What is required to use the rev-symbol skill?

You need the IDA-NO-MCP plugin to export decompiled code from IDA Pro. The skill expects a specific directory structure including a 'decompile/' folder and associated metadata files.

Does it require an internet connection?

While it can perform local reasoning based on its knowledge base, it may use Web Search to verify unique code patterns or magic numbers against open-source implementations.

How does it handle functions without any strings or constants?

The skill uses cross-reference analysis to look at what other functions are called (callees) and what calls the target (callers), identifying patterns like memory allocation or socket operations.

Can it identify specific algorithms like AES or MD5?

Yes, it specifically scans for numeric constants and S-boxes associated with MD5, CRC32, Base64, AES, and other common algorithms to suggest accurate function names.

Symbol Recovery & Reverse Engineering

Name: Symbol Recovery & Reverse Engineering
Author: P4nda0s

byP4nda0s

•

Security & Testing

Restores function symbols and names by analyzing code patterns, cryptographic constants, and cross-references in decompiled binaries.

About

The rev-symbol skill is a specialized reverse-engineering tool designed to rebuild context in stripped or obfuscated binaries. By processing exports from the IDA-NO-MCP plugin, it identifies functions based on internal characteristics like magic numbers (MD5, AES S-Boxes) and external behavior like paired API calls (malloc/free, lock/unlock). It streamlines the analysis process by providing high-confidence symbol suggestions, helping security researchers and developers understand complex assembly logic through automated pattern recognition and cross-reference tracing.

Key Features

72 GitHub stars
Heuristic analysis of paired function call patterns for API recognition
Cross-reference (XREF) analysis of callers and callees to infer context
Integration with IDA-NO-MCP exported decompilation data
Automatic identification of cryptographic magic numbers and constants
Web-assisted search for unique code patterns and signature matching

Use Cases

Restoring function names in stripped firmware or legacy binaries
Mapping complex call chains during vulnerability research and security audits
Identifying hidden algorithms and encryption logic in malware samples

About

Key Features

72 GitHub stars
Heuristic analysis of paired function call patterns for API recognition
Cross-reference (XREF) analysis of callers and callees to infer context
Integration with IDA-NO-MCP exported decompilation data
Automatic identification of cryptographic magic numbers and constants
Web-assisted search for unique code patterns and signature matching

Use Cases

Restoring function names in stripped firmware or legacy binaries
Mapping complex call chains during vulnerability research and security audits
Identifying hidden algorithms and encryption logic in malware samples