Generate Signature For Structoffset

Generate Signature for Struct Offset

Generate a unique hex byte signature that locates an instruction containing a specific struct member offset (for example: mov [rcx+1A8h], eax, cmp dword ptr [rdi+0B0h], 0).

Core Concept

For struct-offset signatures, we signature the instruction containing the struct offset, not the function body itself.

Hard requirements:

1. The target instruction must be fully fixed (no wildcard bytes at all).
2. The displacement bytes carrying struct_offset in the target instruction must be explicitly included (not wildcarded).
3. Instructions other than the target instruction may use wildcarding.
4. Signature length grows by complete instruction boundaries and stops at the shortest unique prefix.

Strategy:

• Forward-only expansion: Expand only forward (after target instruction). The signature may extend beyond the current function boundary into CC padding or the next function. offset_sig_disp is always 0 — the signature always starts at the target instruction.

Prerequisites

• Target instruction address (the instruction that contains the struct offset)
• Expected struct_offset value (e.g. 0x1A8)
• IDA Pro MCP connection

Method

1. Generate and Validate Signature (Single Step)

Use a single py_eval call that:

• Validates the input instruction contains the expected struct_offset displacement.
• Collects instruction bytes from the target instruction forward, tests uniqueness.
• Forward-only expansion (no backward expansion — offset_sig_disp is always 0).
• Enforces no wildcard on the target instruction.
• Computes both VA and RVA for the target instruction.
• Outputs the shortest unique signature as struct_sig with metadata.

mcp__ida-pro-mcp__py_eval code="""
import idaapi, ida_bytes, idautils, ida_ua, ida_segment, json

def main():
    target_inst = 
    target_struct_offset =    # e.g. 0x1A8 from "mov [rcx+1A8h], eax"
    min_sig_bytes = 6
    max_sig_bytes = 96
    max_instructions = 64

    # --- Binary search wrapper (IDA 9.0+ find_bytes -> older bin_search fallback) ---
    def raw_bin_search(ea, max_ea, data, mask, flags=0):
        if hasattr(ida_bytes, 'find_bytes'):
            return ida_bytes.find_bytes(data, ea, range_end=max_ea, mask=mask, flags=flags)
        return ida_bytes.bin_search(ea, max_ea, data, mask, len(data), flags)

    f = idaapi.get_func(target_inst)
    if not f:
        print(json.dumps({
            "inst_va": hex(target_inst),
            "error": "target instruction is not inside a known function",
            "status": "failed"
        }))
        return

    insn0 = idautils.DecodeInstruction(target_inst)
    if not insn0 or insn0.size = insn.size:
                    continue

                sizes = []
                dsz = ida_ua.get_dtype_size(getattr(op, "dtype", getattr(op, "dtyp", 0)))
                if dsz > 0:
                    sizes.append(dsz)
                for s in (1, 2, 4, 8):
                    if s not in sizes:
                        sizes.append(s)

                for sz in sizes:
                    if off + sz > insn.size:
                        continue
                    unsigned_val = int.from_bytes(raw[off:off + sz], "little", signed=False)
                    signed_val = int.from_bytes(raw[off:off + sz], "little", signed=True)
                    expected_mod = expected & ((1  0 and offb  0 and offo = 2 and (raw_bytes[1] & 0xF0) == 0x80:
            for i in range(2, insn_obj.size):
                wild.add(i)
        elif 0x70  Use `struct_sig` directly as final signature.
- `status == "failed"` -> See Step 2.

### 2. Iterate if Needed

If Step 1 returns `status: "failed"`:
1. Increase `max_sig_bytes` (e.g. from `96` to `192`) and re-run Step 1.
2. Increase `max_instructions` (e.g. from `64` to `128`) if function instructions are short.
3. If still not unique, use a different instruction that references the same struct offset and re-run.

### 3. Continue with Unfinished Tasks

If we are called by a task from a task list / parent SKILL, restore and continue with the unfinished tasks.

## Output Format

Required:
- `struct_sig`: Space-separated hex bytes with `??` for wildcards.

Recommended metadata:
- `struct_sig_va`: VA of signature start (always equals target instruction VA since `offset_sig_disp` is always `0`).
- `offset_sig_disp`: Always `0` — signature always starts at the target instruction.
- `struct_inst_length`: Length of the target instruction in bytes.
- `struct_disp_offset`: Byte position of the struct offset displacement within the **signature** (= displacement position within target instruction, since `offset_sig_disp` is always `0`).
- `struct_disp_size`: Displacement byte size.
- `struct_offset`: The expected struct offset used for validation.

### Example Output

```yaml
struct_sig: "C7 81 A8 01 00 00 01 00 00 00 48 8B ?? ?? ?? ?? 48 85 C0 74 ??"
struct_sig_va: 0x180123456
offset_sig_disp: 0
struct_inst_length: 10
struct_disp_offset: 2
struct_disp_size: 4
struct_offset: 0x1A8

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: HLND2T
• Source: HLND2T/CS2_VibeSignatures
• License: MIT

Install and usage instructions live in the source repository linked above.