From reverse-engineering
Restores function symbols and names from IDA-NO-MCP decompiled C code by analyzing strings, constants (MD5, CRC32, AES), code patterns, and cross-references to callers/callees/imports.
How this skill is triggered — by the user, by Claude, or both
Slash command
/reverse-engineering:rev-symbolThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Analyze function code characteristics to recover/identify function symbols and names.
Analyze function code characteristics to recover/identify function symbols and names.
First, verify that IDA-NO-MCP exported data exists in the current directory:
decompile/ directory exists.c files insideIf not found, prompt the user:
IDA-NO-MCP export data not detected.
Please export decompilation results using IDA-NO-MCP plugin first:
1. Download plugin: https://github.com/P4nda0s/IDA-NO-MCP
2. Copy INP.py to IDA plugins directory
3. Press Ctrl-Shift-E in IDA to export
4. Open the exported directory with Claude Code
./
├── decompile/ # Decompiled C code directory
│ ├── 0x401000.c # One file per function, named by hex address
│ ├── 0x401234.c
│ └── ...
├── decompile_failed.txt # Failed decompilation list
├── decompile_skipped.txt # Skipped functions list
├── strings.txt # String table (address, length, type, content)
├── imports.txt # Import table (address:function_name)
├── exports.txt # Export table (address:function_name)
└── memory/ # Memory hexdump (1MB chunks)
Each .c file contains function metadata comments and decompiled code:
/*
* func-name: sub_401000
* func-address: 0x401000
* callers: 0x402000, 0x403000 // List of functions that call this function
* callees: 0x404000, 0x405000 // List of functions called by this function
*/
int __fastcall sub_401000(int a1, int a2)
{
// Decompiled code...
}
Carefully examine the target function for:
0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x103254760xEDB88320ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0x63, 0x7C, 0x77, 0x7B...0x78, 0x9C (compression header)If you can identify a known algorithm through constants/structure, tell the user directly.
Analyze Callees (called functions):
Read functions in the callees list
For each callee, check if its address exists in imports.txt
Recognize call patterns even when symbols are missing:
Paired function patterns (identify by matching call pairs):
// malloc/free, new/delete, alloc/dealloc
xx = sub_A(0x100); // alloc: takes size, returns pointer
...
sub_B(xx); // free: takes the same pointer
// mutex_lock/mutex_unlock, pthread_mutex_lock/unlock
sub_A(lock_ptr); // lock
... // critical section
sub_B(lock_ptr); // unlock (same lock object)
// open/close, fopen/fclose, CreateFile/CloseHandle
fd = sub_A("/path", 0); // open: path + flags, returns handle
...
sub_B(fd); // close: takes the handle
// pthread_create/pthread_join
sub_A(&tid, 0, func, arg); // create: out param, attr, func, arg
...
sub_B(tid, &ret); // join: tid, out param
**Argument pattern recognition:**
```c
// socket(AF_INET, SOCK_STREAM, 0) - fixed constants
sub_XXX(2, 1, 0); // socket: domain=2, type=1, protocol=0
// connect/bind(sockfd, addr, addrlen)
sub_XXX(fd, &var, 16); // addr struct, len=16 for IPv4
// memcpy/memmove(dst, src, size)
sub_XXX(dst, src, n); // 3 params: dst, src, count
// memset(ptr, value, size)
sub_XXX(ptr, 0, 0x100); // 3 params: ptr, byte value, count
// read/write(fd, buf, count)
ret = sub_XXX(fd, buf, n); // returns bytes read/written
// strcmp/strncmp(s1, s2) or (s1, s2, n)
if (sub_XXX(s1, s2) == 0) // returns 0 on equal
Return value patterns:
// file/socket operations: -1 on error
if ((fd = sub_XXX(...)) == -1) goto error;
// allocation: NULL on failure
if (!(ptr = sub_XXX(size))) goto error;
// success/error: 0 = success
if (sub_XXX(...) != 0) goto error;
// strlen: returns size_t
len = sub_XXX(str);
sub_YYY(dst, src, len); // len used in memcpy
Analyze Callers (calling functions):
Collect the following information:
strings.txt for addresses used in the function)imports.txt)exports.txtBased on collected information:
First attempt local reasoning based on:
If uncertain, use Web Search to search:
0x67452301 0xEFCDAB89 algorithmrotate left xor constant algorithmfunction(int, int, 0) socket## Symbol Recovery Analysis: <function_address>
### Function Characteristics
- Strings: <list discovered strings>
- Constants: <list key constants>
- Called imports: <list>
### Cross-Reference Analysis
- Callers: <callers and their symbols>
- Callees: <callees and their symbols>
### Inference Result
- **Suggested symbol name**: <suggested_name>
- **Confidence**: High / Medium / Low
- **Reasoning**: <explain why this name is suggested>
### Similar Open Source Implementation
- <if similar open source code is found, provide link>
/reverse-engineering:rev-symbol 0x401000
or
/reverse-engineering:rev-symbol sub_401234
npx claudepluginhub carsalgut/reverse-skills --plugin reverse-engineeringRe-sources IDA binaries through recursive decompilation, function annotation, type reconstruction, structure recovery, and bottom-up program understanding workflows.
Decompiles binary functions to C-like pseudocode using VulHunt tools. Analyze function logic, control flow, or prepare for code pattern matching.
Performs depth-first reverse engineering on Ghidra binaries, answering questions like function behavior, crypto usage, or C2 addresses via iterative analysis and database improvements.