メニュー
Resolve a virtual function call through a sub-object vtable. Given (class, sub_object_offset, vtable_slot), identifies the actual function being called. Use when target assembly loads a vtable from (this+offset) and calls slot N.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Decompile and analyze a function from Ghidra. Shows decompiled C code, switch statements, and cast operations. Use when investigating function structure or debugging type issues. Automatically resolves symbol names to correct functions. Need to skip sandbox to access Ghidra over network.
Run decomp-synth (the guided source-synthesis permuter) on a function — beam search over 112 behaviour-neutral C++ transforms (signed/unsigned, declaration reorder, branch polarity, variable extraction, …), each scored with objdiff, to drive a near-match toward 100%. Use when a function is below 100% and you want to automatically try source variations.
Diff stack-frame layouts between target and base for a function. Labels base-side slots with source variable names from a MSVC /Z7 CodeView recompile. Identifies SWAPPED pairs (decl-reorder candidates), SHIFTED slots, DIFFER (different variables in same slot), and TGT_ONLY / BASE_ONLY (extra/missing locals). Filters out callee-save slots.
Dump vtable layout for a class from original COFF .obj files. Maps each slot to the actual virtual function symbol AND its declaration-order name from the class header, so ICF-merged entries (OnlyReturns / merged_Returns1 / etc.) are still identifiable. Use when debugging vtable offset mismatches in objdiff.
Diff a DATA symbol (vtable ??_7Class@@6B@, RTTI, pointer/jump table, string pool, static initializer) between the target and the decompiled build, showing byte differences and — for each relocation slot — which function/symbol each side points to. Use when a data symbol is below 100%, or to find which vtable slot resolves to the wrong function. The MCP run_objdiff wrapper does not expose data diffs, so this calls objdiff-cli directly.
Run DC3's original Xbox 360 debug XEX on Xenia (Linux/Vulkan) and navigate to gameplay. Captures headless frames of menus, song select, loading, and in-game venues with 3D characters. Use when testing original binary behavior, capturing IK telemetry, or comparing Xbox vs native rendering.
| name | resolve-vcall |
| description | Resolve a virtual function call through a sub-object vtable. Given (class, sub_object_offset, vtable_slot), identifies the actual function being called. Use when target assembly loads a vtable from (this+offset) and calls slot N. |
| argument-hint | <class_name> <sub_object_offset> <vtable_slot> |
| allowed-tools | Bash(python3 scripts/dump_vtable.py *), Read, Grep, Glob |
Resolve virtual function calls through sub-object pointers in MSVC PPC vtables.
$ARGUMENTS — three space-separated values:
class_name — Most-derived class (e.g., CharServoBone)sub_object_offset — Byte offset from this-ptr to vtable load (e.g., 8, 0x8)vtable_slot — Slot index in the vtable (e.g., 1). If >= 100, treated as byte offset and divided by 4.Run the resolver:
python3 scripts/dump_vtable.py resolve $ARGUMENTS
Present the results:
If resolution fails, the error will list available vtables with their sub-object offsets. Use this to find the correct offset.
??_7<class>@@6B<base>@@@ vtable symbols??_R4 (RTTI Complete Object Locator) at the end of each vtable to get the authoritative sub-object offsetlwz rN, OFFSET(this_reg) loading the vtable pointerlwz rN, SLOT_OFFSET(vtable_reg) → slot = SLOT_OFFSET / 4OnlyReturns) mean the function compiled to identical code as another — the positional name is the real function