generate-signature-for-globalvar

Generate Signature for Global Variable

Generate a unique hex byte signature that locates an instruction accessing a global variable using fully programmatic wildcard detection and validation — no manual byte analysis required.

Core Concept

Since global variable addresses change between binary updates, we don't signature the GV itself. Instead, we:

1. Find an instruction that references the global variable (mov/lea/cmp/etc.)
2. Generate a signature to locate that instruction
3. At runtime, parse the instruction to resolve the actual GV address

RIP-Relative Addressing (x86-64)

In x86-64, most global variable accesses use RIP-relative addressing:

GV_Address = Instruction_Address + Instruction_Length + RIP_Offset

Where:

• Instruction_Address = address found by pattern scan
• Instruction_Length = total bytes of the instruction (opcode + ModR/M + offset)
• RIP_Offset = signed 32-bit displacement (last 4 bytes of instruction)

Prerequisites

• Global variable address. qword_XXXXXX for example.
• IDA Pro MCP session, resolved per mcp-ida-session.md: idb_list → idb_open (script fallback only if the endpoint is unreachable). Honor its IDB save discipline — an idle-TTL self-exit does not save.

Method

1. Generate and Validate Signature (Single Step)

Use a single py_eval call that:

• Discovers candidate instructions accessing the GV via DataRefsTo
• Verifies each candidate resolves to the target GV via RIP-relative displacement
• Collects instruction stream with auto-wildcarding for each candidate
• Tracks instruction boundaries so prefixes always cover complete instructions
• Progressively tests at each instruction boundary via binary search
• Outputs the shortest unique signature with full metadata

Note: If you already know the GV-accessing instruction address, set target_inst = <inst_addr>. If you know the containing function, set target_func = <func_addr>.