Write Patch As YAML

Write Patch as YAML

Persist a single patch analysis result to a YAML file beside the binary using IDA Pro MCP.

Prerequisites

Before using this skill, you should have:

1. Identified the patch name and determined patch_bytes
2. Generated a unique signature using /generate-signature-for-patch

Required Parameters

Optional Parameters

Method

mcp__ida-pro-mcp__py_eval code="""
import idaapi
import os
import yaml

# === REQUIRED: Replace these values ===
patch_name = "<patch_name>"             # e.g., "ServerMovementUnlock"
patch_sig = "<patch_sig>"               # e.g., "0F 86 AF 00 00 00 0F 57 C0 0F 2E C2"
patch_bytes = "<patch_bytes>"           # e.g., "E9 B0 00 00 00 90"
# ======================================

# === OPTIONAL: Set to None to omit from output ===
patch_sig_disp = <patch_sig_disp>       # e.g., 5 or None (0 also omitted)
# =================================================

# Get binary path and determine platform
input_file = idaapi.get_input_file_path()
dir_path = os.path.dirname(input_file)

if input_file.endswith('.dll'):
    platform = 'windows'
else:
    platform = 'linux'

# Build data dictionary conditionally
data = {}

data['patch_name'] = patch_name
data['patch_sig'] = patch_sig

if patch_sig_disp is not None and patch_sig_disp > 0:
    data['patch_sig_disp'] = patch_sig_disp

data['patch_bytes'] = patch_bytes

yaml_path = os.path.join(dir_path, f"{patch_name}.{platform}.yaml")
with open(yaml_path, 'w', encoding='utf-8') as f:
    yaml.dump(data, f, default_flow_style=False, sort_keys=False, allow_unicode=True)
print(f"Written to: {yaml_path}")
"""

Output File Naming Convention

The output YAML filename follows this pattern:

• <patch_name>.<platform>.yaml

Examples:

• server.dll → ServerMovementUnlock.windows.yaml
• server.so / libserver.so → ServerMovementUnlock.linux.yaml

Output YAML Format

Full output (with patch_sig_disp provided):

patch_name: ServerMovementUnlock
patch_sig: 48 85 C0 74 ?? E8 ?? ?? ?? ?? 0F 86 AF 00 00 00
patch_sig_disp: 5
patch_bytes: E9 B0 00 00 00 90

Standard output (without backward expansion, patch_sig_disp is 0 or omitted):

patch_name: ServerMovementUnlock
patch_sig: 0F 86 AF 00 00 00 0F 57 C0 0F 2E C2
patch_bytes: E9 B0 00 00 00 90

Each field:

• patch_name - Descriptive name of the patch
• patch_sig - Unique byte signature locating the instruction to patch
• patch_sig_disp (optional) - Byte displacement from signature start to the target instruction. Only present when non-zero (backward expansion was used). Runtime: scan for patch_sig, then add patch_sig_disp to get the target instruction address.
• patch_bytes - Replacement bytes to write at the patch location

Platform Detection

The skill automatically detects the platform based on file extension:

• .dll → Windows
• .so → Linux

Example Usage

Standard patch (forward-only signature)

patch_name = "ServerMovementUnlock"
patch_sig = "0F 86 AF 00 00 00 0F 57 C0 0F 2E C2"
patch_bytes = "E9 B0 00 00 00 90"
patch_sig_disp = None

Patch with backward-expanded signature

patch_name = "DisableSteamBanCheck"
patch_sig = "48 85 C0 74 ?? E8 ?? ?? ?? ?? 0F 84 AA 00 00 00"
patch_bytes = "90 90 90 90 90 90"
patch_sig_disp = 5

NOP a call instruction

patch_name = "SkipPrecacheCall"
patch_sig = "E8 AA BB CC DD 48 8B 5C 24 30"
patch_bytes = "90 90 90 90 90"
patch_sig_disp = None

Notes

• The YAML file is written to the same directory as the input binary
• When patch_sig_disp is None or 0, the patch_sig_disp field is omitted from the output entirely (signature starts at the target instruction)
• patch_sig should be a signature generated by /generate-signature-for-patch
• patch_bytes must have the same byte count as the original instruction being patched
• patch_sig_disp is the byte displacement from signature start to the target instruction, only needed when backward expansion was used