write-globalvar-as-yaml

Write Global Variable IDA Analysis Output as YAML

Persist global variable analysis results to a YAML file beside the binary using IDA Pro MCP.

Prerequisites

Before using this skill, you should have:

1. Identified and renamed the target global variable
2. Generated a unique signature using /generate-signature-for-globalvar
3. An IDA Pro MCP session, resolved per mcp-ida-session.md: idb_list → idb_open (script fallback only if the endpoint is unreachable). Honor its IDB save discipline — an idle-TTL self-exit does not save.

Required Parameters

Note: gv_inst_offset is always 0 - the signature MUST start at the instruction that references the global variable.

Method

mcp__ida-pro-mcp__py_eval code="""
import idaapi
import os
import yaml

# === REQUIRED: Replace these values ===
gv_name = "<gv_name>"               # e.g., "IGameSystem_InitAllSystems_pFirst"
gv_addr = <gv_addr>                 # e.g., 0x180XXXXXX
gv_sig = "<gv_sig>"                 # e.g., "48 8B 1D ?? ?? ?? ?? 48 85 DB 0F 84 ?? ?? ?? ?? BD FF FF 00 00"
gv_sig_va = <gv_sig_va>             # e.g., 0x180XXXXXX (virtual address where signature matches)
gv_inst_length = <gv_inst_length>   # e.g., 7 (instruction length in bytes)
gv_inst_disp = <gv_inst_disp>       # e.g., 3 (displacement offset within instruction)
# ======================================

# Fixed value - signature must start at the GV-referencing instruction
gv_inst_offset = 0

# Get binary path and determine platform
input_file = idaapi.get_input_file_path()
dir_path = os.environ.get('CS2VIBE_ARTIFACT_DIR') or os.path.dirname(input_file)

if input_file.endswith('.dll'):
    platform = 'windows'
    image_base = idaapi.get_imagebase()
else:
    platform = 'linux'
    image_base = 0x0

gv_rva = gv_addr - image_base

data = {
    'gv_name': gv_name,
    'gv_va': hex(gv_addr),
    'gv_rva': hex(gv_rva),
    'gv_sig': gv_sig,
    'gv_sig_va': hex(gv_sig_va),
    'gv_inst_offset': gv_inst_offset,
    'gv_inst_length': gv_inst_length,
    'gv_inst_disp': gv_inst_disp,
}

yaml_path = os.path.join(dir_path, f"{gv_name}.{platform}.yaml")
with open(yaml_path, 'w', encoding='utf-8') as f:
    yaml.dump(data, f, default_flow_style=False, sort_keys=False)
print(f"Written to: {yaml_path}")
"""