菜单
Decompile and analyze a function from Ghidra. Shows decompiled C code, switch statements, and cast operations. Use when investigating function structure or debugging type issues. Automatically resolves symbol names to correct functions. Need to skip sandbox to access Ghidra over network.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Run decomp-synth (the guided source-synthesis permuter) on a function — beam search over 112 behaviour-neutral C++ transforms (signed/unsigned, declaration reorder, branch polarity, variable extraction, …), each scored with objdiff, to drive a near-match toward 100%. Use when a function is below 100% and you want to automatically try source variations.
Diff stack-frame layouts between target and base for a function. Labels base-side slots with source variable names from a MSVC /Z7 CodeView recompile. Identifies SWAPPED pairs (decl-reorder candidates), SHIFTED slots, DIFFER (different variables in same slot), and TGT_ONLY / BASE_ONLY (extra/missing locals). Filters out callee-save slots.
Dump vtable layout for a class from original COFF .obj files. Maps each slot to the actual virtual function symbol AND its declaration-order name from the class header, so ICF-merged entries (OnlyReturns / merged_Returns1 / etc.) are still identifiable. Use when debugging vtable offset mismatches in objdiff.
Diff a DATA symbol (vtable ??_7Class@@6B@, RTTI, pointer/jump table, string pool, static initializer) between the target and the decompiled build, showing byte differences and — for each relocation slot — which function/symbol each side points to. Use when a data symbol is below 100%, or to find which vtable slot resolves to the wrong function. The MCP run_objdiff wrapper does not expose data diffs, so this calls objdiff-cli directly.
Run DC3's original Xbox 360 debug XEX on Xenia (Linux/Vulkan) and navigate to gameplay. Captures headless frames of menus, song select, loading, and in-game venues with 3D characters. Use when testing original binary behavior, capturing IK telemetry, or comparing Xbox vs native rendering.
Capture Vulkan API traces from the native port using GFXReconstruct. Works headless (no swapchain needed). Use when debugging rendering issues, analyzing GPU workload, or capturing frames for inspection.
| name | ghidra-decompile |
| description | Decompile and analyze a function from Ghidra. Shows decompiled C code, switch statements, and cast operations. Use when investigating function structure or debugging type issues. Automatically resolves symbol names to correct functions. Need to skip sandbox to access Ghidra over network. |
| argument-hint | [function-name-or-address] |
| allowed-tools | Bash(python3 tools/ghidra/switch_cast_inspect.py *), Bash(python3 tools/ghidra/pcode_export.py *), Bash(python3 tools/ghidra/pcode_inspect.py *) |
Decompile a function and analyze its structure for switch statements, casts, and type operations.
NOTE: You must skip the sandbox to talk to localhost. Ghidra is likely already running but you will see a failure if you use the sandbox's proxy!
$ARGUMENTS
Switch/cast analysis (the old pcode_inspect.py name is DEPRECATED — it still works via a shim that delegates here, but use switch_cast_inspect.py):
python3 tools/ghidra/switch_cast_inspect.py "FUNCTION" [--switches] [--casts]
For genuine Ghidra P-code (HIGH/RAW) use pcode_export.py — note it must run with the sandbox skipped (JVM/ICD); it manages its own private Ghidra project:
python3 tools/ghidra/pcode_export.py "FUNCTION" [--high|--raw] [--json]
Resolve the function - The argument can be:
RndWind::Handle)?Handle@RndWind@@UAA?AVDataNode@@PAVDataArray@@_N@Z)0x826703b0)Run decompilation:
python3 tools/ghidra/switch_cast_inspect.py "FunctionName"
For switch analysis only:
python3 tools/ghidra/switch_cast_inspect.py "FunctionName" --switches
For cast/type analysis only:
python3 tools/ghidra/switch_cast_inspect.py "FunctionName" --casts
Present results including:
INT_SEXT - Signed extension (extsb, extsh, extsw)INT_ZEXT - Zero extension (rlwinm masks)--address flag to treat input as raw address (skip symbol search)--no-decompile to only analyze raw bytes