# Generate Signature For Structoffset

> |

- **Type:** Skill
- **Install:** `agentstack add skill-hlnd2t-cs2-vibesignatures-generate-signature-for-structoffset`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [HLND2T](https://agentstack.voostack.com/s/hlnd2t)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [HLND2T](https://github.com/HLND2T)
- **Source:** https://github.com/HLND2T/CS2_VibeSignatures/tree/main/.claude/skills/generate-signature-for-structoffset

## Install

```sh
agentstack add skill-hlnd2t-cs2-vibesignatures-generate-signature-for-structoffset
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Generate Signature for Struct Offset

Generate a unique hex byte signature that locates an instruction containing a specific struct member offset (for example: `mov [rcx+1A8h], eax`, `cmp dword ptr [rdi+0B0h], 0`).

## Core Concept

For struct-offset signatures, we signature the **instruction containing the struct offset**, not the function body itself.

Hard requirements:
1. The target instruction must be fully fixed (no wildcard bytes at all).
2. The displacement bytes carrying `struct_offset` in the target instruction must be explicitly included (not wildcarded).
3. Instructions other than the target instruction may use wildcarding.
4. Signature length grows by complete instruction boundaries and stops at the shortest unique prefix.

Strategy:
- **Forward-only expansion:** Expand only forward (after target instruction). The signature may extend beyond the current function boundary into CC padding or the next function. `offset_sig_disp` is always `0` — the signature always starts at the target instruction.

## Prerequisites

- Target instruction address (the instruction that contains the struct offset)
- Expected `struct_offset` value (e.g. `0x1A8`)
- IDA Pro MCP connection

## Method

### 1. Generate and Validate Signature (Single Step)

Use a single `py_eval` call that:
- Validates the input instruction contains the expected `struct_offset` displacement.
- Collects instruction bytes from the target instruction forward, tests uniqueness.
- Forward-only expansion (no backward expansion — `offset_sig_disp` is always `0`).
- Enforces **no wildcard on the target instruction**.
- Computes both VA and RVA for the target instruction.
- Outputs the shortest unique signature as `struct_sig` with metadata.

```python
mcp__ida-pro-mcp__py_eval code="""
import idaapi, ida_bytes, idautils, ida_ua, ida_segment, json

def main():
    target_inst = 
    target_struct_offset =    # e.g. 0x1A8 from "mov [rcx+1A8h], eax"
    min_sig_bytes = 6
    max_sig_bytes = 96
    max_instructions = 64

    # --- Binary search wrapper (IDA 9.0+ find_bytes -> older bin_search fallback) ---
    def raw_bin_search(ea, max_ea, data, mask, flags=0):
        if hasattr(ida_bytes, 'find_bytes'):
            return ida_bytes.find_bytes(data, ea, range_end=max_ea, mask=mask, flags=flags)
        return ida_bytes.bin_search(ea, max_ea, data, mask, len(data), flags)

    f = idaapi.get_func(target_inst)
    if not f:
        print(json.dumps({
            "inst_va": hex(target_inst),
            "error": "target instruction is not inside a known function",
            "status": "failed"
        }))
        return

    insn0 = idautils.DecodeInstruction(target_inst)
    if not insn0 or insn0.size = insn.size:
                    continue

                sizes = []
                dsz = ida_ua.get_dtype_size(getattr(op, "dtype", getattr(op, "dtyp", 0)))
                if dsz > 0:
                    sizes.append(dsz)
                for s in (1, 2, 4, 8):
                    if s not in sizes:
                        sizes.append(s)

                for sz in sizes:
                    if off + sz > insn.size:
                        continue
                    unsigned_val = int.from_bytes(raw[off:off + sz], "little", signed=False)
                    signed_val = int.from_bytes(raw[off:off + sz], "little", signed=True)
                    expected_mod = expected & ((1  0 and offb  0 and offo = 2 and (raw_bytes[1] & 0xF0) == 0x80:
            for i in range(2, insn_obj.size):
                wild.add(i)
        elif 0x70  Use `struct_sig` directly as final signature.
- `status == "failed"` -> See Step 2.

### 2. Iterate if Needed

If Step 1 returns `status: "failed"`:
1. Increase `max_sig_bytes` (e.g. from `96` to `192`) and re-run Step 1.
2. Increase `max_instructions` (e.g. from `64` to `128`) if function instructions are short.
3. If still not unique, use a different instruction that references the same struct offset and re-run.

### 3. Continue with Unfinished Tasks

If we are called by a task from a task list / parent SKILL, restore and continue with the unfinished tasks.

## Output Format

Required:
- `struct_sig`: Space-separated hex bytes with `??` for wildcards.

Recommended metadata:
- `struct_sig_va`: VA of signature start (always equals target instruction VA since `offset_sig_disp` is always `0`).
- `offset_sig_disp`: Always `0` — signature always starts at the target instruction.
- `struct_inst_length`: Length of the target instruction in bytes.
- `struct_disp_offset`: Byte position of the struct offset displacement within the **signature** (= displacement position within target instruction, since `offset_sig_disp` is always `0`).
- `struct_disp_size`: Displacement byte size.
- `struct_offset`: The expected struct offset used for validation.

### Example Output

```yaml
struct_sig: "C7 81 A8 01 00 00 01 00 00 00 48 8B ?? ?? ?? ?? 48 85 C0 74 ??"
struct_sig_va: 0x180123456
offset_sig_disp: 0
struct_inst_length: 10
struct_disp_offset: 2
struct_disp_size: 4
struct_offset: 0x1A8
```

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [HLND2T](https://github.com/HLND2T)
- **Source:** [HLND2T/CS2_VibeSignatures](https://github.com/HLND2T/CS2_VibeSignatures)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-hlnd2t-cs2-vibesignatures-generate-signature-for-structoffset
- Seller: https://agentstack.voostack.com/s/hlnd2t
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.