en un clic
rev-symbol
// Restore function symbols by analyzing code patterns, strings, constants, and cross-references
// Restore function symbols by analyzing code patterns, strings, constants, and cross-references
Dump decrypted iOS app binaries (砸壳) from jailbroken devices using frida-ios-dump. Activate when the user wants to decrypt an iOS app, dump an IPA from a device, or extract a decrypted Mach-O binary for reverse engineering.
Reconstruct data structures by analyzing memory access patterns across functions
Generate Frida hook scripts using modern Frida API. Activate when the user wants to write Frida scripts, hook functions at runtime, trace calls or arguments or return values, intercept native or ObjC or Java methods, dump memory or exports, or handle native module load timing for Android and other targets.
IDAPython and IDALib script reference for reverse engineering. Activate when the user needs to write IDAPython scripts in IDA, use IDALib for headless analysis, operate on IDB databases, debug with IDA, manipulate memory/registers, traverse functions/blocks/instructions, work with Hex-Rays decompiler API, handle obfuscation, or batch-process binaries.
Dump Unity IL2CPP symbols from iOS/Android builds. Extract method names, addresses, and type info from IL2CPP binaries and global-metadata.dat, then generate IDA/Ghidra import scripts.
Dump DEX files from a running Android app for unpacking/deobfuscation. Activate when the user wants to unpack an Android APK, dump DEX from memory, extract decrypted DEX files, or defeat class-loading packing.
| name | rev-symbol |
| description | Restore function symbols by analyzing code patterns, strings, constants, and cross-references |
Analyze function code characteristics to recover/identify function symbols and names.
Determine which IDA access method is available:
Option A — IDA Pro MCP (preferred if connected):
Check if the IDA Pro MCP server is connected (look for an active ida-pro or equivalent MCP connection). If connected, you can query IDA directly via MCP tools — no exported files needed. Proceed with the analysis using MCP.
Option B — IDA-NO-MCP exported data: If MCP is not connected, check if IDA-NO-MCP exported data exists in the current directory:
decompile/ directory exists.c files insideIf neither MCP nor exported data is available, prompt the user:
No IDA access method detected. Choose one of the following:
Option A — IDA Pro MCP (recommended):
Connect the IDA Pro MCP server so Claude can query IDA directly.
Option B — IDA-NO-MCP export:
1. Download plugin: https://github.com/P4nda0s/IDA-NO-MCP
2. Copy INP.py to IDA plugins directory
3. Press Ctrl-Shift-E in IDA to export
4. Open the exported directory with Claude Code
./
├── decompile/ # Decompiled C code directory
│ ├── 0x401000.c # One file per function, named by hex address
│ ├── 0x401234.c
│ └── ...
├── decompile_failed.txt # Failed decompilation list
├── decompile_skipped.txt # Skipped functions list
├── strings.txt # String table (address, length, type, content)
├── imports.txt # Import table (address:function_name)
├── exports.txt # Export table (address:function_name)
└── memory/ # Memory hexdump (1MB chunks)
Each .c file contains function metadata comments and decompiled code:
/*
* func-name: sub_401000
* func-address: 0x401000
* callers: 0x402000, 0x403000 // List of functions that call this function
* callees: 0x404000, 0x405000 // List of functions called by this function
*/
int __fastcall sub_401000(int a1, int a2)
{
// Decompiled code...
}
Carefully examine the target function for:
0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x103254760xEDB88320ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0x63, 0x7C, 0x77, 0x7B...0x78, 0x9C (compression header)If you can identify a known algorithm through constants/structure, tell the user directly.
Analyze Callees (called functions):
Read functions in the callees list
For each callee, check if its address exists in imports.txt
Recognize call patterns even when symbols are missing:
Paired function patterns (identify by matching call pairs):
// malloc/free, new/delete, alloc/dealloc
xx = sub_A(0x100); // alloc: takes size, returns pointer
...
sub_B(xx); // free: takes the same pointer
// mutex_lock/mutex_unlock, pthread_mutex_lock/unlock
sub_A(lock_ptr); // lock
... // critical section
sub_B(lock_ptr); // unlock (same lock object)
// open/close, fopen/fclose, CreateFile/CloseHandle
fd = sub_A("/path", 0); // open: path + flags, returns handle
...
sub_B(fd); // close: takes the handle
// pthread_create/pthread_join
sub_A(&tid, 0, func, arg); // create: out param, attr, func, arg
...
sub_B(tid, &ret); // join: tid, out param
**Argument pattern recognition:**
```c
// socket(AF_INET, SOCK_STREAM, 0) - fixed constants
sub_XXX(2, 1, 0); // socket: domain=2, type=1, protocol=0
// connect/bind(sockfd, addr, addrlen)
sub_XXX(fd, &var, 16); // addr struct, len=16 for IPv4
// memcpy/memmove(dst, src, size)
sub_XXX(dst, src, n); // 3 params: dst, src, count
// memset(ptr, value, size)
sub_XXX(ptr, 0, 0x100); // 3 params: ptr, byte value, count
// read/write(fd, buf, count)
ret = sub_XXX(fd, buf, n); // returns bytes read/written
// strcmp/strncmp(s1, s2) or (s1, s2, n)
if (sub_XXX(s1, s2) == 0) // returns 0 on equal
Return value patterns:
// file/socket operations: -1 on error
if ((fd = sub_XXX(...)) == -1) goto error;
// allocation: NULL on failure
if (!(ptr = sub_XXX(size))) goto error;
// success/error: 0 = success
if (sub_XXX(...) != 0) goto error;
// strlen: returns size_t
len = sub_XXX(str);
sub_YYY(dst, src, len); // len used in memcpy
Analyze Callers (calling functions):
Collect the following information:
strings.txt for addresses used in the function)imports.txt)exports.txtBased on collected information:
First attempt local reasoning based on:
If uncertain, use Web Search to search:
0x67452301 0xEFCDAB89 algorithmrotate left xor constant algorithmfunction(int, int, 0) socket## Symbol Recovery Analysis: <function_address>
### Function Characteristics
- Strings: <list discovered strings>
- Constants: <list key constants>
- Called imports: <list>
### Cross-Reference Analysis
- Callers: <callers and their symbols>
- Callees: <callees and their symbols>
### Inference Result
- **Suggested symbol name**: <suggested_name>
- **Confidence**: High / Medium / Low
- **Reasoning**: <explain why this name is suggested>
### Similar Open Source Implementation
- <if similar open source code is found, provide link>