"project_xxx","nativeId":"sha256","kind":"all","limit":100}}

list_native_memory_ranges

Enumerate bounded /proc/self/maps metadata inside the cached APK's running process. Supports loaded-module ownership, exact permissions, and offset pagination. It never reads or writes mapped bytes.

显示名称：List native memory ranges

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	要检查其已安装应用进程的 APK 工作区。
processName	string	否	-	精确进程名；空值选择主包进程。
module	string	否	-	Optional loaded SO base name or full runtime path.
permissions	string	否	-	Optional exact map permissions matching [r-][w-][x-][ps], for example r-xp.
offset	number	否	>= 0；默认 0	Zero-based result offset. Default 0.
limit	number	否	<= 512；默认 128	Ranges returned. Default 128, maximum 512.
waitTimeoutMs	number	否	<= 15000；默认 8000	How long MCP waits for the running process response. Default 8000, maximum 15000.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"list_native_memory_ranges","arguments":{"projectDir":"project_xxx","module":"libtarget.so","permissions":"r-xp","limit":128}}

list_native_relocations

List ELF REL/RELA relocation evidence, including imported symbol names, relocation type, virtual address, and file offset when mapped.

显示名称：List native relocations

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
query	string	否	-	Optional symbol, relocation type, or section substring.
cursor	string	否	-	Opaque cursor returned by the previous page.
limit	number	否	<= 200；默认 100	Page size. Default 100, maximum 200.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"list_native_relocations","arguments":{"projectDir":"project_xxx","nativeId":"sha256","query":"JUMP_SLOT"}}

list_native_strings

Scan printable strings from the verified read-only SO cache. Results are bounded and paginated by file offset.

显示名称：List native strings

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
query	string	否	-	Optional case-insensitive string filter.
cursor	string	否	-	Opaque cursor returned by the previous page.
limit	number	否	<= 200；默认 100	Page size. Default 100, maximum 200.
minLength	number	否	-	Minimum printable string length. Default 4.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"list_native_strings","arguments":{"projectDir":"project_xxx","nativeId":"sha256","query":"http","limit":100}}

list_native_symbols

List ELF symbols with import/export/defined scope filtering. Results include value, file offset when resolvable, binding, type, visibility, and section evidence.

显示名称：List native symbols

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
scope	string	否	可填：all、imports、exports、defined、local	all, imports, exports, defined, or local. Defaults to all.
type	string	否	-	Optional ELF symbol type such as FUNC, OBJECT, or NOTYPE.
query	string	否	-	Optional case-insensitive name substring.
includeUnnamed	boolean	否	true / false；默认 false	Include section/file symbols with empty names. Defaults to false.
cursor	string	否	-	Opaque cursor returned by the previous page.
limit	number	否	<= 200；默认 100	Page size. Default 100, maximum 200.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"list_native_symbols","arguments":{"projectDir":"project_xxx","nativeId":"sha256","scope":"exports","limit":100}}

lookup_native_function

Resolve a function symbol by name, virtual address, or file offset. Use this before any future disassembly or decompilation tool.

显示名称：Lookup native function

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
nameOrAddress	string	是	-	Function name or hexadecimal/decimal address.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"lookup_native_function","arguments":{"projectDir":"project_xxx","nativeId":"sha256","nameOrAddress":"0x1234"}}

lookup_native_symbol

Resolve one symbol by exact or partial name, virtual address, or file offset. Address matches include containing function/object symbols when size metadata exists.

显示名称：Lookup native symbol

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
nameOrAddress	string	是	-	Symbol name or hexadecimal/decimal address.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"lookup_native_symbol","arguments":{"projectDir":"project_xxx","nativeId":"sha256","nameOrAddress":"JNI_OnLoad"}}

map_native_methods

Map cached Dex native declarations to concrete SO exports and bounded RegisterNatives evidence. Static long names and non-overloaded short names are exact symbol matches; dynamic candidates never claim a function pointer unless a table decoder proves it.

显示名称：Map Dex native methods

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace name, for example project_xxx.
abi	string	否	-	Optional exact ABI filter such as arm64-v8a.
query	string	否	-	Optional class, method, descriptor, or full method-signature substring.
cursor	string	否	-	Opaque native-method cursor returned by the previous page.
limit	number	否	<= 200；默认 50	Dex native methods per page. Default 50, maximum 200.
maxLibraries	number	否	<= 100；默认 25	Maximum SO files inspected per call. Default 25, maximum 100.
maxTotalBytes	number	否	<= 536870912；默认 268435456	Maximum total SO bytes inspected. Default 268435456 (256 MiB), maximum 536870912.
maxStringBytesPerLibrary	number	否	<= 33554432；默认 8388608	Maximum string-section bytes scanned per SO for dynamic candidates. Default 8388608, maximum 33554432; 0 disables dynamic string evidence.
maxTableBytesPerLibrary	number	否	<= 67108864；默认 16777216	Maximum alloc-data bytes scanned per SO for JNINativeMethod tables. Default 16777216, maximum 67108864; 0 disables table decoding.
includeDynamicCandidates	boolean	否	true / false；默认 true	Include bounded RegisterNatives/string evidence candidates. Defaults to true.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"map_native_methods","arguments":{"projectDir":"project_xxx","abi":"arm64-v8a","limit":50,"includeDynamicCandidates":true}}

native_survey

Return the high-value first view of an SO: APK entries, ABI, ELF identity, cache state, warnings, and evidence-backed next steps.

显示名称：Survey native library

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"native_survey","arguments":{"projectDir":"project_xxx","nativeId":"sha256"}}

prepare_native_library

Extract one SO from source.apk into its content-addressed read-only cache. The original APK and extracted original are never modified by analysis tools.

显示名称：Prepare native library

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
verifyHash	boolean	否	true / false；默认 true	Verify an existing extracted file before reusing it. Defaults to true.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"prepare_native_library","arguments":{"projectDir":"project_xxx","nativeId":"sha256","verifyHash":true}}

read_native_data

Read a bounded value or byte range from a verified SO using a physical file offset. Maximum read size is 65536 bytes.

显示名称：Read native binary data

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
address	string	是	-	Physical file offset as a hexadecimal or decimal string.
kind	string	否	可填：bytes、hexdump、cstring、utf8、integer、float、double、pointer	bytes, hexdump, cstring, utf8, integer, float, double, or pointer. Defaults to bytes.
length	number	否	最小 1；最大 65536	Requested byte count for variable-length reads. Default 64.
endian	string	否	可填：little、big	little or big. Defaults to little.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"read_native_data","arguments":{"projectDir":"project_xxx","nativeId":"sha256","address":"0x40","kind":"hexdump","length":128}}

resolve_native_address

Map an ELF virtual address or SO file offset to its segment, section, nearest symbol, and unified static/runtime coordinates. Legacy vaddr and paddr fields are preserved; paddr means fileOffset.

显示名称：Resolve native address

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
address	string	是	-	Hexadecimal or decimal address.
kind	string	否	可填：auto、vaddr、paddr	auto, vaddr, or paddr. Defaults to auto.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"resolve_native_address","arguments":{"projectDir":"project_xxx","nativeId":"sha256","address":"0x1234","kind":"vaddr"}}

resolve_native_runtime_address

Link cached ELF coordinates to an ASLR runtime address, or normalize an existing runtime address/module offset. Static mode accepts nativeId plus staticAddress and returns cached identity, ELF/file coordinates, runtime mapping, and match evidence.

显示名称：Resolve native runtime address

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	要检查其已安装应用进程的 APK 工作区。
processName	string	否	-	精确进程名；空值选择主包进程。
address	string	否	-	ASLR runtime address as decimal or 0x-prefixed unsigned value.
module	string	否	-	Loaded SO base name or full runtime path with moduleOffset. In static mode, an optional cached SO base name used to disambiguate one nativeId stored under multiple names.
moduleOffset	string	否	-	Module-relative offset as decimal or 0x-prefixed unsigned value. Use with module.
nativeId	string	否	-	Cached SO nativeId. Use with staticAddress for static-to-runtime linking, or with address to correlate an ASLR address back to cached ELF/file coordinates.
staticAddress	string	否	-	Cached ELF virtual address or SO file offset. Use with nativeId.
staticKind	string	否	auto / vaddr / paddr；默认 auto	auto, vaddr, or paddr. Defaults to auto. paddr is the legacy name for an SO file offset.
waitTimeoutMs	number	否	<= 15000；默认 8000	How long MCP waits for the running process response. Default 8000, maximum 15000.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"resolve_native_runtime_address","arguments":{"projectDir":"project_xxx","nativeId":"sha256","staticAddress":"0x1234","staticKind":"vaddr"}}

scan_native_memory

Run a read-only, bounded byte-pattern scan inside one loaded SO in the cached APK's running process. Pattern bytes use space-separated hex and ?? wildcards. Arbitrary-address and whole-process scans are not available.

显示名称：Scan native module memory

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	要检查其已安装应用进程的 APK 工作区。
processName	string	否	-	精确进程名；空值选择主包进程。
module	string	是	-	Loaded SO base name or full runtime path.
permissions	string	否	-	Optional exact readable map permissions, for example r-xp or rw-p.
pattern	string	是	最多 64 字节	Space-separated bytes with optional ?? wildcards, maximum 64 bytes, for example 73 63 72 69 70 74 78.
maxBytes	number	否	<= 16777216；默认 4194304	Maximum bytes scanned. Default 4194304, maximum 16777216.
maxMatches	number	否	<= 1024；默认 128	Maximum matches returned. Default 128, maximum 1024.
timeoutMillis	number	否	<= 10000；默认 1000	In-process scan deadline. Default 1000, maximum 10000.
waitTimeoutMs	number	否	<= 15000	How long MCP waits for the response. Default is the greater of 8000 or scan timeout plus 2000, maximum 15000.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"scan_native_memory","arguments":{"projectDir":"project_xxx","module":"libtarget.so","permissions":"r-xp","pattern":"73 63 72 69 70 74 78","maxBytes":4194304}}

search_native

Search a verified SO by printable string or hexadecimal bytes. Hex queries support ?? wildcards.

显示名称：Search native library

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK 工作区目录名，例如 project_xxx。
nativeId	string	是	-	SO 文件完整 SHA-256，可使用大写或小写。
kind	string	是	可填：string、hex、bytes	Search kind: string, hex, or bytes.
query	string	是	-	String text or space-separated hex bytes such as 7f 45 ?? 46.
cursor	string	否	-	Opaque cursor returned by the previous page.
limit	number	否	最小 1；最大 200	Page size. Default 100, maximum 200.
minLength	number	否	最小 1；最大 1024	Minimum string length for kind=string. Default 4.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"search_native","arguments":{"projectDir":"project_xxx","nativeId":"sha256","kind":"hex","query":"7f 45 ?? 46"}}

start_native_emulation

Create an isolated unidbg task from one cached APK and cached ARM32/ARM64 SO. It loads the SO with the APK-backed Dalvik VM, optionally invokes JNI_OnLoad, applies exact-signature JNI stubs, and can invoke bounded exported C or JNI entry points without accepting arbitrary addresses. Returns immediately with taskId and jobId.

显示名称：Start cached SO emulation

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	Cached APK workspace directory, for example project_xxx.
nativeId	string	是	-	Complete SHA-256 identifier returned by list_native_libraries.
callJniOnLoad	boolean	否	true / false；默认 true	Invoke JNI_OnLoad when exported. Default true.
sdkVersion	number	否	最小 19；最大 23	Android API environment presented by unidbg. Default 23. unidbg 0.9.8 packages API 19 and 23; other values are rejected.
timeoutMs	number	否	最小 1000；最大 300000	Hard task timeout. Default 60000, range 1000-300000.
jniStubs	array	否	-	Up to 64 exact JNI environment stubs. Each item: kind=staticMethod|instanceMethod|staticField|instanceField, full unidbg signature such as android/os/Build->MODEL:Ljava/lang/String;, returnType=void|boolean|int32|int64|float|double|string|byteArray|null|object, value, and optional className for object returns.
invocations	array	否	-	Up to 16 bounded calls after loading. Each item uses kind=EXPORT with symbol/returnType/arguments, or JNI_STATIC/JNI_INSTANCE with className/method/descriptor/arguments. No address or host path is accepted. Argument types: int32,uint32,int64,uint64,boolean,null plus managed cstring/bytes for EXPORT or string/bytes for JNI.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"start_native_emulation","arguments":{"projectDir":"project_xxx","nativeId":"<sha256>","callJniOnLoad":true,"sdkVersion":23,"jniStubs":[{"kind":"staticField","signature":"android/os/Build->MODEL:Ljava/lang/String;","returnType":"string","value":"Pixel 8"}],"invocations":[{"id":"add","kind":"EXPORT","symbol":"sx_demo_add_i32","returnType":"int32","arguments":[{"type":"int32","value":2},{"type":"int32","value":3}]}],"timeoutMs":60000}}

start_native_function_trace

Trace one function from a cached SO inside the target process using the existing Xposed, xDL, Dobby, and ScriptX native runtime. Provide an ELF virtual address or a unique defined function symbol. The trace is observation-only: it does not modify arguments or return values.

显示名称：Start runtime native function trace

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace containing the target SO.
nativeId	string	是	-	SHA-256 identity of the cached SO bytes.
moduleName	string	否	-	Runtime SO base name. Required only when the same nativeId has multiple APK file names.
address	string	否	-	ELF virtual address such as 0x1234. Do not pass an ASLR runtime address or file offset.
symbolName	string	否	-	Unique defined function symbol. Required when address is blank; may also verify an address.
returnType	string	否	integer / float / double / void；默认 integer	ABI return register kind: integer, float, double, or void. Defaults to integer.
argumentCount	number	否	<= 16；默认 8	Raw ABI argument words to retain. Default 8, maximum 16. Floating registers are also reported as evidence.
processName	string	否	-	Optional exact package process. Blank allows all package processes.
restartTarget	boolean	否	true / false；默认 true	Force-stop and relaunch the target so the hook is installed. Defaults to true.
maxEvents	number	否	<= 10000；默认 2000	Maximum persisted hook-status and call events. Default 2000, maximum 10000.
ttlMs	number	否	30000 ~ 86400000；默认 600000	Session lifetime in milliseconds. Default 600000, range 30000 to 86400000.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"start_native_function_trace","arguments":{"projectDir":"project_xxx","nativeId":"sha256","address":"0x1234","returnType":"integer","argumentCount":8}}

start_native_jni_trace

Create a bounded runtime trace session for the cached APK package. By default ScriptX force-stops and relaunches the target so the existing Xposed runtime can load libscriptx.so and observe real JNIEnv RegisterNatives calls. This does not use Frida and does not modify APK, Dex, or SO caches.

显示名称：Start runtime JNI registration trace

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace name whose manifest package will be traced.
processName	string	否	-	Optional exact process name. Blank traces every process belonging to the package.
restartTarget	boolean	否	true / false；默认 true	Force-stop and relaunch the target after writing the request. Defaults to true and is recommended because most registrations happen during startup.
maxEvents	number	否	<= 20000；默认 5000	Maximum persisted method-registration events. Default 5000, maximum 20000.
ttlMs	number	否	30000 ~ 86400000；默认 600000	Session lifetime in milliseconds. Default 600000, range 30000 to 86400000.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"start_native_jni_trace","arguments":{"projectDir":"project_xxx","restartTarget":true,"maxEvents":5000}}

start_native_load_trace

Create a bounded runtime session for the cached APK package. The existing Xposed runtime loads libscriptx.so and observes dlopen/android_dlopen_ext without Frida. By default the target is restarted and an initial loaded-module snapshot is captured.

显示名称：Start runtime native library load trace

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace name whose manifest package will be traced.
processName	string	否	-	Optional exact process name. Blank traces every process belonging to the package.
restartTarget	boolean	否	true / false；默认 true	Force-stop and relaunch the target after writing the request. Defaults to true.
includeInitialSnapshot	boolean	否	true / false；默认 true	Emit the process module list immediately after hook installation. Defaults to true.
maxEvents	number	否	<= 20000；默认 5000	Maximum persisted snapshot and loader events. Default 5000, maximum 20000.
ttlMs	number	否	30000 ~ 86400000；默认 600000	Session lifetime in milliseconds. Default 600000, range 30000 to 86400000.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"start_native_load_trace","arguments":{"projectDir":"project_xxx","restartTarget":true,"includeInitialSnapshot":true,"maxEvents":5000}}

start_native_memory_snapshot

Capture a bounded, observation-only snapshot of one cached SO after it is mapped or when a ScriptX native Hook is hit. The existing Xposed and ScriptX native runtime reads executable PT_LOAD bytes and optional relocation slots, then compares them with the cached ELF without Frida.

显示名称：Start runtime native memory snapshot

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace containing the cached SO.
nativeId	string	是	-	SHA-256 identity of the cached SO bytes.
moduleName	string	否	-	Runtime SO base name. Required only when nativeId has multiple APK names.
processName	string	否	-	Optional exact package process. Blank allows all package processes.
restartTarget	boolean	否	true / false；默认 true	Force-stop and relaunch the target so it reads the request. Defaults to true.
maxBytes	number	否	4096 ~ 8388608；默认 524288	Maximum attempted runtime bytes. Default 524288, range 4096 to 8388608.
chunkBytes	number	否	4096 ~ 16384	Executable segment bytes per event. Default and maximum 16384; minimum 4096.
includeRelocations	boolean	否	true / false；默认 true	Capture up to 128 JUMP_SLOT, GLOB_DAT, and IRELATIVE slots before executable bytes. Defaults to true.
address	string	否	-	Optional decimal or 0x-prefixed ELF virtual address. This is not an ASLR runtime address or file offset.
symbolName	string	否	-	Optional exact defined FUNC or GNU_IFUNC symbol. It must resolve uniquely in the cached ELF.
sizeBytes	number	否	>= 0	Targeted executable bytes from address or symbol. Zero selects symbol size when available, otherwise 65536.
captureCount	number	否	1 ~ 8；默认 1	Automatic capture stages. Default 1, range 1 to 8. Multi-stage capture binds to one exact process.
captureIntervalMs	number	否	1000 ~ 600000；默认 30000	Delay between automatic stages. Default 30000; multi-stage range 1000 to 600000.
stageLabelPrefix	string	否	-	Stable label prefix for stages, for example unpacking produces unpacking-1 and unpacking-2.
triggerMode	string	否	MODULE_LOAD / HOOK；默认 MODULE_LOAD	MODULE_LOAD captures automatically after mapping; HOOK waits for native.hook({snapshot:true}). Defaults to MODULE_LOAD.
hookMinIntervalMs	number	否	0 ~ 600000；默认 1000	Minimum delay between accepted Hook-triggered stages. Default 1000, range 0 to 600000.
ttlMs	number	否	30000 ~ 86400000；默认 600000	Session lifetime in milliseconds. Default 600000, range 30000 to 86400000.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"start_native_memory_snapshot","arguments":{"projectDir":"project_xxx","nativeId":"sha256","symbolName":"JNI_OnLoad","triggerMode":"HOOK","captureCount":3}}

stop_native_emulation

Cancel a running unidbg task and terminate its Ubuntu process group through the existing Ubuntu job cancellation path. A completed task is returned unchanged.

显示名称：Stop native emulation task

参数

参数	类型	必填	可填值 / 范围	说明
taskId	string	是	-	Task identifier returned by start_native_emulation.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"stop_native_emulation","arguments":{"taskId":"emu-..."}}

stop_native_function_trace

Disable the active function trace request and reject future events for the session. The target process is not killed; the installed pass-through hook disappears when that process exits.

显示名称：Stop runtime native function trace

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace used when the trace was started.
sessionId	string	否	-	Session returned by start_native_function_trace. Blank selects the newest workspace session.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"stop_native_function_trace","arguments":{"projectDir":"project_xxx","sessionId":"uuid"}}

stop_native_jni_trace

Disable the active trace request and reject future events for the session. The target process is not killed; an already-installed in-process hook becomes inert at the ScriptX receiver and disappears when that process exits.

显示名称：Stop runtime JNI registration trace

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace name used when the trace was started.
sessionId	string	否	-	Session returned by start_native_jni_trace. Blank selects the newest session for this workspace.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"stop_native_jni_trace","arguments":{"projectDir":"project_xxx","sessionId":"uuid"}}

stop_native_load_trace

Disable the active native load trace request and reject future events for the session. The target process is not killed; installed in-process hooks become inert at the ScriptX receiver and disappear when the process exits.

显示名称：Stop runtime native library load trace

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace name used when the trace was started.
sessionId	string	否	-	Session returned by start_native_load_trace. Blank selects the newest session for this workspace.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"stop_native_load_trace","arguments":{"projectDir":"project_xxx","sessionId":"uuid"}}

stop_native_memory_snapshot

Disable the active snapshot request and reject future events. The target process is not killed and already captured evidence remains available for pagination.

显示名称：Stop runtime native memory snapshot

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace used when the snapshot was started.
sessionId	string	否	-	Session returned by start_native_memory_snapshot. Blank selects the newest workspace session.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"stop_native_memory_snapshot","arguments":{"projectDir":"project_xxx","sessionId":"uuid"}}

stop_native_runtime_operation

Cancel a pending or running one-shot native runtime inspection and disable its request. Completed results remain available in the returned session metadata.

显示名称：Stop native runtime operation

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace used by the runtime inspection.
sessionId	string	否	-	Session returned by a runtime inspection tool. Blank selects the newest workspace inspection.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"stop_native_runtime_operation","arguments":{"projectDir":"project_xxx","sessionId":"uuid"}}

survey_native_workspace

Return a fast APK-level native overview from the existing index: app identity, ABI and byte distribution, duplicate content, Dex native-method count, and metadata-ranked SO candidates. This tool does not extract every SO.

显示名称：Survey APK native workspace

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace name, for example project_xxx.
maxCandidates	number	否	<= 100；默认 20	Maximum ranked metadata candidates. Default 20, maximum 100.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"survey_native_workspace","arguments":{"projectDir":"project_xxx","maxCandidates":20}}

triage_native_libraries

Perform bounded, paginated static triage across SO files and rank analysis priority using JNI, crypto, network, dynamic-loading, anti-analysis, root-detection, command-execution, packing, and memory-manipulation evidence. Findings are indicators, not vulnerability claims.

显示名称：Triage APK native libraries

参数

参数	类型	必填	可填值 / 范围	说明
projectDir	string	是	-	APK workspace name, for example project_xxx.
abi	string	否	-	Optional exact ABI filter such as arm64-v8a.
query	string	否	-	Optional file name, APK path, or nativeId substring.
cursor	string	否	-	Opaque cursor returned by the previous page.
limit	number	否	<= 25；默认 10	Libraries per call. Default 10, maximum 25.
maxTotalBytes	number	否	<= 536870912；默认 134217728	Maximum total SO bytes processed in one call. Default 134217728 (128 MiB), maximum 536870912.
maxStringBytesPerLibrary	number	否	<= 33554432；默认 8388608	Maximum string-section bytes scanned per SO. Default 8388608 (8 MiB), maximum 33554432. Use 0 to skip strings.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"triage_native_libraries","arguments":{"projectDir":"project_xxx","abi":"arm64-v8a","limit":10,"maxTotalBytes":134217728}}

uninstall_native_emulation_backend

Remove only the fixed /opt/scriptx/unidbg backend directory from Ubuntu. This does not remove Ubuntu, cached APKs, cached SO files, or saved emulation task reports.

显示名称：Uninstall native emulation backend

参数

参数	类型	必填	可填值 / 范围	说明
confirm	boolean	是	仅 true	Must be true because this removes the installed unidbg backend.

返回值

返回统一 MCP 结果对象：ok 表示调用是否成功，message 是可读说明，具体数据放在 result。分析尚未准备好、后端安装中或需要先缓存 APK 时，ok 可能为 false，应先读 message 与 result 中的状态字段再决定下一步。

示例

{"name":"uninstall_native_emulation_backend","arguments":{"confirm":true}}