# rev-struct

Reads memory accesses in decompiled functions and turns them into a struct definition with fields, offsets and a size estimate.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1900 installs · ★ 2314
- Author: P4nda0s
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/P4nda0s/reverse-skills/tree/HEAD/skills/rev-struct/SKILL.md
- Updated: 2026-05-06
- HTML: https://affpapa.org/en/nevibecode/skills/rev-struct

## What it does

Give the skill a function address and it reads the decompiled C for that function, then lists every offset access: direct, array-based, nested through a pointer. From there it walks the callers and callees to pick up what the function alone does not show — allocation size, field initialisation, a pointer handed off to another routine.

Offsets get merged and sorted, and the struct size comes out as the highest offset plus the size of the last field. Field types follow from how the field is used: a call through the pointer means a callback, passing it to `strlen` or `printf` means a string pointer, comparisons against constants mean flags. A function table at offset zero reads as a vtable, a next/prev pair as a list node.

Before any of that, the skill needs a data source. The preferred route is a connected IDA Pro MCP server, which lets it query IDA directly. Without MCP it looks for an IDA-NO-MCP export in the working directory: a `decompile/` folder with one `.c` file per function, plus `strings.txt`, `imports.txt`, `exports.txt` and memory dumps. If neither is present the skill stops and asks you to pick a route, so prepare the export before you start digging.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-struct -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/rev-struct/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/rev-struct/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-struct -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/rev-struct/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-struct -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/rev-struct/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install P4nda0s/reverse-skills rev-struct
```

2. **Manually: put the files in place**
- File: `.github/skills/rev-struct/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-struct -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/P4nda0s/reverse-skills --path skills/rev-struct
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/rev-struct/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add P4nda0s/reverse-skills --skill rev-struct -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/P4nda0s/reverse-skills/tree/HEAD/skills/rev-struct/SKILL.md

## When to use it
- recover a struct definition from decompiled code
- gather field offsets across several related functions
- estimate struct size from `malloc` call sites
- tell a callback field apart from a plain data field
- spot a vtable and list pointers inside a C++ object

## Example prompts
- recover the struct used by function 0x401000
- analyze memory accesses in sub_401000 and its callers
- build the field list from `decompile/0x401234.c`

## Similar
- [ghidra](https://affpapa.org/en/nevibecode/skills/ghidra.md) — skill · 652 installs
- [ghidra-headless](https://affpapa.org/en/nevibecode/skills/ghidra-headless.md) — skill · 507 installs
- [binary-analysis-patterns](https://affpapa.org/en/nevibecode/skills/binary-analysis-patterns.md) — skill · 10900 installs
- [ctf-rev](https://affpapa.org/en/nevibecode/skills/ctf-rev.md) — skill · 321 installs
- [binary-protection-bypass](https://affpapa.org/en/nevibecode/skills/binary-protection-bypass.md) — skill · 3700 installs
- [reverse-skill-router](https://affpapa.org/en/nevibecode/skills/reverse-skill-router.md) — skill · 1500 installs

From the same set: [p4nda0s/reverse-skills](https://affpapa.org/en/nevibecode/by/p4nda0s/reverse-skills.md) — 7 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md