rev-struct
Reconstruct data structures by analyzing memory access patterns across functions
By p4nda0s · 1,637 installs
npx skills add p4nda0s/reverse-skills --skill rev-struct
Source repository · Upstream listing
rev struct Structure Recovery
Recover data structure definitions by analyzing memory access patterns in functions and their call chains.
Pre check
Determine which IDA access method is available:
Option A — IDA Pro MCP (preferred if connected):
Check if the IDA Pro MCP server is connected (look for an active ida pro or equivalent MCP connection). If connected, you can query IDA directly via MCP tools — no exported files needed. Proceed with the analysis using MCP.
Option B — IDA NO MCP exported data:
If MCP is not connected, check if IDA NO MCP exported data exists in the current directory:
1. Check if decompile/ directory exists
2. Check if there are .c files inside
If neither MCP nor exported data is available, prompt the user:
Export Directory Structure
Function File Format (decompile/ .c)
Each .c file contains function metadata comments and decompiled code:
Structure Recovery Steps
Step 1: Read Target Function
1. Based on the user provided address, read decompile/<address .c
2. Parse function metadata, extract callers and callees lists
3. Identify pointer parameters in the function (potential structure pointers)
Step 2: Collect Memory Access Patterns
Search for the following patterns in the target function:
Direct offset access:
Array access:
Nested structures:
Record format:
Step 3: Traverse Callers for Analysis
Read each caller function and analyze:
1. Parameter passing : What is passed when calling?
2. Operations before/after the call :
3. Collect more offset accesses
Step 4: Traverse Callees for Analysis
Read each callee function and analyze:
1. How parameters are used :
2. Passed to other functions :
Step 5: Aggregate and Infer
1. Merge all offset information , sort by offset
2. Calculate struct size : max(offset) + last field size
3. Infer field types :
Called as function pointer → function pointer
Passed to strlen / printf → string pointer
Compared with constants → enum/flags
Increment/decrement operations → counter/index
4. Identify common patterns :
Offset 0 is a function pointer table → vtable (C++ object)
next/prev pointers → linked list node
refcount field → reference counted object
Output Format