write-patch-as-yaml

Name: write-patch-as-yaml
Author: HLND2T

58stars10forks

How to install write-patch-as-yaml?

hlnd2t/cs2_vibesignatures/write-patch-as-yaml

$npx -y skills add HLND2T/CS2_VibeSignatures --skill write-patch-as-yaml

Installs into the current project.

Summary

Write patch analysis results as YAML file beside the binary using IDA Pro MCP. Use this skill after identifying a patch target and generating a signature for it to persist the results in a standardized YAML format.

Files · 1

View on GitHub

SKILL.md

1	# Write Patch as YAML
2
3	Persist a single patch analysis result to a YAML file beside the binary using IDA Pro MCP.
4
5	## Prerequisites
6
7	Before using this skill, you should have:
8	1. Identified the patch name and determined `patch_bytes`
9	2. Generated a unique signature using `/generate-signature-for-patch`
10
11	## Required Parameters
12
13	\| Parameter \| Description \| Example \|
14	\|-----------\|-------------\|---------\|
15	\| `patch_name` \| Descriptive name of the patch \| `ServerMovementUnlock` \|
16	\| `patch_sig` \| Unique byte signature locating the instruction to patch \| `0F 86 AF 00 00 00 0F 57 C0 0F 2E C2` \|
17	\| `patch_bytes` \| Replacement bytes to write at the patch location \| `E9 B0 00 00 00 90` \|
18
19	## Optional Parameters
20
21	\| Parameter \| Description \| Example \|
22	\|-----------\|-------------\|---------\|
23	\| `patch_sig_disp` \| Byte displacement from signature start to the target instruction. `0` or `None` means signature starts at the target instruction. Non-zero means backward expansion was used by `/generate-signature-for-patch`. (use `None` to omit) \| `5` \|
24
25	## Method
26
27	```python
28	mcp__ida-pro-mcp__py_eval code="""
29	import idaapi
30	import os
31	import yaml
32
33	# === REQUIRED: Replace these values ===
34	patch_name = "<patch_name>" # e.g., "ServerMovementUnlock"
35	patch_sig = "<patch_sig>" # e.g., "0F 86 AF 00 00 00 0F 57 C0 0F 2E C2"
36	patch_bytes = "<patch_bytes>" # e.g., "E9 B0 00 00 00 90"
37	# ======================================
38
39	# === OPTIONAL: Set to None to omit from output ===
40	patch_sig_disp = <patch_sig_disp> # e.g., 5 or None (0 also omitted)
41	# =================================================
42
43	# Get binary path and determine platform
44	input_file = idaapi.get_input_file_path()
45	dir_path = os.path.dirname(input_file)
46
47	if input_file.endswith('.dll'):
48	platform = 'windows'
49	else:
50	platform = 'linux'
51
52	# Build data dictionary conditionally
53	data = {}
54
55	data['patch_name'] = patch_name
56	data['patch_sig'] = patch_sig
57
58	if patch_sig_disp is not None and patch_sig_disp > 0:
59	data['patch_sig_disp'] = patch_sig_disp
60
61	data['patch_bytes'] = patch_bytes
62
63	yaml_path = os.path.join(dir_path, f"{patch_name}.{platform}.yaml")
64	with open(yaml_path, 'w', encoding='utf-8') as f:
65	yaml.dump(data, f, default_flow_style=False, sort_keys=False, allow_unicode=True)
66	print(f"Written to: {yaml_path}")
67	"""
68	```
69
70	## Output File Naming Convention
71
72	The output YAML filename follows this pattern:
73	- `<patch_name>.<platform>.yaml`
74
75	Examples:
76	- `server.dll` → `ServerMovementUnlock.windows.yaml`
77	- `libserver.so` / `libserver.so` → `ServerMovementUnlock.linux.yaml`
78
79	## Output YAML Format
80
81	Full output (with `patch_sig_disp` provided):
82	```yaml
83	patch_name: ServerMovementUnlock
84	patch_sig: 48 85 C0 74 ?? E8 ?? ?? ?? ?? 0F 86 AF 00 00 00
85	patch_sig_disp: 5
86	patch_bytes: E9 B0 00 00 00 90
87	```
88
89	Standard output (without backward expansion, `patch_sig_disp` is 0 or omitted):
90	```yaml
91	patch_name: ServerMovementUnlock
92	patch_sig: 0F 86 AF 00 00 00 0F 57 C0 0F 2E C2
93	patch_bytes: E9 B0 00 00 00 90
94	```
95
96	Each field:
97	- `patch_name` - Descriptive name of the patch
98	- `patch_sig` - Unique byte signature locating the instruction to patch
99	- `patch_sig_disp` (optional) - Byte displacement from signature start to the target instruction. Only present when non-zero (backward expansion was used). Runtime: scan for `patch_sig`, then add `patch_sig_disp` to get the target instruction address.
100	- `patch_bytes` - Replacement bytes to write at the patch location
101
102	## Platform Detection
103
104	The skill automatically detects the platform based on file extension:
105	- `.dll` → Windows
106	- `.so` → Linux
107
108	## Example Usage
109
110	### Standard patch (forward-only signature)
111
112	```python
113	patch_name = "ServerMovementUnlock"
114	patch_sig = "0F 86 AF 00 00 00 0F 57 C0 0F 2E C2"
115	patch_bytes = "E9 B0 00 00 00 90"
116	patch_sig_disp = None
117	```
118
119	### Patch with backward-expanded signature
120
121	```python
122	patch_name = "DisableSteamBanCheck"
123	patch_sig = "48 85 C0 74 ?? E8 ?? ?? ?? ?? 0F 84 AA 00 00 00"
124	patch_bytes = "90 90 90 90 90 90"
125	patch_sig_disp = 5
126	```
127
128	### NOP a call instruction
129
130	```python
131	patch_name = "SkipPrecacheCall"
132	patch_sig = "E8 AA BB CC DD 48 8B 5C 24 30"
133	patch_bytes = "90 90 90 90 90"
134	patch_sig_disp = None
135	```
136
137	## Notes
138
139	- The YAML file is written to the same directory as the input binary
140	- When `patch_sig_disp` is `None` or `0`, the `patch_sig_disp` field is omitted from the output entirely (signature starts at the target instruction)
141	- `patch_sig` should be a signature generated by `/generate-signature-for-patch`
142	- `patch_bytes` must have the same byte count as the original instruction being patched
143	- `patch_sig_disp` is the byte displacement from signature start to the target instruction, only needed when backward expansion was used

People who liked this also viewed

6 picks

Type

write-patch-as-yaml

58stars10forks

View on GitHub

How to install write-patch-as-yaml?

hlnd2t/cs2_vibesignatures/write-patch-as-yaml

$npx -y skills add HLND2T/CS2_VibeSignatures --skill write-patch-as-yaml

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Write Patch as YAML
2
3	Persist a single patch analysis result to a YAML file beside the binary using IDA Pro MCP.
4
5	## Prerequisites
6
7	Before using this skill, you should have:
8	1. Identified the patch name and determined `patch_bytes`
9	2. Generated a unique signature using `/generate-signature-for-patch`
10
11	## Required Parameters
12
13	\| Parameter \| Description \| Example \|
14	\|-----------\|-------------\|---------\|
15	\| `patch_name` \| Descriptive name of the patch \| `ServerMovementUnlock` \|
16	\| `patch_sig` \| Unique byte signature locating the instruction to patch \| `0F 86 AF 00 00 00 0F 57 C0 0F 2E C2` \|
17	\| `patch_bytes` \| Replacement bytes to write at the patch location \| `E9 B0 00 00 00 90` \|
18
19	## Optional Parameters
20
21	\| Parameter \| Description \| Example \|
22	\|-----------\|-------------\|---------\|
23	\| `patch_sig_disp` \| Byte displacement from signature start to the target instruction. `0` or `None` means signature starts at the target instruction. Non-zero means backward expansion was used by `/generate-signature-for-patch`. (use `None` to omit) \| `5` \|
24
25	## Method
26
27	```python
28	mcp__ida-pro-mcp__py_eval code="""
29	import idaapi
30	import os
31	import yaml
32
33	# === REQUIRED: Replace these values ===
34	patch_name = "<patch_name>" # e.g., "ServerMovementUnlock"
35	patch_sig = "<patch_sig>" # e.g., "0F 86 AF 00 00 00 0F 57 C0 0F 2E C2"
36	patch_bytes = "<patch_bytes>" # e.g., "E9 B0 00 00 00 90"
37	# ======================================
38
39	# === OPTIONAL: Set to None to omit from output ===
40	patch_sig_disp = <patch_sig_disp> # e.g., 5 or None (0 also omitted)
41	# =================================================
42
43	# Get binary path and determine platform
44	input_file = idaapi.get_input_file_path()
45	dir_path = os.path.dirname(input_file)
46
47	if input_file.endswith('.dll'):
48	platform = 'windows'
49	else:
50	platform = 'linux'
51
52	# Build data dictionary conditionally
53	data = {}
54
55	data['patch_name'] = patch_name
56	data['patch_sig'] = patch_sig
57
58	if patch_sig_disp is not None and patch_sig_disp > 0:
59	data['patch_sig_disp'] = patch_sig_disp
60
61	data['patch_bytes'] = patch_bytes
62
63	yaml_path = os.path.join(dir_path, f"{patch_name}.{platform}.yaml")
64	with open(yaml_path, 'w', encoding='utf-8') as f:
65	yaml.dump(data, f, default_flow_style=False, sort_keys=False, allow_unicode=True)
66	print(f"Written to: {yaml_path}")
67	"""
68	```
69
70	## Output File Naming Convention
71
72	The output YAML filename follows this pattern:
73	- `<patch_name>.<platform>.yaml`
74
75	Examples:
76	- `server.dll` → `ServerMovementUnlock.windows.yaml`
77	- `libserver.so` / `libserver.so` → `ServerMovementUnlock.linux.yaml`
78
79	## Output YAML Format
80
81	Full output (with `patch_sig_disp` provided):
82	```yaml
83	patch_name: ServerMovementUnlock
84	patch_sig: 48 85 C0 74 ?? E8 ?? ?? ?? ?? 0F 86 AF 00 00 00
85	patch_sig_disp: 5
86	patch_bytes: E9 B0 00 00 00 90
87	```
88
89	Standard output (without backward expansion, `patch_sig_disp` is 0 or omitted):
90	```yaml
91	patch_name: ServerMovementUnlock
92	patch_sig: 0F 86 AF 00 00 00 0F 57 C0 0F 2E C2
93	patch_bytes: E9 B0 00 00 00 90
94	```
95
96	Each field:
97	- `patch_name` - Descriptive name of the patch
98	- `patch_sig` - Unique byte signature locating the instruction to patch
99	- `patch_sig_disp` (optional) - Byte displacement from signature start to the target instruction. Only present when non-zero (backward expansion was used). Runtime: scan for `patch_sig`, then add `patch_sig_disp` to get the target instruction address.
100	- `patch_bytes` - Replacement bytes to write at the patch location
101
102	## Platform Detection
103
104	The skill automatically detects the platform based on file extension:
105	- `.dll` → Windows
106	- `.so` → Linux
107
108	## Example Usage
109
110	### Standard patch (forward-only signature)
111
112	```python
113	patch_name = "ServerMovementUnlock"
114	patch_sig = "0F 86 AF 00 00 00 0F 57 C0 0F 2E C2"
115	patch_bytes = "E9 B0 00 00 00 90"
116	patch_sig_disp = None
117	```
118
119	### Patch with backward-expanded signature
120
121	```python
122	patch_name = "DisableSteamBanCheck"
123	patch_sig = "48 85 C0 74 ?? E8 ?? ?? ?? ?? 0F 84 AA 00 00 00"
124	patch_bytes = "90 90 90 90 90 90"
125	patch_sig_disp = 5
126	```
127
128	### NOP a call instruction
129
130	```python
131	patch_name = "SkipPrecacheCall"
132	patch_sig = "E8 AA BB CC DD 48 8B 5C 24 30"
133	patch_bytes = "90 90 90 90 90"
134	patch_sig_disp = None
135	```
136
137	## Notes
138
139	- The YAML file is written to the same directory as the input binary
140	- When `patch_sig_disp` is `None` or `0`, the `patch_sig_disp` field is omitted from the output entirely (signature starts at the target instruction)
141	- `patch_sig` should be a signature generated by `/generate-signature-for-patch`
142	- `patch_bytes` must have the same byte count as the original instruction being patched
143	- `patch_sig_disp` is the byte displacement from signature start to the target instruction, only needed when backward expansion was used

People who liked this also viewed

6 picks

Type