write-structoffset-as-yaml

Name: write-structoffset-as-yaml
Author: HLND2T

58stars10forks

How to install write-structoffset-as-yaml?

hlnd2t/cs2_vibesignatures/write-structoffset-as-yaml

$npx -y skills add HLND2T/CS2_VibeSignatures --skill write-structoffset-as-yaml

Installs into the current project.

Summary

Write struct member offset analysis results as YAML file beside the binary using IDA Pro MCP. Use this skill after identifying a struct member offset and optionally generating a signature for it to persist the results in a standardized YAML format.

Files · 1

View on GitHub

SKILL.md

1	# Write Struct Offset as YAML
2
3	Persist a single struct member offset analysis result to a YAML file beside the binary using IDA Pro MCP.
4
5	## Prerequisites
6
7	Before using this skill, you should have:
8	1. Identified the struct name and member name
9	2. Determined the member offset (and optionally size)
10	3. Generated a unique signature using `/generate-signature-for-structoffset`
11
12	## Required Parameters
13
14	\| Parameter \| Description \| Example \|
15	\|-----------\|-------------\|---------\|
16	\| `struct_name` \| Name of the struct/class \| `CBaseEntity` \|
17	\| `member_name` \| Name of the struct member \| `m_skeletonInstance` \|
18	\| `offset` \| Hex offset of the member from struct start \| `0x278` \|
19
20	## Optional Parameters
21
22	\| Parameter \| Description \| Example \|
23	\|-----------\|-------------\|---------\|
24	\| `size` \| Size of the member in bytes (use `None` to omit) \| `8` \|
25	\| `offset_sig` \| Unique byte signature locating an instruction that contains the offset (use `None` to omit) \| `8B 93 E0 04 00 00` \|
26	\| `offset_sig_disp` \| Byte displacement from signature start to the target instruction. `0` or `None` means signature starts at the target instruction. Non-zero means backward expansion was used by `/generate-signature-for-structoffset`. (use `None` to omit) \| `8` \|
27
28	## Method
29
30	```python
31	mcp__ida-pro-mcp__py_eval code="""
32	import idaapi
33	import os
34	import yaml
35
36	# === REQUIRED: Replace these values ===
37	struct_name = "<struct_name>" # e.g., "CBaseEntity"
38	member_name = "<member_name>" # e.g., "m_skeletonInstance"
39	offset = <offset> # e.g., 0x278
40	# ======================================
41
42	# === OPTIONAL: Set to None to omit from output ===
43	size = <size> # e.g., 8 or None
44	offset_sig = <offset_sig> # e.g., "8B 93 E0 04 00 00" or None
45	offset_sig_disp = <offset_sig_disp> # e.g., 8 or None (0 also omitted)
46	# =================================================
47
48	# Get binary path and determine platform
49	input_file = idaapi.get_input_file_path()
50	dir_path = os.path.dirname(input_file)
51
52	if input_file.endswith('.dll'):
53	platform = 'windows'
54	else:
55	platform = 'linux'
56
57	# Build data dictionary conditionally
58	data = {}
59
60	data['struct_name'] = struct_name
61	data['member_name'] = member_name
62	data['offset'] = hex(offset)
63
64	if size is not None and size > 0:
65	data['size'] = size
66
67	if offset_sig is not None:
68	data['offset_sig'] = offset_sig
69
70	if offset_sig_disp is not None and offset_sig_disp > 0:
71	data['offset_sig_disp'] = offset_sig_disp
72
73	yaml_path = os.path.join(dir_path, f"{struct_name}_{member_name}.{platform}.yaml")
74	with open(yaml_path, 'w', encoding='utf-8') as f:
75	yaml.dump(data, f, default_flow_style=False, sort_keys=False, allow_unicode=True)
76	print(f"Written to: {yaml_path}")
77	"""
78	```
79
80	## Output File Naming Convention
81
82	The output YAML filename follows this pattern:
83	- `<struct_name>_<member_name>.<platform>.yaml`
84
85	Examples:
86	- `server.dll` → `CBaseEntity_m_skeletonInstance.windows.yaml`
87	- `libserver.so` / `libserver.so` → `CBaseEntity_m_skeletonInstance.linux.yaml`
88
89	## Output YAML Format
90
91	Full output (with `size`, `offset_sig`, and `offset_sig_disp` provided):
92	```yaml
93	struct_name: CBaseEntity
94	member_name: m_skeletonInstance
95	offset: 0x278
96	size: 8
97	offset_sig: FF 50 ?? 48 85 C0 74 ?? 48 8B 80 A0 03 00 00 48 83 C4 28 C3
98	offset_sig_disp: 8
99	```
100
101	Output without backward expansion (`offset_sig_disp` is 0 or omitted):
102	```yaml
103	struct_name: CBaseEntity
104	member_name: m_skeletonInstance
105	offset: 0x278
106	size: 8
107	offset_sig: 8B 93 78 02 00 00
108	```
109
110	Minimal output (with `size=None`, `offset_sig=None`):
111	```yaml
112	struct_name: CBaseEntity
113	member_name: m_skeletonInstance
114	offset: 0x278
115	```
116
117	Each field:
118	- `struct_name` - Name of the struct/class
119	- `member_name` - Name of the struct member
120	- `offset` - Hex offset from struct start
121	- `size` (optional) - Size in bytes
122	- `offset_sig` (optional) - Unique byte signature of an instruction containing the offset (e.g., `8B 93 E0 04 00 00` for `mov edx, [rbx+4E0h]`)
123	- `offset_sig_disp` (optional) - Byte displacement from signature start to the target instruction. Only present when non-zero (backward expansion was used). Runtime: scan for `offset_sig`, then add `offset_sig_disp` to get the target instruction address.
124
125	## Platform Detection
126
127	The skill automatically detects the platform based on file extension:
128	- `.dll` → Windows
129	- `.so` → Linux
130
131	## Example Usage
132
133	### With all parameters
134
135	```python
136	struct_name = "CBaseEntity"
137	member_name = "m_skeletonInstance"
138	offset = 0x278
139	size = 8
140	offset_sig = "8B 93 78 02 00 00"
141	offset_sig_disp = None
142	```
143
144	### With backward-expanded signature
145
146	```python
147	struct_name = "CSkeletonInstance"
148	member_name = "m_animationController"
149	offset = 0x3A

People who liked this also viewed

6 picks

Type

write-structoffset-as-yaml

58stars10forks

View on GitHub

How to install write-structoffset-as-yaml?

hlnd2t/cs2_vibesignatures/write-structoffset-as-yaml

$npx -y skills add HLND2T/CS2_VibeSignatures --skill write-structoffset-as-yaml

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Write Struct Offset as YAML
2
3	Persist a single struct member offset analysis result to a YAML file beside the binary using IDA Pro MCP.
4
5	## Prerequisites
6
7	Before using this skill, you should have:
8	1. Identified the struct name and member name
9	2. Determined the member offset (and optionally size)
10	3. Generated a unique signature using `/generate-signature-for-structoffset`
11
12	## Required Parameters
13
14	\| Parameter \| Description \| Example \|
15	\|-----------\|-------------\|---------\|
16	\| `struct_name` \| Name of the struct/class \| `CBaseEntity` \|
17	\| `member_name` \| Name of the struct member \| `m_skeletonInstance` \|
18	\| `offset` \| Hex offset of the member from struct start \| `0x278` \|
19
20	## Optional Parameters
21
22	\| Parameter \| Description \| Example \|
23	\|-----------\|-------------\|---------\|
24	\| `size` \| Size of the member in bytes (use `None` to omit) \| `8` \|
25	\| `offset_sig` \| Unique byte signature locating an instruction that contains the offset (use `None` to omit) \| `8B 93 E0 04 00 00` \|
26	\| `offset_sig_disp` \| Byte displacement from signature start to the target instruction. `0` or `None` means signature starts at the target instruction. Non-zero means backward expansion was used by `/generate-signature-for-structoffset`. (use `None` to omit) \| `8` \|
27
28	## Method
29
30	```python
31	mcp__ida-pro-mcp__py_eval code="""
32	import idaapi
33	import os
34	import yaml
35
36	# === REQUIRED: Replace these values ===
37	struct_name = "<struct_name>" # e.g., "CBaseEntity"
38	member_name = "<member_name>" # e.g., "m_skeletonInstance"
39	offset = <offset> # e.g., 0x278
40	# ======================================
41
42	# === OPTIONAL: Set to None to omit from output ===
43	size = <size> # e.g., 8 or None
44	offset_sig = <offset_sig> # e.g., "8B 93 E0 04 00 00" or None
45	offset_sig_disp = <offset_sig_disp> # e.g., 8 or None (0 also omitted)
46	# =================================================
47
48	# Get binary path and determine platform
49	input_file = idaapi.get_input_file_path()
50	dir_path = os.path.dirname(input_file)
51
52	if input_file.endswith('.dll'):
53	platform = 'windows'
54	else:
55	platform = 'linux'
56
57	# Build data dictionary conditionally
58	data = {}
59
60	data['struct_name'] = struct_name
61	data['member_name'] = member_name
62	data['offset'] = hex(offset)
63
64	if size is not None and size > 0:
65	data['size'] = size
66
67	if offset_sig is not None:
68	data['offset_sig'] = offset_sig
69
70	if offset_sig_disp is not None and offset_sig_disp > 0:
71	data['offset_sig_disp'] = offset_sig_disp
72
73	yaml_path = os.path.join(dir_path, f"{struct_name}_{member_name}.{platform}.yaml")
74	with open(yaml_path, 'w', encoding='utf-8') as f:
75	yaml.dump(data, f, default_flow_style=False, sort_keys=False, allow_unicode=True)
76	print(f"Written to: {yaml_path}")
77	"""
78	```
79
80	## Output File Naming Convention
81
82	The output YAML filename follows this pattern:
83	- `<struct_name>_<member_name>.<platform>.yaml`
84
85	Examples:
86	- `server.dll` → `CBaseEntity_m_skeletonInstance.windows.yaml`
87	- `libserver.so` / `libserver.so` → `CBaseEntity_m_skeletonInstance.linux.yaml`
88
89	## Output YAML Format
90
91	Full output (with `size`, `offset_sig`, and `offset_sig_disp` provided):
92	```yaml
93	struct_name: CBaseEntity
94	member_name: m_skeletonInstance
95	offset: 0x278
96	size: 8
97	offset_sig: FF 50 ?? 48 85 C0 74 ?? 48 8B 80 A0 03 00 00 48 83 C4 28 C3
98	offset_sig_disp: 8
99	```
100
101	Output without backward expansion (`offset_sig_disp` is 0 or omitted):
102	```yaml
103	struct_name: CBaseEntity
104	member_name: m_skeletonInstance
105	offset: 0x278
106	size: 8
107	offset_sig: 8B 93 78 02 00 00
108	```
109
110	Minimal output (with `size=None`, `offset_sig=None`):
111	```yaml
112	struct_name: CBaseEntity
113	member_name: m_skeletonInstance
114	offset: 0x278
115	```
116
117	Each field:
118	- `struct_name` - Name of the struct/class
119	- `member_name` - Name of the struct member
120	- `offset` - Hex offset from struct start
121	- `size` (optional) - Size in bytes
122	- `offset_sig` (optional) - Unique byte signature of an instruction containing the offset (e.g., `8B 93 E0 04 00 00` for `mov edx, [rbx+4E0h]`)
123	- `offset_sig_disp` (optional) - Byte displacement from signature start to the target instruction. Only present when non-zero (backward expansion was used). Runtime: scan for `offset_sig`, then add `offset_sig_disp` to get the target instruction address.
124
125	## Platform Detection
126
127	The skill automatically detects the platform based on file extension:
128	- `.dll` → Windows
129	- `.so` → Linux
130
131	## Example Usage
132
133	### With all parameters
134
135	```python
136	struct_name = "CBaseEntity"
137	member_name = "m_skeletonInstance"
138	offset = 0x278
139	size = 8
140	offset_sig = "8B 93 78 02 00 00"
141	offset_sig_disp = None
142	```
143
144	### With backward-expanded signature
145
146	```python
147	struct_name = "CSkeletonInstance"
148	member_name = "m_animationController"
149	offset = 0x3A

People who liked this also viewed

6 picks

Type