Write Vfunc As YAML

Write Virtual Function IDA Analysis Output as YAML

Persist virtual function analysis results to a YAML file beside the binary using IDA Pro MCP.

Prerequisites

Before using this skill, you should have:

1. Identified and renamed the target virtual function
2. Generated a unique signature using /generate-signature-for-function
3. Obtained vtable information using /get-vtable-index

Required Parameters

Optional Parameters

When func_addr is None, the following fields will be omitted from output: func_va, func_rva, func_size. When func_sig is None, the func_sig field will be omitted from output. When vfunc_sig is None, the vfunc_sig field will be omitted from output. When vfunc_sig_disp is None or 0, the vfunc_sig_disp field will be omitted from output.

Method

mcp__ida-pro-mcp__py_eval code="""
import idaapi
import os
import yaml

# === REQUIRED: Replace these values ===
func_name = "<func_name>"           # e.g., "CCSPlayerController_ChangeTeam"
# ======================================

# === OPTIONAL: Set to None to omit from output ===
func_addr = <func_addr>             # e.g., 0x180999830 or None
func_sig = <func_sig>               # e.g., "48 89 5C 24 08" or None
vfunc_sig = <vfunc_sig>               # e.g., "FF 90 80 04 00 00 4C 8B AC 24 ?? ?? ?? ??" or None
vfunc_sig_disp = <vfunc_sig_disp>     # e.g., 3 or None (0 also omitted)
# =================================================

# === VTABLE INFO: Replace these values ===
vtable_name = "<vtable_name>"       # e.g., "CCSPlayerController"
vfunc_offset = <vfunc_offset>       # e.g., 0x330
vfunc_index = <vfunc_index>         # e.g., 102
# =========================================

# Get binary path and determine platform
input_file = idaapi.get_input_file_path()
dir_path = os.environ.get('CS2VIBE_ARTIFACT_DIR') or os.path.dirname(input_file)

if input_file.endswith('.dll'):
    platform = 'windows'
    image_base = idaapi.get_imagebase()
else:
    platform = 'linux'
    image_base = 0x0

# Build data dictionary conditionally
data = {}

data['func_name'] = func_name

if func_addr is not None:
    func = idaapi.get_func(func_addr)
    func_size = func.size() if func else 0
    func_rva = func_addr - image_base
    data['func_va'] = hex(func_addr)
    data['func_rva'] = hex(func_rva)
    data['func_size'] = hex(func_size)

if func_sig is not None:
    data['func_sig'] = func_sig

if vfunc_sig is not None:
    data['vfunc_sig'] = vfunc_sig

if vfunc_sig_disp is not None and vfunc_sig_disp > 0:
    data['vfunc_sig_disp'] = vfunc_sig_disp

data['vtable_name'] = vtable_name
data['vfunc_offset'] = hex(vfunc_offset)
data['vfunc_index'] = vfunc_index

yaml_path = os.path.join(dir_path, f"{func_name}.{platform}.yaml")
with open(yaml_path, 'w', encoding='utf-8') as f:
    yaml.dump(data, f, default_flow_style=False, sort_keys=False, allow_unicode=True)
print(f"Written to: {yaml_path}")
"""

Output File Naming Convention

The output YAML filename follows this pattern:

• <func_name>.<platform>.yaml

Examples:

• server.dll → CCSPlayerController_ChangeTeam.windows.yaml
• libserver.so / libserver.so → CCSPlayerController_ChangeTeam.linux.yaml

Output YAML Format

Full output (with func_addr, func_sig, vfunc_sig, and vfunc_sig_disp provided):

func_name: CCSPlayerController_ChangeTeam
func_va: 0x180999830      # Virtual address - changes with game updates (optional)
func_rva: 0x999830        # Relative virtual address (VA - image base) - changes with game updates (optional)
func_size: 0x301          # Function size in bytes - changes with game updates (optional)
func_sig: 48 89 5C 24 08  # Unique byte signature (optional)
vfunc_sig: FF 90 30 03 00 00 4C 8B AC 24 ?? ?? ?? ??  # Unique byte signature for vfunc offset (optional)
vfunc_sig_disp: 3         # Byte displacement from vfunc_sig start to target instruction (optional, only when > 0)
vtable_name: CCSPlayerController
vfunc_offset: 0x330       # Offset from vtable start - changes with game updates
vfunc_index: 102          # vtable[102] - changes with game updates

Output without backward expansion (vfunc_sig_disp is 0 or omitted):

func_name: CCSPlayerController_ChangeTeam
func_va: 0x180999830
func_rva: 0x999830
func_size: 0x301
func_sig: 48 89 5C 24 08
vfunc_sig: FF 90 30 03 00 00 4C 8B AC 24 ?? ?? ?? ??
vtable_name: CCSPlayerController
vfunc_offset: 0x330
vfunc_index: 102

Minimal output (with func_addr=None, func_sig=None, vfunc_sig=None):

func_name: CCSPlayerController_ChangeTeam
vtable_name: CCSPlayerController
vfunc_offset: 0x330       # Offset from vtable start - changes with game updates
vfunc_index: 102          # vtable[102] - changes with game updates

Platform Detection

The skill automatically detects the platform based on file extension:

• .dll → Windows (uses idaapi.get_imagebase() for image base)
• .so → Linux (uses 0x0 as image base)

Trusted finalization

This writer produces a semantic YAML payload at the caller-provided expected artifact path. It does not own final field ordering, scalar spelling, encoding, or line endings. After runtime validation, the trusted analyzer rewrites every successful preprocessor or Agent output through the Source2 central canonicalizer; that canonical rewrite is the only byte-level trust boundary.

Notes

• All values marked "changes with game updates" should be regenerated when analyzing new binary versions
• The YAML file is written to the same directory as the input binary
• When func_addr is provided, func_size is automatically calculated from IDA's function analysis
• When func_addr is provided, func_rva is automatically calculated as func_va - image_base
• When func_addr / func_sig / vfunc_sig is None, those fields are omitted from the output entirely
• When vfunc_sig_disp is None or 0, the vfunc_sig_disp field is omitted from the output entirely (signature starts at the target instruction)
• vfunc_sig should be a signature generated by /generate-signature-for-vfuncoffset
• vfunc_sig_disp is the byte displacement from signature start to the target instruction, only needed when backward expansion was used
• This skill is specifically for virtual functions that have vtable information
• For regular functions without vtable, use /write-func-as-yaml instead