CS2_VibeSignatures: Skill for Claude Code

Write Virtual Function IDA Analysis Output as YAML

Persist virtual function analysis results to a YAML file beside the binary using IDA Pro MCP.

Prerequisites

Before using this skill, you should have:

1. Identified and renamed the target virtual function
2. Generated a unique signature using /generate-signature-for-function
3. Obtained vtable information using /get-vtable-index

Required Parameters

Parameter	Description	Example
func_name	Name of the function	CCSPlayerController_ChangeTeam
vtable_name	Class name for vtable	CCSPlayerController
vfunc_offset	Offset from vtable start	0x330
vfunc_index	Index in vtable	102

Optional Parameters

Parameter	Description	Example
func_addr	Virtual address of the function (use None to omit)	0x180999830
func_sig	Unique byte signature to locate function body (use None to omit)	48 89 5C 24 08
vfunc_sig	Unique byte signature to determine vfunc offset (use None to omit)	FF 90 80 04 00 00 4C 8B AC 24 ?? ?? ?? ??
vfunc_sig_disp	Byte displacement from signature start to the target instruction. 0 or None means signature starts at the target instruction. Non-zero means backward expansion was used by /generate-signature-for-vfuncoffset. (use None to omit)	3

When func_addr is None, the following fields will be omitted from output: func_va, func_rva, func_size. When func_sig is None, the func_sig field will be omitted from output. When vfunc_sig is None, the vfunc_sig field will be omitted from output. When vfunc_sig_disp is None or 0, the vfunc_sig_disp field will be omitted from output.

Method

mcp__ida-pro-mcp__py_eval code="""
import idaapi
import os
import yaml

# === REQUIRED: Replace these values ===
func_name = "<func_name>"           # e.g., "CCSPlayerController_ChangeTeam"
# ======================================

# === OPTIONAL: Set to None to omit from output ===
func_addr = <func_addr>             # e.g., 0x180999830 or None
func_sig = <func_sig>               # e.g., "48 89 5C 24 08" or None
vfunc_sig = <vfunc_sig>               # e.g., "FF 90 80 04 00 00 4C 8B AC 24 ?? ?? ?? ??" or None
vfunc_sig_disp = <vfunc_sig_disp>     # e.g., 3 or None (0 also omitted)
# =================================================

# === VTABLE INFO: Replace these values ===
vtable_name = "<vtable_name>"       # e.g., "CCSPlayerController"
vfunc_offset = <vfunc_offset>       # e.g., 0x330
vfunc_index = <vfunc_index>         # e.g., 102
# =========================================

# Get binary path and determine platform
input_file = idaapi.get_input_file_path()
dir_path = os.environ.get('CS2VIBE_ARTIFACT_DIR') or os.path.dirname(input_file)

if input_file.endswith('.dll'):
    platform = 'windows'
    image_base = idaapi.get_imagebase()
else:
    platform = 'linux'
    image_base = 0x0

# Build data dictionary conditionally
data = {}

data['func_name'] = func_name

if func_addr is not None:
    func = idaapi.get_func(func_addr)
    func_size = func.size() if func else 0
    func_rva = func_addr - image_base
    data['func_va'] = hex(func_addr)
    data['func_rva'] = hex(func_rva)
    data['func_size'] = hex(func_size)

if func_sig is not None:
    data['func_sig'] = func_sig

if vfunc_sig is not None:
    data['vfunc_sig'] = vfunc_sig

if vfunc_sig_disp is not None and vfunc_sig_disp > 0:
    data['vfunc_sig_disp'] = vfunc_sig_disp

data['vtable_name'] = vtable_name
data['vfunc_offset'] = hex(vfunc_offset)
data['vfunc_index'] = vfunc_index

yaml_path = os.path.join(dir_path, f"{func_name}.{platform}.yaml")
with open(yaml_path, 'w', encoding='utf-8') as f:
    yaml.dump(data, f, default_flow_style=False, sort_keys=False, allow_unicode=True)
print(f"Written to: {yaml_path}")
"""