
If you're staring at stripped binaries in IDA Pro, this skill helps recover function names by analyzing code patterns, constants, and call relationships. It works with either the IDA Pro MCP server or exported decompilation data, then hunts for telltale signs like magic numbers (MD5 constants, CRC polynomials), paired function patterns (malloc/free, lock/unlock), and cross-references to known imports. The analysis is methodical: check internal characteristics first, trace caller/callee chains, then web search if needed. It's honest about confidence levels and shows its reasoning, which matters when you're deciding whether to trust a suggested symbol name. Beats manually grep-ing for constants and guessing at crypto implementations.
$ npx -y skills add p4nda0s/reverse-skills --skill rev-symbol --agent claude-codeInstalls into .claude/skills of the current project.
Analyze function code characteristics to recover/identify function symbols and names.
Determine which IDA access method is available:
Option A — IDA Pro MCP (preferred if connected):
Check if the IDA Pro MCP server is connected (look for an active ida-pro or equivalent MCP connection). If connected, you can query IDA directly via MCP tools — no exported files needed. Proceed with the analysis using MCP.
Option B — IDA-NO-MCP exported data: If MCP is not connected, check if IDA-NO-MCP exported data exists in the current directory:
decompile/ directory exists.c files insideIf neither MCP nor exported data is available, prompt the user:
No IDA access method detected. Choose one of the following:
Option A — IDA Pro MCP (recommended):
Connect the IDA Pro MCP server so Claude can query IDA directly.
Option B — IDA-NO-MCP export:
1. Download plugin: https://github.com/P4nda0s/IDA-NO-MCP
2. Copy INP.py to IDA plugins directory
3. Press Ctrl-Shift-E in IDA to export
4. Open the exported directory with Claude Code
Sponsors