get-vtable-index

Name: get-vtable-index
Author: HLND2T

58stars10forks

How to install get-vtable-index?

hlnd2t/cs2_vibesignatures/get-vtable-index

$npx -y skills add HLND2T/CS2_VibeSignatures --skill get-vtable-index

Installs into the current project.

Summary

Find a function's vtable offset and index using IDA Pro MCP. Use this skill when you have a function address and need to determine its position in a vtable by iterating through vtable entries. Triggers: vtable index, vftable offset, virtual function table position, find function

Files · 1

View on GitHub

SKILL.md

1	# Get VTable Index
2
3	Find a function's position (offset and index) within a vtable by iterating through vtable entries.
4
5	## Prerequisites
6
7	- Function address (from decompilation or xrefs)
8	- ClassName (to get vtable via `get-vtable-address` skill)
9	- platform (either `windows` or `linux`, depending on the binary we are analyzing)
10
11	## Method
12
13	### 1. Load vtable YAML and find function index:
14
15	ALWAYS first check if `{ClassName}_vtable.{platform}.yaml` exists beside the binary, then search for the function in `vtable_entries`:
16
17	```python
18	mcp__ida-pro-mcp__py_eval code="""
19	import idaapi
20	import yaml
21	import os
22
23	# === REQUIRED: Replace these values ===
24	class_name = "<ClassName>" # e.g., "CCSPlayerPawn"
25	func_addr = <FUNC_ADDRESS> # Target function address to find
26	# ======================================
27
28	input_file = idaapi.get_input_file_path()
29	dir_path = os.path.dirname(input_file)
30	platform = 'windows' if input_file.endswith('.dll') else 'linux'
31
32	yaml_path = os.path.join(dir_path, f"{class_name}_vtable.{platform}.yaml")
33
34	if not os.path.exists(yaml_path):
35	print(f"ERROR: Required file {class_name}_vtable.{platform}.yaml not found.")
36	print(f"Expected path: {yaml_path}")
37	print(f"Please run `/find-{class_name}_vtable` first to generate the vtable YAML file.")
38	else:
39	with open(yaml_path, 'r', encoding='utf-8') as f:
40	data = yaml.safe_load(f)
41
42	vtable_entries = data.get('vtable_entries', {})
43	vtable_va = data.get('vtable_va')
44	ptr_size = 8 if idaapi.inf_is_64bit() else 4
45
46	for idx, entry in vtable_entries.items():
47	# Handle both int and hex string formats
48	i = int(idx) if isinstance(idx, str) else idx
49	entry_addr = int(entry, 16) if isinstance(entry, str) else entry
50	if entry_addr == func_addr:
51	offset = i * ptr_size
52	print(f"Found at vfunc_offset: {hex(offset)}, vfunc_index: {i}")
53	print(f"vtable_va: {hex(vtable_va) if isinstance(vtable_va, int) else vtable_va}")
54	break
55	else:
56	print(f"Function {hex(func_addr)} not found in {class_name} vtable entries!")
57	"""
58	```
59
60	Replace:
61	- `<ClassName>` with the target class name (e.g., `CCSPlayerPawn`)
62	- `<FUNC_ADDRESS>` with the target function address
63
64	IMPORTANT: Use the function entry address. VTables store pointers to the function start; string xrefs often land in the middle of a function. If you only have an address inside the function, resolve the real entry first:
65	```python
66	mcp__ida-pro-mcp__py_eval code="""
67	import idaapi
68	addr_inside_func = <ADDRESS_INSIDE_FUNCTION>
69	f = idaapi.get_func(addr_inside_func)
70	print(f"Function entry: {hex(f.start_ea)}" if f else "Not inside a function")
71	"""
72	```
73
74	### 2. Continue with the unfinished tasks
75
76	If we are called by a task from a task list / parent SKILL, restore and continue with the unfinished tasks.
77
78	## Formulas
79
80	- `vfunc_offset = index × ptr_size` (ptr_size = 8 for 64-bit, 4 for 32-bit)
81	- `vfunc_index = offset / ptr_size`, and is the index of the entry in `vtable_entries`.

People who liked this also viewed

6 picks

Type

get-vtable-index

58stars10forks

View on GitHub

How to install get-vtable-index?

hlnd2t/cs2_vibesignatures/get-vtable-index

$npx -y skills add HLND2T/CS2_VibeSignatures --skill get-vtable-index

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Get VTable Index
2
3	Find a function's position (offset and index) within a vtable by iterating through vtable entries.
4
5	## Prerequisites
6
7	- Function address (from decompilation or xrefs)
8	- ClassName (to get vtable via `get-vtable-address` skill)
9	- platform (either `windows` or `linux`, depending on the binary we are analyzing)
10
11	## Method
12
13	### 1. Load vtable YAML and find function index:
14
15	ALWAYS first check if `{ClassName}_vtable.{platform}.yaml` exists beside the binary, then search for the function in `vtable_entries`:
16
17	```python
18	mcp__ida-pro-mcp__py_eval code="""
19	import idaapi
20	import yaml
21	import os
22
23	# === REQUIRED: Replace these values ===
24	class_name = "<ClassName>" # e.g., "CCSPlayerPawn"
25	func_addr = <FUNC_ADDRESS> # Target function address to find
26	# ======================================
27
28	input_file = idaapi.get_input_file_path()
29	dir_path = os.path.dirname(input_file)
30	platform = 'windows' if input_file.endswith('.dll') else 'linux'
31
32	yaml_path = os.path.join(dir_path, f"{class_name}_vtable.{platform}.yaml")
33
34	if not os.path.exists(yaml_path):
35	print(f"ERROR: Required file {class_name}_vtable.{platform}.yaml not found.")
36	print(f"Expected path: {yaml_path}")
37	print(f"Please run `/find-{class_name}_vtable` first to generate the vtable YAML file.")
38	else:
39	with open(yaml_path, 'r', encoding='utf-8') as f:
40	data = yaml.safe_load(f)
41
42	vtable_entries = data.get('vtable_entries', {})
43	vtable_va = data.get('vtable_va')
44	ptr_size = 8 if idaapi.inf_is_64bit() else 4
45
46	for idx, entry in vtable_entries.items():
47	# Handle both int and hex string formats
48	i = int(idx) if isinstance(idx, str) else idx
49	entry_addr = int(entry, 16) if isinstance(entry, str) else entry
50	if entry_addr == func_addr:
51	offset = i * ptr_size
52	print(f"Found at vfunc_offset: {hex(offset)}, vfunc_index: {i}")
53	print(f"vtable_va: {hex(vtable_va) if isinstance(vtable_va, int) else vtable_va}")
54	break
55	else:
56	print(f"Function {hex(func_addr)} not found in {class_name} vtable entries!")
57	"""
58	```
59
60	Replace:
61	- `<ClassName>` with the target class name (e.g., `CCSPlayerPawn`)
62	- `<FUNC_ADDRESS>` with the target function address
63
64	IMPORTANT: Use the function entry address. VTables store pointers to the function start; string xrefs often land in the middle of a function. If you only have an address inside the function, resolve the real entry first:
65	```python
66	mcp__ida-pro-mcp__py_eval code="""
67	import idaapi
68	addr_inside_func = <ADDRESS_INSIDE_FUNCTION>
69	f = idaapi.get_func(addr_inside_func)
70	print(f"Function entry: {hex(f.start_ea)}" if f else "Not inside a function")
71	"""
72	```
73
74	### 2. Continue with the unfinished tasks
75
76	If we are called by a task from a task list / parent SKILL, restore and continue with the unfinished tasks.
77
78	## Formulas
79
80	- `vfunc_offset = index × ptr_size` (ptr_size = 8 for 64-bit, 4 for 32-bit)
81	- `vfunc_index = offset / ptr_size`, and is the index of the entry in `vtable_entries`.

People who liked this also viewed

6 picks

Type