Skip to content
Back to skills

2489 Gv Sig E5a149b2

ASecurity

`gv_sig` is the relocation signature for global-variable discovery, anchored at a GV-access instruction.

  • 9 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added October 11, 2026
data

Works with

  • mcp

Security analysis

A100/100

Scanned October 11, 2026

npx -y skills add tools-only/X-Skills --skill 2489-gv_sig_e5a149b2 --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of 2489 Gv Sig E5a149b2?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for 2489 Gv Sig E5a149b2
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/tools-only-2489-gv-sig-e5a149b2/badge)](https://www.skillsdirectory.com/skills/tools-only-2489-gv-sig-e5a149b2)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

SKILL.md
# gv_sig

## Overview
`gv_sig` is the relocation signature for global-variable discovery, anchored at a GV-access instruction.

## Field Context
- Related YAML fields: `gv_name`, `gv_va`, `gv_rva`, `gv_sig`, `gv_sig_va`, `gv_inst_offset`, `gv_inst_length`, `gv_inst_disp`.

## Generation Principle
- Canonical auto-generation is implemented by `preprocess_gen_gv_sig_via_mcp` in `ida_analyze_util.py`.
- Input anchor is known `gv_va`, optionally constrained by `gv_access_inst_va` / `gv_access_func_va`.
- Candidate GV-access instructions are discovered in priority order:
  1. explicit `gv_access_inst_va`
  2. instruction scan in `gv_access_func_va`
  3. fallback `DataRefsTo(gv_va)` code refs
- For each candidate instruction, RIP-relative displacement (`disp_i32`) is validated to resolve to `gv_va`.
- Signature is collected forward on instruction boundaries.
- Volatile bytes are wildcarded (`??`), including the GV displacement bytes themselves.
- Candidate acceptance requires:
  - exactly one `find_bytes(limit=2)` match
  - matched address equals candidate GV-access instruction address
- The shortest accepted candidate becomes `gv_sig`.
- Generator outputs `gv_sig_va`, `gv_inst_offset` (currently `0`), `gv_inst_length`, `gv_inst_disp`, and `gv_va/gv_rva`.

## Usage Method
- In `preprocess_gv_sig_via_mcp`, old `gv_sig` + `gv_inst_*` metadata are reused to relocate GV address in new binary.
- Flow:
  1. Load `gv_sig`, `gv_inst_offset`, `gv_inst_length`, `gv_inst_disp`.
  2. Unique-match `gv_sig` -> `gv_sig_va`.
  3. Compute instruction address: `inst_addr = gv_sig_va + gv_inst_offset`.
  4. Read instruction bytes (`gv_inst_length`) and parse displacement at `gv_inst_disp`.
  5. Recover GV address:
     `gv_va = inst_addr + gv_inst_length + disp_i32`.
  6. Recompute `gv_rva` and write updated GV YAML.

## Downstream Use
- Current dist gamedata updaters mainly consume function/offset/patch outputs.
- `gv_sig` is primarily used by analysis/preprocess relocation flow.

## Practical Notes
- Uniqueness must be instruction-level strict.
- Over-wildcarding hurts uniqueness; under-wildcarding hurts portability.
- `gv_inst_*` must stay consistent with RIP-relative disp32 model.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.