CLI Reference

Reference for the rerius command-line tool.

Repository: https://github.com/ECLS-Studio/rerius

Synopsis#

rerius [OPTIONS] <binary>
rerius [OPTIONS] -c <file.daxc>

Full Flag Reference#

Output Control#

Flag	Description	Example
`-a`	Show hex bytes alongside each instruction	`rerius -a ./binary`
`-n`	No color output (plain text)	`rerius -n ./binary \\| less`
`-v`	Verbose: extra detail in analysis output	`rerius -v -C ./binary`
`-h`	Show help and exit	`rerius -h`

Section Selection#

Flag	Description	Example
`-s <name>`	Disassemble a specific section (default: `.text`)	`rerius -s .plt ./binary`
`-S`	Disassemble all executable sections	`rerius -S ./binary`
`-l`	List all sections with metadata (no disassembly)	`rerius -l ./binary`
`-A <addr>`	Start address in hex	`rerius -A 0x4010 ./binary`
`-E <addr>`	End address in hex	`rerius -A 0x4010 -E 0x4100 ./binary`

Static Analysis#

Flag	Description
`-y`	Resolve symbols: annotate addresses with names from the symbol table
`-d`	Demangle C++ Itanium ABI names
`-f`	Detect function boundaries: print function headers
`-g`	Instruction group coloring: call, branch, ret, stack, syscall, nop
`-r`	Cross-reference annotations: show what calls or jumps to each address
`-t`	Inline string annotations: show string content from `.rodata`
`-C`	Build and print control flow graphs
`-L`	Loop detection via dominator analysis
`-G`	Call graph: who calls whom
`-W`	Switch/jump table detection
`-u`	Unicode string scanner: UTF-8, UTF-16LE, UTF-16BE

Advanced Analysis#

Flag	Description	Platform
`-P`	Symbolic execution: track register state through a function	ARM64, x86-64, RISC-V
`-Q`	SSA / typed IR lifting: internally called "NR" (type inference, call-target resolution)	ARM64, RISC-V
`-D`	Decompile to pseudo-C: from the lifted IR, with resolved calls and type-aware locals	ARM64, RISC-V
`-I`	Emulate function: concrete execution with real-time SMC detection	ARM64, RISC-V
`-e`	Entropy analysis: Shannon entropy sliding window per section	All
`-R`	Recursive descent disassembly: follows control flow	ARM64, x86-64, RISC-V
`-V`	Instruction validity filter: flags invalid, privileged, dead bytes, and SMC	ARM64, x86-64, RISC-V
`--poly`	Polymorphic obfuscation map: mutation cluster detection with XOR, ROR, and hash-chain signals	All
`--dsa`	DSA: Dynamic Single Assignment over all functions	ARM64, RISC-V
`--aire`	AIRE: heuristic pattern signals with confidence scoring, next-step suggestions, and cross-run memory recall	All
`--vm-trace`	Print VM dispatch flow trace after emulation	ARM64, x86-64, RISC-V

Batch Flags#

Flag	Includes
`-x`	`-y -d -f -g -r -t -C -L -G -W -u`: all standard analysis
`-X`	Everything in `-x` plus `-P -Q -D -I -e -R -V --poly --aire --vm-trace --dsa`, and it also enables interactive mode: after the analysis output, it drops into the REPL rather than exiting. With stdin closed/redirected it reads EOF and exits immediately; at an interactive terminal it will wait for a command instead of returning control to your shell.

Snapshot#

Flag	Description
`-o <file>`	Save full analysis as a `.daxc` AOT C source snapshot
`-c`	Convert a `.daxc` snapshot to annotated `.S` assembly

Plugins#

Flag	Description
`-eox <folder>`	Load plugins from the specified folder
`-eox-list`	List all currently loaded plugins

Interactive Mode#

Flag	Description
`-i`	Launch the interactive REPL shell

Exit Codes#

Code	Meaning
`0`	Success
`1`	Any error: bad arguments, binary not found/unreadable, unsupported or unparseable format, or a `.daxc` read failure. The CLI does not currently distinguish these cases by exit code; check stderr for the reason.

Examples#

Minimal: just disassemble#

./rerius ./binary

Full standard analysis: most useful for everyday reverse engineering#

./rerius -x ./binary

Full analysis including all advanced modules#

-X also enables interactive mode (see the note under Batch Flags): redirect stdin from /dev/null for a non-interactive run:

./rerius -X ./binary < /dev/null

Disassemble with bytes and symbols, no color (pipe to less)#

./rerius -a -y -n ./binary | less

Symbols, demangling, functions, and CFG only#

./rerius -y -d -f -C ./binary

Show only the .rodata section#

./rerius -s .rodata ./binary

Entropy analysis: detect packed or encrypted regions#

./rerius -e ./binary

Recursive descent: reveal dead bytes after jump tricks#

./rerius -R ./binary

Instruction validity filter: find invalid or privileged instructions#

./rerius -V ./binary

Symbolic execution of all detected functions#

./rerius -f -P ./binary

Decompile all functions to pseudo-C#

./rerius -f -D ./binary

Emulate ARM64 function 0#

./rerius -f -I ./arm64_binary
# Initial registers can be set via the JS API: bin.emulate(0, {'0': 42n})

Save analysis snapshot#

./rerius -x -o analysis.daxc ./binary

Reload snapshot and convert to annotated assembly#

rerius analysis.daxc            # load snapshot
rerius -c analysis.daxc         # convert to .S
clang -O2 -o snap analysis.daxc && ./snap   # compile standalone

Disassemble a specific address range#

./rerius -A 0x4010 -E 0x4100 ./binary

All executable sections with full analysis#

./rerius -S -x ./binary

Plain text output for CI or logging#

./rerius -x -n ./binary > report.txt

Output Format#

Printed before disassembly: shows format, architecture, OS/ABI, entry point, sizes, SHA-256, Build-ID, and flags.

 File          : ./binary
 Format        : ELF64
 Arch          : AArch64 (ARM64)
 OS/ABI        : Android
 Entry         : 0x0000000000000690
 Image Size    : 35952 bytes
 Code Size     : 996 bytes
 Data Size     : 302 bytes
 Symbols       : 1
 Functions     : 2
 CFG Blocks    : 11
 Xrefs         : 28
 SHA-256       : 2d83e181...
 PIE           : yes
 Stripped      : yes

Disassembly line format#

<address>  <mnemonic>   <operands>   ; [comment]
0x0000000000000790  mov       w8, w0        ; [data-move]
0x0000000000000794  b         0x7a4         ; [branch] -> sub_7b0

CFG tree format#

  CFG  tricky  (3 blocks)
  |
  +-- block_0--------------------< 0x790  3 insns  12 bytes ENTRY
      +--[J]-- block_1-----------< 0x7b0  5 insns  20 bytes EXIT
          +--[->]-- block_2------< 0x7a4  2 insns  8 bytes

Entropy output format#

  Section              VAddr      Window  Entropy  Classification
  ------------------------------------------------------------------
  .text                0x1000     +0x0     4.21     (normal)
  .data                0x4000     +0x0     7.82     PACKED/ENCRYPTED