decompiler

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Trigger Intents

触发场景

Use this skill when user asks for:

"decompile this function"
pseudocode understanding or AST-level analysis
local variable semantics in decompiled form
decompiler-centric pattern mining (returns/calls/conditions)

Route to:

```
annotations
```
for persistent comments/renames after interpretation
```
types
```
for struct/enum/type construction and application
```
disassembly
```
when decompiler is unavailable or insufficient

当用户提出以下需求时使用本技能：

"反编译这个函数"
伪代码理解或AST层面分析
反编译结果中的局部变量语义分析
以反编译器为核心的模式挖掘（返回/调用/条件语句）

关联技能：

```
annotations
```
：用于解读后添加持久化注释/重命名
```
types
```
：用于结构体/枚举/类型的构建与应用
```
disassembly
```
：当反编译器不可用或功能不足时使用

Do This First (Warm-Start Sequence)

初始操作流程（预热步骤）

sql

-- 1) Capability/profile probe
SELECT * FROM pragma_table_list WHERE name IN ('pseudocode', 'ctree', 'ctree_lvars');

-- 2) Pick one concrete function target
SELECT name, printf('0x%X', address) AS addr, size
FROM funcs
ORDER BY size DESC
LIMIT 10;

-- 3) View decompiled text via primary read surface
SELECT decompile(0x401000);

Interpretation guidance:

```
decompile(addr)
```
is primary display surface.
```
pseudocode
```
/
```
ctree*
```
are structured query/edit surfaces.

sql

-- 1) 能力/配置探测
SELECT * FROM pragma_table_list WHERE name IN ('pseudocode', 'ctree', 'ctree_lvars');

-- 2) 选择一个具体的函数目标
SELECT name, printf('0x%X', address) AS addr, size
FROM funcs
ORDER BY size DESC
LIMIT 10;

-- 3) 通过主读取界面查看反编译文本
SELECT decompile(0x401000);

解读指南：

```
decompile(addr)
```
是主显示界面。
```
pseudocode
```
/
```
ctree*
```
是结构化查询/编辑界面。

Global Constraint Reminder (Critical)

全局约束提醒（重要）

Always constrain decompiler tables by function:

sql

WHERE func_addr = 0x...

Without this, decompiler tables may decompile every function and become extremely slow.

始终通过函数约束反编译器表：

sql

WHERE func_addr = 0x...

如果不添加该约束，反编译器表会对所有函数进行反编译，导致速度极慢。

Failure and Recovery

故障与恢复

No Hex-Rays/decompiler tables unavailable:
- Fall back to
```
disassembly
```
  +
```
xrefs
```
  workflows.
Empty/partial rows:
- Confirm target
```
func_addr
```
  exists and refresh decompile cache (
```
decompile(addr, 1)
```
  where supported).
Mutation did not appear:
- Run mandatory mutation loop (read -> edit -> refresh -> verify).

无Hex-Rays/反编译器表不可用：
- fallback到
```
disassembly
```
  +
```
xrefs
```
  工作流。
结果为空/不完整：
- 确认目标
```
func_addr
```
  存在，并刷新反编译缓存（支持的情况下使用
```
decompile(addr, 1)
```
  ）。
修改未生效：
- 执行强制修改循环（读取 -> 编辑 -> 刷新 -> 验证）。

Handoff Patterns

技能衔接模式

```
decompiler
```
->
```
types
```
for local type seeding and richer declarations.
```
decompiler
```
->
```
annotations
```
for persistent narrative and naming.
```
decompiler
```
->
```
disassembly
```
for opcode-level validation.

```
decompiler
```
->
```
types
```
：用于局部类型植入与更丰富的声明。
```
decompiler
```
->
```
annotations
```
：用于添加持久化说明与命名。
```
decompiler
```
->
```
disassembly
```
：用于操作码层面的验证。

Decompiler Tables (Hex-Rays Required)

反编译器表（需Hex-Rays支持）

CRITICAL: Always filter by

func_addr

. Without constraint, these tables will decompile EVERY function - extremely slow!

重要提示： 始终通过

func_addr

过滤。如果不添加约束，这些表会对所有函数进行反编译——速度极慢！

pseudocode

The

pseudocode

table is a structured line-by-line pseudocode with writable comments. Use
decompile(addr)
to view pseudocode; use this table only for surgical edits (comments) or structured queries.

Column	Type	Writable	Description
`func_addr`	INT	No	Function address
`line_num`	INT	No	Line number
`line`	TEXT	No	Pseudocode text
`ea`	INT	No	Corresponding assembly address (from COLOR_ADDR anchor)
`comment`	TEXT	Yes	Decompiler comment at this ea
`comment_placement`	TEXT	Yes	Comment placement: `semi` (inline, default), `block1` (above line)

Filter behavior:

```
WHERE func_addr = X
```
: best performance; iterates pseudocode for one function only.
```
WHERE ea = X
```
: decompiles only the containing function and returns matching lines for that EA.
```
WHERE line_num = N
```
: scans functions and returns rows at that line index; use only when you need cross-function line alignment.

Comment placements:

semi

(after

block1

(own line above),

block2

curly1

curly2

colon

case

else

do

sql

-- VIEWING: Use decompile() function, NOT the pseudocode table
SELECT decompile(0x401000);

-- COMMENTING: Use pseudocode table to add/edit/delete comments
UPDATE pseudocode SET comment_placement = 'semi',
                      comment = 'buffer overflow here'
WHERE func_addr = 0x401000 AND ea = 0x401020;

-- Add block comment (appears on own line above the statement)
UPDATE pseudocode SET comment_placement = 'block1', comment = 'vulnerable call'
WHERE func_addr = 0x401000 AND ea = 0x401020;

-- Delete comments at a resolved unique anchor
UPDATE pseudocode SET comment = NULL
WHERE func_addr = 0x401000 AND ea = 0x401020;

True function comments are not part of

pseudocode

use

UPDATE funcs SET comment = ... WHERE address = ...

for the regular function comment

use

UPDATE funcs SET rpt_comment = ... WHERE address = ...

for the repeatable function comment

pseudocode

表是结构化的逐行伪代码，支持编辑注释。查看伪代码请使用
decompile(addr)
；仅在需要精准编辑（注释）或结构化查询时使用本表。

列名	类型	是否可写	描述
`func_addr`	INT	否	函数地址
`line_num`	INT	否	行号
`line`	TEXT	否	伪代码文本
`ea`	INT	否	对应的汇编地址（来自COLOR_ADDR锚点）
`comment`	TEXT	是	该ea处的反编译器注释
`comment_placement`	TEXT	是	注释位置： `semi` （行内，默认）、 `block1` （行上方）

过滤行为：

```
WHERE func_addr = X
```
：性能最优；仅遍历单个函数的伪代码。
```
WHERE ea = X
```
：仅反编译包含该EA的函数，并返回匹配该行的结果。
```
WHERE line_num = N
```
：扫描所有函数并返回对应行索引的结果；仅在需要跨函数行对齐时使用。

注释位置选项：

semi

（

后）、

block1

（单独一行在上方）、

block2

、

curly1

、

curly2

、

colon

、

case

、

else

、

do

sql

-- 查看：使用decompile()函数，而非pseudocode表
SELECT decompile(0x401000);

-- 添加/编辑/删除注释：使用pseudocode表
UPDATE pseudocode SET comment_placement = 'semi',
                      comment = '此处存在缓冲区溢出'
WHERE func_addr = 0x401000 AND ea = 0x401020;

-- 添加块注释（显示在语句上方的单独一行）
UPDATE pseudocode SET comment_placement = 'block1', comment = '易受攻击的调用'
WHERE func_addr = 0x401000 AND ea = 0x401020;

-- 删除已解析唯一锚点处的注释
UPDATE pseudocode SET comment = NULL
WHERE func_addr = 0x401000 AND ea = 0x401020;

真正的函数注释不属于

pseudocode

表：

如需添加常规函数注释，使用

UPDATE funcs SET comment = ... WHERE address = ...

如需添加可重复显示的函数注释，使用

UPDATE funcs SET rpt_comment = ... WHERE address = ...

pseudocode_orphan_comments

Persisted Hex-Rays comments that no longer attach to the current decompiled output of a live function. Use it to inspect or delete stale comments.

Column	Type	Writable	Description
`func_addr`	INT	No	Function address
`func_name`	TEXT	No	Current function name for triage
`ea`	INT	No	Stored orphan comment EA
`comment_placement`	TEXT	No	Stored `treeloc_t.itp` placement
`orphan_comment`	TEXT	Delete-only	Stored orphan comment text

Rules:

```
UPDATE ... SET orphan_comment = NULL
```
or
```
''
```
deletes that orphan comment.
Any non-empty write is rejected.

已持久化但不再关联到当前函数反编译输出的Hex-Rays注释。用于检查或删除过期注释。

列名	类型	是否可写	描述
`func_addr`	INT	否	函数地址
`func_name`	TEXT	否	当前函数名称（用于分类排查）
`ea`	INT	否	存储的过期注释EA
`comment_placement`	TEXT	否	存储的 `treeloc_t.itp` 位置
`orphan_comment`	TEXT	仅可删除	存储的过期注释文本

规则：

使用
```
UPDATE ... SET orphan_comment = NULL
```
或
```
''
```
删除过期注释。
任何非空写入操作都会被拒绝。

pseudocode_v_orphan_comment_groups

Grouped, read-only orphan triage surface. One row per function with orphan comments.

Columns:

func_addr

func_name

orphan_count

orphan_comments_json

分组的只读过期注释排查界面。每条记录对应一个存在过期注释的函数。

列：

func_addr

、

func_name

、

orphan_count

、

orphan_comments_json

Comment Anchor Resolution (Critical)

注释锚点解析（重要）

Use this recipe before writing heading-style decompiler notes.

Rules:

Do not assume
```
ea == func_addr
```
.
The first displayed pseudocode row often has
```
ea = 0
```
and is not the right write target.
One
```
ea
```
can map to multiple rows (
```
{
```
, statement,
```
}
```
); prefer a unique non-brace anchor.
For true function comments, update
```
funcs.comment
```
/
```
funcs.rpt_comment
```
instead of
```
pseudocode
```
.

sql

-- Resolve the first attachable non-brace row near function start
SELECT line_num, ea, line
FROM pseudocode
WHERE func_addr = 0x401000
  AND ea != 0
  AND TRIM(line) NOT IN ('{', '}')
  AND ea IN (
    SELECT ea
    FROM pseudocode
    WHERE func_addr = 0x401000 AND ea != 0
    GROUP BY ea
    HAVING COUNT(*) = 1
  )
ORDER BY line_num
LIMIT 1;

-- Write a heading-style summary using the resolved ea
UPDATE pseudocode
SET comment_placement = 'block1',
    comment = 'One-paragraph summary of the function.'
WHERE func_addr = 0x401000
  AND ea = (
    SELECT ea
    FROM pseudocode
    WHERE func_addr = 0x401000
      AND ea != 0
      AND TRIM(line) NOT IN ('{', '}')
      AND ea IN (
        SELECT ea
        FROM pseudocode
        WHERE func_addr = 0x401000 AND ea != 0
        GROUP BY ea
        HAVING COUNT(*) = 1
      )
    ORDER BY line_num
    LIMIT 1
  );

在添加标题式反编译器注释前，请遵循以下步骤。

规则：

不要假设
```
ea == func_addr
```
。
第一个显示的伪代码行通常
```
ea = 0
```
，不是合适的写入目标。
一个
```
ea
```
可能映射到多行（
```
{
```
、语句、
```
}
```
）；优先选择唯一的非大括号锚点。
如需添加真正的函数注释，请更新
```
funcs.comment
```
/
```
funcs.rpt_comment
```
而非
```
pseudocode
```
表。

sql

-- 解析函数起始位置附近第一个可关联的非大括号行
SELECT line_num, ea, line
FROM pseudocode
WHERE func_addr = 0x401000
  AND ea != 0
  AND TRIM(line) NOT IN ('{', '}')
  AND ea IN (
    SELECT ea
    FROM pseudocode
    WHERE func_addr = 0x401000 AND ea != 0
    GROUP BY ea
    HAVING COUNT(*) = 1
  )
ORDER BY line_num
LIMIT 1;

-- 使用解析得到的ea添加标题式摘要
UPDATE pseudocode
SET comment_placement = 'block1',
    comment = '函数的一段摘要说明。'
WHERE func_addr = 0x401000
  AND ea = (
    SELECT ea
    FROM pseudocode
    WHERE func_addr = 0x401000
      AND ea != 0
      AND TRIM(line) NOT IN ('{', '}')
      AND ea IN (
        SELECT ea
        FROM pseudocode
        WHERE func_addr = 0x401000 AND ea != 0
        GROUP BY ea
        HAVING COUNT(*) = 1
      )
    ORDER BY line_num
    LIMIT 1
  );

ctree

Full Abstract Syntax Tree of decompiled code.

Column	Type	Description
`func_addr`	INT	Function address
`item_id`	INT	Unique node ID
`is_expr`	INT	1=expression, 0=statement
`op_name`	TEXT	Node type ( `cot_call` , `cit_if` , etc.)
`ea`	INT	Address in binary
`parent_id`	INT	Parent node ID
`depth`	INT	Tree depth
`x_id` , `y_id` , `z_id`	INT	Child node IDs
`var_idx`	INT	Local variable index
`var_name`	TEXT	Variable name
`obj_ea`	INT	Target address
`obj_name`	TEXT	Symbol name
`num_value`	INT	Numeric literal
`label_num`	INT	Label number when node defines a label
`goto_label_num`	INT	Target label number for `cit_goto` nodes
`str_value`	TEXT	String literal

反编译代码的完整抽象语法树。

列名	类型	描述
`func_addr`	INT	函数地址
`item_id`	INT	唯一节点ID
`is_expr`	INT	1=表达式，0=语句
`op_name`	TEXT	节点类型（ `cot_call` 、 `cit_if` 等）
`ea`	INT	二进制中的地址
`parent_id`	INT	父节点ID
`depth`	INT	树深度
`x_id` , `y_id` , `z_id`	INT	子节点ID
`var_idx`	INT	局部变量索引
`var_name`	TEXT	变量名称
`obj_ea`	INT	目标地址
`obj_name`	TEXT	符号名称
`num_value`	INT	数值字面量
`label_num`	INT	节点定义标签时的标签编号
`goto_label_num`	INT	`cit_goto` 节点的目标标签编号
`str_value`	TEXT	字符串字面量

ctree_lvars

Local variables from decompilation.

Column	Type	Description
`func_addr`	INT	Function address
`idx`	INT	Variable index
`name`	TEXT	Variable name
`type`	TEXT	Type string
`comment`	TEXT	Local-variable comment shown next to declaration
`size`	INT	Size in bytes
`is_arg`	INT	1=function argument
`is_stk_var`	INT	1=stack variable
`stkoff`	INT	Stack offset

Mutation guidance:

Prefer
```
idx
```
-based updates for deterministic writes.
```
comment
```
updates map to Hex-Rays local-variable comments (
```
lv.cmt
```
) and appear in
```
decompile(...)
```
output.

反编译得到的局部变量。

列名	类型	描述
`func_addr`	INT	函数地址
`idx`	INT	变量索引
`name`	TEXT	变量名称
`type`	TEXT	类型字符串
`comment`	TEXT	显示在声明旁的局部变量注释
`size`	INT	字节大小
`is_arg`	INT	1=函数参数
`is_stk_var`	INT	1=栈变量
`stkoff`	INT	栈偏移量

修改指南：

优先基于
```
idx
```
进行更新，确保写入的确定性。
更新
```
comment
```
会同步到Hex-Rays局部变量注释（
```
lv.cmt
```
），并在
```
decompile(...)
```
输出中显示。

ctree_labels

Decompiler control-flow labels. Supports UPDATE (

name

) and mirrors label facilities on

cfunc_t

Column	Type	RW	Description
`func_addr`	INT	R	Function address
`label_num`	INT	R	Label number ( `LABEL_<n>` )
`name`	TEXT	RW	Current label name
`item_id`	INT	R	Backing ctree item id for this label
`item_ea`	INT	R	Address of label-bearing ctree item
`is_user_defined`	INT	R	1 if name differs from default `LABEL_<n>`

反编译器控制流标签。支持更新（

name

字段），并与

cfunc_t

的标签功能同步。

列名	类型	读写权限	描述
`func_addr`	INT	读	函数地址
`label_num`	INT	读	标签编号（ `LABEL_<n>` ）
`name`	TEXT	读写	当前标签名称
`item_id`	INT	读	该标签对应的ctree项ID
`item_ea`	INT	读	承载标签的ctree项地址
`is_user_defined`	INT	读	1表示名称与默认 `LABEL_<n>` 不同

ctree_call_args

Flattened call arguments for easy querying.

Column	Type	Description
`func_addr`	INT	Function address
`call_item_id`	INT	Call node ID
`call_ea`	INT	Call-site EA
`call_obj_name`	TEXT	Callee object name
`call_helper_name`	TEXT	Callee helper name
`arg_idx`	INT	Argument index (0-based)
`arg_item_id`	INT	Argument expression item ID
`arg_op`	TEXT	Argument type
`arg_var_name`	TEXT	Variable name if applicable
`arg_num_value`	INT	Numeric value
`arg_str_value`	TEXT	String value

扁平化的调用参数，便于查询。

列名	类型	描述
`func_addr`	INT	函数地址
`call_item_id`	INT	调用节点ID
`call_ea`	INT	调用位置EA
`call_obj_name`	TEXT	被调用对象名称
`call_helper_name`	TEXT	被调用辅助函数名称
`arg_idx`	INT	参数索引（从0开始）
`arg_item_id`	INT	参数表达式项ID
`arg_op`	TEXT	参数类型
`arg_var_name`	TEXT	变量名称（如有）
`arg_num_value`	INT	数值
`arg_str_value`	TEXT	字符串值

Decompiler Views

反编译器视图

Pre-built views for common patterns (always filter by

func_addr

View	Purpose
`ctree_v_calls`	Function calls with callee info
`ctree_v_indirect_calls`	Indirect/dynamic call sites for call-site typing
`pseudocode_v_orphan_comment_groups`	Grouped orphan comment triage
`ctree_v_loops`	for/while/do loops
`ctree_v_ifs`	if statements
`ctree_v_comparisons`	Comparisons with operands
`ctree_v_assignments`	Assignments with operands
`ctree_v_derefs`	Pointer dereferences
`ctree_v_returns`	Return statements with value details
`ctree_v_calls_in_loops`	Calls inside loops (recursive)
`ctree_v_calls_in_ifs`	Calls inside if branches (recursive)
`ctree_v_leaf_funcs`	Functions with no outgoing calls
`ctree_v_call_chains`	Call chain paths up to depth 10

预构建的常用模式视图（始终通过

func_addr

过滤）：

视图	用途
`ctree_v_calls`	包含被调用方信息的函数调用
`ctree_v_indirect_calls`	用于调用位置类型标注的间接/动态调用位置
`pseudocode_v_orphan_comment_groups`	分组的过期注释排查
`ctree_v_loops`	for/while/do循环
`ctree_v_ifs`	if语句
`ctree_v_comparisons`	包含操作数的比较语句
`ctree_v_assignments`	包含操作数的赋值语句
`ctree_v_derefs`	指针解引用
`ctree_v_returns`	包含返回值详情的返回语句
`ctree_v_calls_in_loops`	循环内的调用（递归）
`ctree_v_calls_in_ifs`	if分支内的调用（递归）
`ctree_v_leaf_funcs`	无对外调用的函数
`ctree_v_call_chains`	深度最多为10的调用链路径

Type Tables and Views

类型表与视图

For

types

types_members

types_enum_values

types_func_args

schemas, type views, and type CRUD examples, see

types

skill.

关于

types

、

types_members

、

types_enum_values

、

types_func_args

的结构、类型视图及类型增删改查示例，请查看

types

技能文档。

SQL Functions — Decompilation

SQL函数——反编译相关

When to use
decompile()
vs
pseudocode
table:

Read/show pseudocode -> always start with
```
SELECT decompile(addr)
```
. Returns full function as one text block with per-line prefixes.
Local declaration hints -> declaration lines include compact local-variable index hints (
```
[lv:N]
```
) so rename operations can target
```
UPDATE ctree_lvars ... WHERE func_addr = ... AND idx = N
```
safely.
Need fresh output after edits -> use
```
SELECT decompile(addr, 1)
```
to force re-decompilation.
Need structured line access or comment CRUD -> query/update the
```
pseudocode
```
table.

Function	Description
`decompile(addr)`	PREFERRED -- Full pseudocode with line prefixes
`decompile(addr, 1)`	Same output but forces re-decompilation
`apply_callee_type(call_ea, decl)`	Apply a prototype to one call site
`callee_type_at(call_ea)`	Read explicit call-site prototype when present
`call_arg_addrs(call_ea)`	Read persisted argument-loader addresses as JSON
`set_union_selection(func_addr, ea, path)`	Set/clear union selection path at EA
`set_union_selection_item(func_addr, item_id, path)`	Set/clear union selection path by `ctree.item_id`
`set_union_selection_ea_arg(func_addr, ea, arg_idx, path[, callee])`	PREFERRED call-arg targeting helper
`call_arg_item(func_addr, ea, arg_idx[, callee])`	Resolve call-arg coordinate to explicit `arg_item_id`
`ctree_item_at(func_addr, ea[, op_name[, nth]])`	Resolve generic expression coordinate to explicit `ctree.item_id`
`set_union_selection_ea_expr(func_addr, ea, path[, op_name[, nth]])`	Set/clear union selection via generic expression coordinate
`get_union_selection(func_addr, ea)`	Read union selection path JSON at EA
`get_union_selection_item(func_addr, item_id)`	Read union selection path JSON by `ctree.item_id`
`get_union_selection_ea_arg(func_addr, ea, arg_idx[, callee])`	Read union selection JSON via call-arg coordinate
`get_union_selection_ea_expr(func_addr, ea[, op_name[, nth]])`	Read union selection JSON via generic expression coordinate
`set_numform(func_addr, ea, opnum, spec)`	Set/clear numform directly by EA + operand index
`get_numform(func_addr, ea, opnum)`	Read numform JSON directly by EA + operand index
`set_numform_item(func_addr, item_id, opnum, spec)`	Set/clear numform by explicit ctree item id
`get_numform_item(func_addr, item_id, opnum)`	Read numform JSON by explicit ctree item id
`set_numform_ea_arg(func_addr, ea, arg_idx, opnum, spec[, callee])`	Set/clear numform via call-arg coordinate
`get_numform_ea_arg(func_addr, ea, arg_idx, opnum[, callee])`	Read numform JSON via call-arg coordinate
`set_numform_ea_expr(func_addr, ea, opnum, spec[, op_name[, nth]])`	Set/clear numform via generic expression coordinate
`get_numform_ea_expr(func_addr, ea, opnum[, op_name[, nth]])`	Read numform JSON via generic expression coordinate

Targeting guidance:

Use
```
*_ea_arg
```
helpers for repeated callees and call-site arguments.
Use
```
ctree_item_at(..., op_name, nth)
```
plus
```
*_ea_expr
```
helpers for non-call expressions and assignment-side struct/union population stores.

何时使用
decompile()
vs
pseudocode
表：

读取/展示伪代码 -> 始终从
```
SELECT decompile(addr)
```
开始。返回带行前缀的完整函数文本块。
局部声明提示 -> 声明行包含紧凑的局部变量索引提示（
```
[lv:N]
```
），因此重命名操作可以安全地使用
```
UPDATE ctree_lvars ... WHERE func_addr = ... AND idx = N
```
。
编辑后需要刷新输出 -> 使用
```
SELECT decompile(addr, 1)
```
强制重新反编译。
需要结构化行访问或注释增删改查 -> 查询/更新
```
pseudocode
```
表。

函数	描述
`decompile(addr)`	推荐使用 -- 带行前缀的完整伪代码
`decompile(addr, 1)`	输出内容相同，但强制重新反编译
`apply_callee_type(call_ea, decl)`	为单个调用位置应用原型
`callee_type_at(call_ea)`	读取调用位置的显式原型（如有）
`call_arg_addrs(call_ea)`	以JSON格式读取持久化的参数加载地址
`set_union_selection(func_addr, ea, path)`	在EA位置设置/清除联合体选择路径
`set_union_selection_item(func_addr, item_id, path)`	通过 `ctree.item_id` 设置/清除联合体选择路径
`set_union_selection_ea_arg(func_addr, ea, arg_idx, path[, callee])`	推荐使用的调用参数定位辅助函数
`call_arg_item(func_addr, ea, arg_idx[, callee])`	将调用参数坐标解析为明确的 `arg_item_id`
`ctree_item_at(func_addr, ea[, op_name[, nth]])`	将通用表达式坐标解析为明确的 `ctree.item_id`
`set_union_selection_ea_expr(func_addr, ea, path[, op_name[, nth]])`	通过通用表达式坐标设置/清除联合体选择路径
`get_union_selection(func_addr, ea)`	读取EA位置的联合体选择路径JSON
`get_union_selection_item(func_addr, item_id)`	通过 `ctree.item_id` 读取联合体选择路径JSON
`get_union_selection_ea_arg(func_addr, ea, arg_idx[, callee])`	通过调用参数坐标读取联合体选择路径JSON
`get_union_selection_ea_expr(func_addr, ea[, op_name[, nth]])`	通过通用表达式坐标读取联合体选择路径JSON
`set_numform(func_addr, ea, opnum, spec)`	通过EA + 操作数索引直接设置/清除数值格式
`get_numform(func_addr, ea, opnum)`	通过EA + 操作数索引直接读取数值格式JSON
`set_numform_item(func_addr, item_id, opnum, spec)`	通过明确的ctree项ID设置/清除数值格式
`get_numform_item(func_addr, item_id, opnum)`	通过明确的ctree项ID读取数值格式JSON
`set_numform_ea_arg(func_addr, ea, arg_idx, opnum, spec[, callee])`	通过调用参数坐标设置/清除数值格式
`get_numform_ea_arg(func_addr, ea, arg_idx, opnum[, callee])`	通过调用参数坐标读取数值格式JSON
`set_numform_ea_expr(func_addr, ea, opnum, spec[, op_name[, nth]])`	通过通用表达式坐标设置/清除数值格式
`get_numform_ea_expr(func_addr, ea, opnum[, op_name[, nth]])`	通过通用表达式坐标读取数值格式JSON

定位指南：

对于重复调用的被调用方和调用位置参数，使用
```
*_ea_arg
```
辅助函数。
对于非调用表达式和赋值侧结构体/联合体赋值操作，使用
```
ctree_item_at(..., op_name, nth)
```
搭配
```
*_ea_expr
```
辅助函数。

SQL Functions — Modification

SQL函数——修改相关

For

type_at()

set_type()

parse_decls()

, and name writes via

names

funcs

, see

types

skill.

Preferred SQL write surface for function metadata:

UPDATE funcs SET name = '...', prototype = '...', comment = '...', rpt_comment = '...' WHERE address = ...

```
prototype
```
maps to
```
type_at/set_type
```
behavior and invalidates decompiler cache.

comment

rpt_comment

map to

get_func_cmt()

set_func_cmt()

关于

type_at()

、

set_type()

、

parse_decls()

及通过

names

funcs

修改名称的内容，请查看

types

技能文档。

函数元数据的推荐SQL写入方式：

UPDATE funcs SET name = '...', prototype = '...', comment = '...', rpt_comment = '...' WHERE address = ...

```
prototype
```
与
```
type_at/set_type
```
行为同步，并会使反编译器缓存失效。

comment

rpt_comment

与

get_func_cmt()

set_func_cmt()

行为同步。

Performance Rules

性能规则

Table	Architecture	Key Constraint	Notes
`pseudocode`	Cached	`func_addr`	Lazy per-function cache, freed after query
`pseudocode_orphan_comments`	Cached	`func_addr`	Query-scoped orphan rows; writable delete-only
`pseudocode_v_orphan_comment_groups`	Cached	`func_addr`	Query-scoped grouped orphan triage; start broad with `LIMIT`
`ctree`	Generator	`func_addr`	Lazy streaming, never materializes full result, respects LIMIT
`ctree_lvars`	Cached	`func_addr`	Lazy per-function cache, freed after query
`ctree_call_args`	Generator	`func_addr`	Lazy streaming, respects LIMIT

Critical rules:

ALL decompiler tables require
func_addr
constraint. Without it, every function is decompiled.
Generator tables (
```
ctree
```
,
```
ctree_call_args
```
) stream rows lazily and stop at LIMIT.
Decompiler views (
```
ctree_v_calls
```
,
```
ctree_v_indirect_calls
```
,
```
ctree_v_loops
```
, etc.) inherit the
```
func_addr
```
constraint -- always filter.
Hex-Rays cfunc cache:
```
decompile(addr)
```
is internally cached.
```
decompile(addr, 1)
```
forces a full re-decompilation -- only use when you need to see effects of a mutation.

Cost model:

decompile(addr)          -> ~50-200ms first call, ~0ms cached
decompile(addr, 1)       -> ~50-200ms always (forces re-decompile)
ctree WHERE func_addr=X  -> one decompilation + streaming rows
ctree (no constraint)    -> one decompilation per row in funcs

表	架构	关键约束	说明
`pseudocode`	缓存型	`func_addr`	懒加载的单函数缓存，查询后释放
`pseudocode_orphan_comments`	缓存型	`func_addr`	查询范围内的过期注释行；仅支持删除操作
`pseudocode_v_orphan_comment_groups`	缓存型	`func_addr`	查询范围内的分组过期注释排查；使用 `LIMIT` 来扩大范围
`ctree`	生成器型	`func_addr`	懒加载流式返回，不会生成完整结果集，遵循LIMIT限制
`ctree_lvars`	缓存型	`func_addr`	懒加载的单函数缓存，查询后释放
`ctree_call_args`	生成器型	`func_addr`	懒加载流式返回，遵循LIMIT限制

重要规则：

所有反编译器表都需要
func_addr
约束。没有该约束时，会对所有函数进行反编译。
生成器型表（
```
ctree
```
、
```
ctree_call_args
```
）懒加载流式返回行，并在达到LIMIT时停止。
反编译器视图（
```
ctree_v_calls
```
、
```
ctree_v_indirect_calls
```
、
```
ctree_v_loops
```
等）继承
```
func_addr
```
约束——始终进行过滤。
Hex-Rays cfunc缓存：
```
decompile(addr)
```
内部会缓存结果。
```
decompile(addr, 1)
```
强制完全重新反编译——仅在需要查看修改效果时使用。

成本模型：

decompile(addr)          -> 首次调用约50-200ms，缓存后约0ms
decompile(addr, 1)       -> 始终约50-200ms（强制重新反编译）
ctree WHERE func_addr=X  -> 一次反编译 + 流式返回行
ctree (无约束)    -> 对funcs表中的每个函数各进行一次反编译

Additional Resources

额外资源

For detailed workflows (capability probing, mutation loop, call-site typing, local type seeding, fallback patterns, full worked examples): references/decompiler-workflows.md
For detailed view schemas (ctree_v_indirect_calls, ctree_v_returns): references/decompiler-views.md
For ctree node types, manipulation patterns, and advanced CTEs: references/ctree-manipulation.md

详细工作流（能力探测、修改循环、调用位置类型标注、局部类型植入、 fallback模式、完整示例）：references/decompiler-workflows.md
详细视图结构（ctree_v_indirect_calls、ctree_v_returns）：references/decompiler-views.md
ctree节点类型、操作模式及高级CTE：references/ctree-manipulation.md