rev-struct — Claude Code skill: recover structs from memory access
Reads memory accesses in decompiled functions and turns them into a struct definition with fields, offsets and a size estimate.
npx skills add P4nda0s/reverse-skills --skill rev-struct -a claude-codeWhat rev-struct does
Give the skill a function address and it reads the decompiled C for that function, then lists every offset access: direct, array-based, nested through a pointer. From there it walks the callers and callees to pick up what the function alone does not show — allocation size, field initialisation, a pointer handed off to another routine.
Offsets get merged and sorted, and the struct size comes out as the highest offset plus the size of the last field. Field types follow from how the field is used: a call through the pointer means a callback, passing it to strlen or printf means a string pointer, comparisons against constants mean flags. A function table at offset zero reads as a vtable, a next/prev pair as a list node.
Before any of that, the skill needs a data source. The preferred route is a connected IDA Pro MCP server, which lets it query IDA directly. Without MCP it looks for an IDA-NO-MCP export in the working directory: a decompile/ folder with one .c file per function, plus strings.txt, imports.txt, exports.txt and memory dumps. If neither is present the skill stops and asks you to pick a route, so prepare the export before you start digging.
What it helps with
- recover a struct definition from decompiled code
- gather field offsets across several related functions
- estimate struct size from
malloccall sites - tell a callback field apart from a plain data field
- spot a vtable and list pointers inside a C++ object
Example prompts for the agent
- recover the struct used by function 0x401000
- analyze memory accesses in sub_401000 and its callers
- build the field list from
decompile/0x401234.c
How to install rev-struct
1Skills CLI (Vercel)
npx skills add P4nda0s/reverse-skills --skill rev-struct -a claude-code2Manually: put the files in place
~/.claude/skills/rev-struct/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/rev-struct/
1Skills CLI (Vercel)
npx skills add P4nda0s/reverse-skills --skill rev-struct -a codex2Manually: put the files in place
.agents/skills/rev-struct/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add P4nda0s/reverse-skills --skill rev-struct -a cursor2Manually: put the files in place
.cursor/skills/rev-struct/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install P4nda0s/reverse-skills rev-struct2Manually: put the files in place
.github/skills/rev-struct/SKILL.md1Skills CLI (Vercel)
npx skills add P4nda0s/reverse-skills --skill rev-struct -a gemini-cli2Platform CLI
gemini skills install https://github.com/P4nda0s/reverse-skills --path skills/rev-structManually: put the files in place
.devin/skills/rev-struct/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add P4nda0s/reverse-skills --skill rev-struct -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about rev-struct
How do I install rev-struct in Claude?
Run npx skills add P4nda0s/reverse-skills --skill rev-struct -a claude-code. The skill lands at ~/.claude/skills/rev-struct/SKILL.md.
What does rev-struct do?
It reads decompiled functions, collects offset accesses and outputs a draft struct definition with field types and a size estimate.
What does rev-struct need to run?
Either a connected IDA Pro MCP server, or an IDA-NO-MCP export in the working directory: a decompile/ folder of .c files plus the string, import and export tables.
