reconstruct-types

Reconstruct Types

Purpose

Module-wide type reconstruction from DeepExtractIDA analysis databases. Scans ALL functions in a module using x64 assembly to collect every memory access pattern, merges with vtable contexts and mangled name data, and produces compilable C/C++ header files with struct/class definitions.

Assembly is the sole evidence source -- it provides exact field sizes from instruction operands and is deterministic across Hex-Rays versions. Functions without assembly data are skipped.

This skill feeds directly into code lifting -- once you have accurate structs, every subsequent lift replaces raw pointer arithmetic with readable field access.

This is NOT security analysis. The goal is faithful type reconstruction, not vulnerability research.

When NOT to Use

• Lifting or rewriting decompiled functions to clean code -- use batch-lift
• Scanning for vulnerabilities in functions that use reconstructed types -- use ai-memory-corruption-scanner or ai-logic-scanner
• Understanding COM interfaces from vtable layouts -- use com-interface-reconstruction
• Tracing data flow through struct fields across functions -- use data-flow-tracer
• General function explanation -- use re-analyst or /explain

Data Sources

SQLite Databases (primary)

Individual analysis DBs in extracted_dbs/ contain per-function data:

• assembly_code -- sole evidence source: exact offsets/sizes from x64 instructions
• mangled_name -- decode class names, namespaces, inheritance
• vtable_contexts -- reconstructed class skeletons with virtual method tables
• function_signature / function_signature_extended -- parameter types

Generated Code (secondary)

extracted_code/{module}/file_info.json has function_summary with class/method groupings. Useful for orientation but lacks assembly and detailed xref data.

Finding a Module DB

Use the decompiled-code-extractor skill's find_module_db.py to locate a module's analysis DB: